Understanding Versioning Schemes for Commercial and OSS Patches

Products

• VMware Tanzu Application Platform

Issue/Introduction

This article goes over versioning convention ($X.Y.Z$ vs. $X.Y.Z.W$) across Commercial and OSS repositories. Specifically, it addresses how CVE-only patches are distinguished from standard releases and determine whether 3-digit Commercial maintenance releases contain general updates or are limited strictly to security fixes.

Environment

 

Commercial Preview Repositories

Open Source Software (OSS) Releases

 

Resolution

1. Four-Digit Versioning ($X.Y.Z.W$)

• Scope: Reserved strictly for CVE fixes and regression fixes only across all components.

• Example ($7.1.0.1$): Contains only the security patch/CVE fix and any required regression fixes. No new features, non-critical refactoring, or unrelated updates are included.

2. Three-Digit Versioning ($X.Y.Z$)

• Scope: Represents a standard patch release.

• Example ($7.1.1$):

  • In OSS: Contains the CVE fixes introduced in prior 4-digit releases (e.g., $7.1.0.1$), alongside potential additional changes, enhancements, or non-critical bug fixes.

  • In Commercial Repositories: Primarily consists of dependency upgrades and critical bug fixes. Because commercial versions are in maintenance mode, non-essential changes are rarely introduced unless a bug is severe enough to warrant a backport.

 

Version Format	Release Type	What It Contains
$X.Y.Z.W$ (e.g., 7.1.0.1)	Special Security Patch	CVE fixes and regression fixes ONLY.
$X.Y.Z$ (e.g., 7.1.1)	Regular Patch Release	Cumulative CVE fixes (from $X.Y.Z.1$) + dependency upgrades, critical bug fixes, and general changes.

Note on Version Parity: Any regular release $X.Y.Z+1$ automatically inherits all CVE fixes previously released in $X.Y.Z.1$.