...
Current and the previous one minor release will receive active support and security updates by the core development team. As of April 2021, that means the 2.5.x, 2.4.x releases are maintained by the core development team. Implementers should upgrade to a stable recent build of their supported version which is at most 3 months old. Security fixes will prompt a new container build and the builds are linear so it is important to stay current. In addition, the OS packages are in the container so it either requires a new container from Grouper or a new subimage to patch/upgrade the OS and related files.
Before releasing all containers, security vulnerabilities listed in maven will be addressed by upgrading those third party libraries.
Note: v2.5+ (while it is a supported version) will be updated at least monthly. The v2.4 container is not receiving regular updates and requires a subimage build to get OS updates.
...