According to VMware Tanzu Spring Framework 5 reached EOL two weeks ago. Spring Boot 2 reached EOL half an year ago.

VMware provides an extended commercial support about one year longer for every Spring version. What does it actually mean for an open-source project in this case (Spring is licensed by Apache License 2.0)?

• Will Tanzu hide the further patched code behind some protected Maven and GIT server?
• Will Tanzu provide extended versions of the library using some other license. It is legally possible?
• Will Tanzu reject all the patches and pull-requests provided by the community? How do they otherwise avoid their commercial patches leaking back to the community upstream?
• Will they continue maintain the community upstream but not create ready-to-use compiled jar-libraries?

NO, it is not a question about understanding of a licence. It is primarily a question about software development based on a library with a short release cycle. It is important for software development to understand, how long security patched are provided.