LoginSign Up
← Back to all sparks
A

Asterisk

MEETINGS
Velocity5.0

Open-source framework for building voice, video and PBX communications.

www.asterisk.org ↗

Four parallel branches, one fix set — Asterisk's changelog is a backport ledger, not a feature list.

telephonymulti-branch-backportssecurity-releaseslts-maintenancerelease-candidates
◆Current state
Asterisk maintains mainline 20, 22 and 23 branches alongside a certified track, and lands each fix set across all of them at once. The June 25 batch was a coordinated security release resolving roughly 20 advisories on every branch simultaneously. The August 7 batch opens the next cycle with release candidates carrying identical commit, author and issue counts across 23.5.0, 22.11.0 and 20.21.0.
◆Where it's heading
The visible output is backport discipline rather than feature development. Release notes carry counts, tags and advisory IDs but no feature text, so the changelog reads as a stability and security ledger for a mature telephony core. The certified track deliberately lags mainline and picks up a smaller subset of each cycle.
◆Prediction
The three release candidates should promote to final within the project's usual short RC window, with the certified branch taking the same fixes a cycle later. Nothing in these entries points to feature work in flight.

◆Recent moves

  1. 11d ago

    Certified 22.8-cert4: 8 community-reported fixes

    A certified-track maintenance release — 13 commits from 6 authors resolving 8 reported issues, with no security advisories attached. The certified branch takes a narrower slice of the cycle than mainline, and this one carries no feature text at all.

    View source ↗
  2. 11d ago

    23.5.0-rc1 opens the cycle with 27 issues resolved

    The mainline release candidate for 23.5.0, gathering 38 commits from 16 authors against 27 reported issues and no security advisories. It is the head of a three-branch backport set rather than a standalone release.

    View source ↗
  3. 11d ago

    22.11.0-rc1 mirrors the 23.5.0 fix set

    The 22 branch takes the same cycle as 23.5.0-rc1 — matching commit, author and issue counts confirm one fix set fanned across branches. Reading it as separate work would double-count a single round of maintenance.

    View source ↗
  4. 11d ago

    20.21.0-rc1 carries the same set back to the LTS line

    The 20 LTS branch receives the identical backport set as 22.11.0 and 23.5.0. That an LTS line four majors back still tracks the current cycle one-for-one is the clearest signal of how this project treats long-term support.

    View source ↗
  5. 1mo ago

    23.4.1 security release resolves 20 advisories

    A dedicated security release clearing roughly 20 advisories at once, spanning a chan_unistim buffer overflow that crashes Asterisk, a NULL dereference in HTTP AMI digest auth, and reflected XSS in phone-provisioning error pages. Zero non-security issues resolved — this cycle was called for one reason.

    View source ↗
  6. 1mo ago

    22.10.1 takes the same 20-advisory security set

    The 22 branch's half of the coordinated June security release, carrying the same advisory list as 23.4.1. Publishing every branch on one day is how this project avoids leaving a supported line exposed.

    View source ↗