I had another look at the package-support.json schema. It does allow versions with expiry dates, but I don't see a way to specify that doing security-only updates for a version.

https://github.com/nodejs/package-maintenance/blob/main/docs/PACKAGE-SUPPORT.md

The package-support.json file does not appear to have been adopted much, although it is not the only way of specifying the support info. Lots of the hits are for Commander!

https://github.com/search?q=path%3Apackage-support.json&type=code

I am tempted to delete the file! The new document covers similar material in a human readable way, so more accessible (since not widespread tooling supporting package-support.json).

This PR proposes bumping up the support for old releases from 6 months to 12 months to give users who want to stay on a supported version more time to upgrade. The commitment may mean more versions to backport for a CVE.

Comparing current situation with our past policies, as of today.

Proposed, 1 year. Two old versions. Oldest Node.js is 18 for 12.x (and 13.x).

Current version and previous (#2150, #1004). One old version. Oldest Node.js is 18.

Six month support (#1114). Zero old versions.

Release polices of some popular packages:

• https://typescript-eslint.io/users/releases/#older-versions
• https://github.com/terser/terser/security (very like out first page!)