Support, versions & advisories

Self-hosting means you run the software, but the support obligation is ours — a published policy so it is a contract, not a case-by-case conversation.

Which versions are supported

Security fixes and support cover the current minor and the one before it (x.Y.z and x.(Y-1).z). Older minors need an upgrade to keep receiving fixes. This is deliberate and small: supporting an unbounded tail of versions is how a self-host product quietly rots, so plan to stay within one minor of current. Versioning & upgrades explains how a version number tells you exactly how much care an upgrade needs.

Security advisories

When we publish a security advisory, the patch that fixes it is already available — the advisory and the release ship together, never "a fix is coming." Because a patch is guaranteed to carry no schema migration and no new required config, you apply it unattended with automatic rollback:

zynth-upgrade --patch

Air-gapped? Download the bundle for the fixed version and apply it offline — same safe sequence, no network — see Downloading releases.

Getting help: the support bundle

We cannot see your instance — that is the point of self-hosting. So when you need help, send a support bundle: a single tarball of the diagnostics we need to triage, generated on your box.

scripts/support-bundle.sh          # writes ./zynth-support-<host>-<timestamp>.tar.gz

It contains your running version and verified image digests, container and health status, the applied schema revision, recent logs, and your configuration.

No secret leaves your box. The bundle is sanitized before it is written, deny-by-default: every configuration value is redacted except an explicit allowlist of known-safe operational settings — so even a setting we add in a future version is redacted automatically, without anyone remembering to. Logs are additionally filtered for anything secret-shaped (tokens, bearer credentials, JWTs). It is still your data — glance through the tarball before you send it — but the default is closed, not open.

Attach the tarball to your support request with a short description of what you observed and when.