Audited releases and support

Every lazysite release is built by a gated pipeline, and the stable line carries a declared support commitment - so a customer site can sit on certified builds and keep receiving security fixes for years.

The release gates

A release cannot be cut unless it passes, among others:

• the full test suite
• coverage floors (a coverage breach blocks the release)
• security lints
• a strict software bill of materials (an undeclared dependency fails the release)
• a benchmark gate (a performance regression beyond tolerance fails)

The tarball is built reproducibly from a tagged commit with a SHA sidecar. The full engineering discipline behind the gates is described on the engineering page.

Certified stable releases

Builds are edge by default. A release certified for customer rollout is cut as stable, stamped into the release manifest - these are the builds that sites on the stable update channel accept.

Five-year support

The support period is five years from the first stable release (0.7.0). Security fixes are delivered on the stable release channel throughout, so a site pinned to stable keeps taking them without ever accepting uncertified builds.