We have added a new page to yiiframework.com website called "release cycle". Its purpose is to clarify about how long a certain framework version will be supported.

Default policy is that after current major version release previous major version has:

• Two years of bug fixes.
• Three years of security and PHP compatibility fixes.

For example, in case Yii 3.0 would be released today, 2.0 would receive bugfixes till March 2021 and security fixes till March 2024.