Starting with 0.3.0, Istio is released and published every month and the monthly releases can all be found on https://github.com/istio/istio/releases. Each monthly release has its own minor version number, while the patch version indicates important bug fixes in the corresponding monthly release. You can find more information about version semantic, cadence, and support in Istio Release Principles.
Internally, Istio releases are cut, tested, and qualified every day. And once a week, a daily release will go through stability and performance testing to detect regression. The monthly release mentioned above is promoted from a weekly release that passed all functional, stability, and performance testing. You can find more information about this process in Istio OSS release train.
The test/release working group is currently working on release train automation. As of 2017 Q4, it is in alpha state that produces daily, monthly, and patch releases automatically, under manual supervision. Once the process is all ironed out, daily, weekly, and monthly releases will be entirely automatic. Patch releases can be requested by developers to fix severe bugs.
When a severe bug is found, developers can contact [email protected] and [email protected] to create a patch release on all currently supported releases. Only bugs that affect stability and security are qualified, while minor problems and new features must wait for the next monthly release.
Currently, the test/release group handles all patch releases. In future, we expect to distribute that work load to developer on-call.