Rapid release cycles

[anantshri]

Rapid release cycles

[nex3]

We generally release whenever we have changes ready, as long as there aren't other changes that we expect to land immediately afterwards. There's not a particularly strong reason to have a feature ready and not make it available to users.

As an ahead-of-time preprocessor that doesn't have any built-in IO facilities beyond reading Sass files, Sass isn't likely to have security vulnerabilities. In the extremely unlikely case that it does, we'll release fixes as part of the standard release cycle. We don't have the resources to maintain multiple branches of the codebase over time.

I personally recommend that projects stay up-to-date using dependabot or similar tools. We try to avoid breaking changes whenever possible, so most releases will be fully compatible with previous ones. When breaking changes are unavoidable for CSS compatibility reasons, we produce deprecation warnings well before the breakage, so staying up to date will ensure you see deprecations in time to apply fixes before you're broken.