Security Policy wording about support versions should be more direct

[robrwo]

@haarg has suggested

i think part of the confusion is the "Supported Versions" section
"The maintainer(s) will only commit to releasing security fixes for the latest version of x" implies a level of support being promised
but kind of indirectly
it implies there was already a level of support promised, and this sentence is clarifying it. but there never was any previous promise.

Possibly changing the wording to something more direct like

"The maintainer(s) will release security fixes for the latest version of X. Security fixes for earlier versions will be released at the maintainer(s) discretion."

[stigtsp]

"The maintainer(s) will release security fixes for the latest version of X. Security fixes for earlier versions will be released at the maintainer(s) discretion."

The last sentence seems a bit redundant and legalese. I think its uncommon for OSS upstream projects to backport security fixes, and on CPAN the only example I can think of would be major versions of perl.

What about: "Only the latest version will receive security updates"?

[robrwo]

What about: "Only the latest version will receive security updates"?

I prefer "The maintainer(s) will release security fixes for the latest version of X". It says who is releasing the fix for what, and it doesn't rule out fixes for earlier versions. We don't need the second sentence.

[robrwo]

Maybe "The latest version of X will receive security fixes." It is obvious that it's the maintainers.

We really do need to trim the recommended wording down.

[haarg]

What about: "Only the latest version will receive security updates"?

The "only" is my primary complaint about the original sentence. It implies that you are noting an exception to some previous statement. But nothing in the document until then has established that any security updates should be expected.

@robrwo's two suggestions above fix that problem. Either one reads acceptably to me.

I think that a sentence like this should also be included in the summary.

[robrwo]

See #125