[ANNOUNCEMENT] Xen stable branch support extended to 5 years of security support

[Cody Zuschlag <cody.zuschlag@xxxxxxxxxxxxxx>]

Statement from the Xen Committers and Core Maintainers

TL;DR: All Xen releases will now have long-term support, with up to five years of security support.

The Xen Committers and Core Maintainers have agreed to update the Xen Project stable branch support policy to better align with common industry expectations for long-term security maintenance.

Across open source infrastructure projects, a five-year security support window is increasingly the norm, particularly in embedded and automotive environments. Xen is already a strong fit in these domains, and clearer long-term guarantees help downstreams plan with confidence.

Historically, Xen releases have received approximately 1.5 years of full support, followed by security-only support up to 3 years total. With this change, we are extending:

- Full support to 3 years
- Security support to 5 years total for each release

Effective immediately, the support policy is as follows:

Xen 4.20 and later
- 3 years of full support (bug fixes and security fixes)
- Followed by 2 years of security-only support
- For a total of 5 years of security support

Xen 4.17 to 4.19
- Security-only support up to a total of 5 years from original release
- No general bug-fix backports

This policy is being adopted as a baseline, and we will actively monitor its impact on the stable and security maintenance effort. If experience shows this model to be unsustainable or otherwise unworkable, the Committers and Core Maintainers reserve the ability to revise the policy with minimal disruption.

Because all Xen releases follow the same support timelines, we intentionally avoid introducing LTS-branded branches. While the motivation aligns with traditional LTS goals, using LTS terminology can imply that only selected releases receive extended support. Our aim is consistent, predictable security support across all releases.

This update strengthens Xen’s position in embedded and automotive use cases, while keeping the stable and security maintenance effort sustainable and avoiding changes to release cadence.

The Xen Project website and documentation will be updated to reflect this policy.

Cross-posted to xen-devel and xen-announce.

Very best regards,

Cody Zuschlag

Xen Project - Community Manager