Moderator
Jan Dembowski
(@jdembowski)
Forum Moderator and Brute Squad
Could anyone tell me what the official stance on supporting 2.x (2.9?) with security patches is, now that 3.x has been released?
I don’t know if there is an official posting on this, but usually only the current version is maintained for security patches.
If some critical upgrade-or-die vulnerability for 2.9.x is discovered, and upgrading to 3.0 is the solution, then odds are good that there will be no patch released.
Moderator
James Huff
(@macmanx)
Volunteer Moderator
When WordPress 2.1 was released, the volunteers made a great effort to continue the development of security fixes in the 2.0.x branch. Unfortunately, they were not able to continue. This blog post (excerpt below) details the difficulty of supporting security fixes on the deprecated branch. Given this, I’d assume that security support for the 2.9.x branch is probably over.
Many of the security improvements to the new versions of WordPress in the last couple of years were complete reworks of how various systems were handled. Porting those changes to the 2.0.x branch would have been a monumental task and could have introduced instability or new bugs. We had to make hard decisions between stability and merging in the latest security enhancements. Additionally, far fewer people stayed on the 2.0.x branch than we anticipated. I take that as a testament to the new features in WordPress and perhaps even more the features offered by plugins, many of which don’t support older versions of WordPress!
I’m disappointed that we weren’t able to keep the branch maintained until 2010, but since one of the big reasons for that failure was the massive scope of our security improvements for the newer versions of WordPress, 2.0.x doesn’t die in vain!
