A Python branch in security mode receives only fixes for issues attackers can exploit, such as crashes, privilege escalation and, optionally, denial of service. Other bug fixes are not backported. A branch is a security branch once it is under five years old but no longer in bugfix mode, and it ends at end of life.
The lifecycle in plain terms
The Python developer guide describes a branch for each feature version. New features go to the main branch. When a release reaches beta, a maintenance branch is created for it, and bug fixing for later micro versions such as 3.14.1 happens there. After the final release, the previous version's branch eventually moves into security mode. The guide gives an example: the 3.11 branch went into security mode after the 3.11.9 bugfix release.
| Status | What the branch accepts |
|---|---|
| Feature | New features, semantic changes, performance work, bug fixes (the main branch) |
| Bugfix | Low-risk fixes and test or documentation edits, with compatibility kept between micro releases |
| Security | Fixes for issues exploitable by attackers, such as crashes and privilege escalation |
| End of life | Nothing, the branch is unsupported |
What the dates look like
The status page lists the current picture. When I checked on 19 October 2026, 3.15 and 3.14 were in bugfix status, and 3.13, 3.12 and 3.11 were in security status. The listed end of life dates were October 2029 for 3.13, October 2028 for 3.12 and October 2027 for 3.11. Python 3.10 was listed as end of life on 1 October 2026. The guide also says the cadence is a new feature version every October, with a five year support period for each (two years of full support, then three of security fixes, per PEP 602).
What this means for you
Security mode is a promise about one kind of fix. If your app hits an ordinary bug in a security-mode branch, the fix will not come from upstream. If a library you use drops support for your Python version, you can end up pinned to old releases of that library too.
There is also a quieter effect. A branch in security mode still releases fixes, so scanners keep finding patched versions. The day a branch reaches end of life, the fixes stop, and a scan may show no fixed version at all. That absence is easy to misread.
Steps
- List the Python version in every service, build image and CI job.
- Mark the end of life date next to each, using the developer guide's status page.
- Plan upgrades so no production workload is within six months of end of life.
- Test against the next branch in CI before you need it.
- Check that your key libraries still support the version you plan to move to.
- Record any exception, with an owner and an expiry date.
Try it yourself
Click through it at your own pace, or open it full screen. Find where a finding is tracked to closure, and think about what you would record if the fix never arrives upstream.
Quick check
Do security branches get new features?
No. The developer guide says only issues exploitable by attackers are fixed, and other changes are not backported.
How long is a Python version supported?
The Python Enhancement Proposal on the release calendar describes five years: two years of full support, then three more of security fixes.
Where is the current status?
The Status of Python versions page in the Python developer guide.
How Safeguard helps
Safeguard can help you keep the support dates in view. Its SBOM and dependency scanning list the exact versions you run, reachability analysis shows which known issues your code can actually reach, and policies and gates can stop a build that pulls in a version you have decided to retire. Autonomous remediation can open fix pull requests; it is off by default and every category starts on Manual. You can try the free scan on a manifest first.
Sources
- Python Developer's Guide, Status of Python versions: supported branches, statuses and end of life dates. Fetched 19 October 2026.
- Python Developer's Guide, Development cycle: maintenance and security branch definitions. Fetched 19 October 2026.
- Python Enhancement Proposal 602, Annual Release Cycle for Python: release cadence and support period. Fetched 19 October 2026.
Last reviewed: 19 October 2026.
