Elgg vs MSPbots

Elgg is running a two-branch release cadence: a 7.0.x line taking bug fixes and a 6.3.x line receiving backports. The recent pairs shipped within two hours of each other — 7.0.5 carrying a single performance fix that stops likes generating ajax response data for unsupported entities, while 6.3.8 carries the longer list: improved sanitization of installer config values, a valid client IP for the core, embedded-image handling in notification emails, mute-option validation, and a permission check before a profile header image can be changed. Contributor counts stay in the low single digits with the same one or two maintainers on nearly every release.

This is a mature project maintaining a stable base rather than pushing new capability, and the balance between the branches is worth noting: the older 6.3 line is receiving more substantive hardening than the current 7.0 line, which has already settled into single-commit patches. That is what a project looks like when most of its deployments have not migrated yet. The 6.3.8 items — input sanitization, permission validation before a mutating action — are the security-shaped fixes that earlier 6.3 releases summarised only as 'small security update'.

Expect the alternating pattern to continue: 7.0.x patches as issues surface, with matching 6.3.x backports carrying the hardening work, until a 7.1 cycle opens. The entries give no indication of when that might be.