Version 1.1 — 20 October 2026. Referred to by the Loam Licence, condition 6.
Lines and what they receive
Loam is released in lines: 3.x, 4.x. A line begins with its first release and is listed below with its dates.
- The current line receives fixes, security fixes and new behaviour, as signed releases you pull through the update service.
- Every line receives security fixes for five years from its first release, as patch releases on that line. Security fixes are free: any licensed installation on a supported line — every licence comes with its key — may pull them, whether or not its update term is current. Fixes reach an installation through its key: without one there is no channel to deliver them on, and no installation to deliver them to.
- After five years a line is end of life: it runs, but nothing is fixed.
| Line | First release | Security fixes until |
|---|---|---|
| 3.x | 11 October 2026 | 11 October 2031 |
A release says what it changes in its notes, and loam update --check tells an installation whether it can take it. What a release changes on a site, migrate carries, on detection — never on version.
Reporting a vulnerability
Mail [email protected]. Anyone may report — no key is needed. Do not report in public. We confirm receipt within three working days, work with you on the fix, and agree with you when and how it is made known. A fix ships as a signed patch release on every supported line, with release notes that name the issue once the fix is out; we are glad to credit you there if you wish. The same details are at /.well-known/security.txt.
Where a vulnerability in loam is actively exploited, or a serious incident affects it, we report it to the competent national CSIRT and ENISA as the Cyber Resilience Act requires — an early warning within 24 hours, a notification within 72 hours, a final report within 14 days — and we tell installation owners through the release notes and the address on their licence.
Hosts
Loam supports the PHP versions that PHP itself supports, on the host contract loam health prints: php 8.3 or later with the listed extensions, nginx or php -S, git, bash. A host outside that contract is not supported.
What support is, and what it is not
Support is the engine: its documentation (read through the gate), its release notes, fixes on supported lines, and answers to questions about loam from licensed installations — name the installation's domain — at [email protected], on a best-effort basis. There is no response-time commitment unless agreed separately.
Support is not your site. Building or changing a site or a theme, hosting, backups, and your own clients' questions belong to whoever delivered the site to you, under their terms — Braaf for sites it builds, a platform for the sites it provides.
Keeping an installation supported
Stay on a supported line and pull releases within a reasonable time; let loam health and loam audit run; give keys sparingly and to people you know; serve only themes you trust. An installation that does not is the owner's to carry (Loam Licence, condition 5). An installation without its key, or with a modified engine, is outside support: it cannot be reached by a fix, and what runs on it cannot be known.