Version Support & Lifecycle Policy

GateLLM is a self-hosted software product that customers download and deploy on their own infrastructure. This policy clarifies the maintenance cycle, security-patch support window, upgrade path, and end-of-life (EOL) schedule for each version, helping customers plan upgrades and compliance.

GateLLM uses semantic versioning (MAJOR.MINOR.PATCH). The release cadence and support windows are as follows; we commit to maintaining at least these minimum standards and may provide longer support.

GateLLM versions fall into three categories:

• PATCH versions (x.y.Z): bug fixes and security patches, no breaking changes. Expected every 2-4 weeks.
• MINOR versions (x.Y.0): new features and improvements, backward compatible (no breaking changes to existing APIs and config). Expected every 1-3 months.
• MAJOR versions (X.0.0): include breaking changes, may require migration. Expected no more than once per year.
• LTS (Long-Term Support) versions: selected from specific MINOR versions, providing extended security-patch support (see Section 4).

We maintain the following versions simultaneously:

• Latest stable version: full feature and security support; recommended for all customers.
• Previous MINOR version (N-1): receives critical security patches and severe bug fixes, but no new features.
• LTS version: receives security patches until its EOL date (see Section 4).

The support window for each version is as follows (calculated from the version's release date):

• Latest stable version: supported until 90 days after the next stable version is released.
• N-1 version: supported until 6 months after its release.
• LTS version: security-patch support for at least 18 months from the LTS version's release date.
• Security patches for MAJOR versions: the previous MAJOR version continues to receive security patches for at least 6 months after a new MAJOR release, providing a migration window.

Security patches follow this policy:

• The remediation timeline for security vulnerabilities is in the Vulnerability Disclosure Policy (Critical 7 days / High 30 days / Medium 60 days / Low 90 days).
• Security patches are released as PATCH versions by default, backported to the latest stable version, the N-1 version, and supported LTS versions.
• EOL versions do not receive security-patch backports; to obtain a patch, upgrade to a supported version.
• Security-related fixes are annotated with CVE IDs or vulnerability summaries in the changelog (after the coordinated disclosure window).
• Security vulnerabilities reported by customers are handled via security@gatellm.io (see the Vulnerability Disclosure Policy).

Vulnerability Disclosure Policy

GateLLM upgrades are designed to be smooth:

• PATCH/MINOR upgrades: backward compatible; typically just replace the image / redeploy Helm, with no config or data migration needed.
• MAJOR upgrades: may include breaking changes; we provide a Migration Guide and Changelog annotating all breaking changes and required migration steps.
• Config & data compatibility: GateLLM config uses a versioned schema with automatic migration on upgrade; database migrations are applied automatically at startup (see the deployment docs).
• License compatibility: licenses are universal within the same MAJOR version; if a cross-MAJOR upgrade requires a new license, this is announced in the release notes in advance.

We notify customers in advance of the following changes via the documentation site, release notes, and the email registered in their account:

• Announcing a new LTS version: at least 30 days in advance.
• Announcing a version EOL: at least 90 days in advance.
• MAJOR version release: the release plan and migration guide are published at least 60 days in advance.
• License policy changes: 90 days in advance, not retroactive to purchased licenses.

The relationship between GateLLM licenses and version support:

• A purchased license may use the latest version available at the time during its validity period; the license is not bound to a specific version number.
• After license expiry: a deployed instance may continue to run (license validation is based on the validity period at issuance), but no longer has access to new versions and security patches — renewing is recommended to maintain a supported state.
• After renewal, access to the latest versions and patches is restored.
• Specific license terms are governed by the Terms of Service.

Terms of Service

For version support and upgrade questions: support@gatellm.io. For security-patch-related questions: security@gatellm.io.

Incident Response & Support · Security & Compliance