This documentation site is for the versions of Synapse maintained by the Matrix.org Foundation (github.com/matrix-org/synapse), available under the Apache 2.0 licence.
If a bug is found after release that is deemed severe enough (by a combination
of the impacted users and the impact on those users) then a bugfix release may
be issued. This may be at any point in the release cycle.
Security will sometimes be backported to the previous version and released
immediately before the next release candidate. An example of this might be:
Day 0: Synapse N - 1 is released.
Day 7: Synapse (N - 1).1 is released as Synapse N - 1 + the security fix.
Day 7: Synapse N release candidate 1 is released (including the security fix).
Depending on the impact and complexity of security fixes, multiple fixes might
be held to be released together.
In some cases, a pre-disclosure of a security release will be issued as a notice
to Synapse operators that there is an upcoming security release. These can be
found in the security category of the Matrix blog.