Unify release family lifecycle policy source

[aljo242]

Summary

• Make sdk/latest/release-family the canonical source for lifecycle/support window policy.
• Remove duplicated lifecycle timeline content from sdk/latest/security/security-policy and replace with explicit pointer text.
• Keep security-policy focused on security process while linking lifecycle/EOL details to the canonical page.

Test plan

• Verified links point to /sdk/latest/release-family and /sdk/latest/security/security-policy as intended.
• Reviewed rendered markdown diffs for clarity and non-contradictory wording.
• Run docs site preview in CI.

Made with Cursor

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
cosmos-docs	🟢 Ready	View Preview	Apr 29, 2026, 7:06 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[greptile-apps]

Greptile Summary

This PR restructures cross-linking between release-family.mdx and security-policy.mdx so that lifecycle/EOL policy has a single authoritative home. The intent is correct, but the execution is incomplete.

• Content gap: release-family.mdx is declared the canonical source for lifecycle policy, yet the one-year maintenance window, cadence policy, EOL notices, and future-family details that were deleted from security-policy.mdx are absent from release-family.mdx. Readers following the pointer will find no lifecycle information at all.
• next/ not synced: Both sdk/next/release-family.mdx and sdk/next/security/security-policy.mdx retain the old pre-PR wording, violating the repo's CLAUDE.md requirement to run scripts/sync-latest-to-next.js after editing latest/ files.

Confidence Score: 3/5

Not safe to merge: lifecycle policy content has been deleted without being relocated, and next/ pages are out of sync.

Two P1 findings: the claimed canonical page is missing the substantive content that was removed from security-policy, and the required next/ sync was skipped. The structural goal of the PR is sound, but in its current state it leaves the docs worse than before.

sdk/latest/release-family.mdx needs the lifecycle policy details added; sdk/next/release-family.mdx and sdk/next/security/security-policy.mdx need to be synced.

Important Files Changed

Filename	Overview
sdk/latest/release-family.mdx	Declared as the canonical lifecycle source, but the lifecycle policy details (maintenance windows, EOL notices, cadence) removed from security-policy.mdx were never added here; also not synced to next/.
sdk/latest/security/security-policy.mdx	Lifecycle content correctly removed and replaced with pointers to release-family.mdx, but the destination page is missing the content; next/ counterpart also not updated.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["User reads about lifecycle policy"] --> B{"Which page?"}
    B --> C["security-policy.mdx\n(latest/)"]
    B --> D["release-family.mdx\n(latest/)"]
    C -->|"Pointer: 'See Release Families page'"| D
    D -->|"Declared canonical"| E["Expected: lifecycle details\n(1-yr window, EOL, cadence)"]
    E -->|"MISSING — content was\ndeleted, never added here"| F["❌ Dead end — no lifecycle info found"]
    C -->|"Pointer also in next/"| G["release-family.mdx\n(next/)"]
    G -->|"Still points BACK to\nsecurity-policy as canonical"| H["⚠️ next/ out of sync\nwith latest/ changes"]

Loading

Comments Outside Diff (1)

1. sdk/latest/release-family.mdx, line 1-10 (link)

   next/ counterpart not synced

   Per the repository's CLAUDE.md, editing files in latest/ requires running node scripts/sync-latest-to-next.js to apply the same changes to next/. Both sdk/next/release-family.mdx and sdk/next/security/security-policy.mdx still contain the old pre-PR content:

   • sdk/next/release-family.mdx line 8 still reads: "For lifecycle policy and maintenance windows, see the Security and Maintenance Policy" (pointing the wrong way)
   • sdk/next/security/security-policy.mdx still contains the full removed lifecycle sections

   This leaves the next/ docs inconsistent with the latest/ changes made in this PR.

   Context Used: CLAUDE.md (source)

_{Reviews (1): Last reviewed commit: "Unify release family lifecycle policy so..." | Re-trigger Greptile}

[greptile-apps]

Claimed canonical page missing lifecycle details

release-family.mdx is now declared the canonical source for lifecycle policy, but the content that was removed from security-policy.mdx was never added here. Readers who follow the pointer will find no information about:

• The one-year maintenance window policy
• The two-families-per-year cadence
• What happens when a successor family is delayed
• EOL notices (CometBFT v0.37.x, ibc-go v0.7.x, SDK v0.50.x)
• Future family evolution

The lifecycle policy has been effectively deleted from both pages, not consolidated.

[aljo242]

Addressed review feedback in commit 2de6838:\n\n- Added lifecycle and EOL policy details to so the canonical page contains substantive policy content.\n- Synced counterparts (, ) to match the latest changes.\n- Added branch work-log entry per repo guidance.

[aljo242]

Follow-up after review:\n\n- Added lifecycle and EOL policy details directly to sdk/latest/release-family.mdx so the canonical page now contains substantive policy content.\n- Synced next pages with matching updates in sdk/next/release-family.mdx and sdk/next/security/security-policy.mdx.\n- Added the required branch work log entry in work-log/docs-chore-single-source-release-family-policy.md.

[mattac21]

Release cadence targets two new release families per year

should we be saying this? I dont think this is necessarily true (we are trying to do more smaller releases as part of our maintainability goal) and this feels unnecessary to call out.