The Python Development Cycle page describes how python maintains versions. Here are some snippets:
17.1.1. In-development (main) branch
The master branch is the branch for the next feature release; it is under active development for all kinds of changes: new features, semantic changes, performance improvements, bug fixes.
17.1.2. Maintenance branches
A branch for a previous feature release, currently being maintained for bug fixes. There are usually two maintenance branches at any given time: one for Python 3.x and one for Python 2.x.
17.1.3. Security branches
A branch less than 5 years old but no longer in maintenance mode is a security branch. The only changes made to a security branch are those fixing issues exploitable by attackers such as crashes, privilege escalation and, optionally, other issues such as denial of service attacks.
So in addition to the main branch receiving new feature updates, there is a maintenance branch receiving general bugfixes for each of Python 2 and 3, and a number of other branches receiving security fixes. When bug/security fixes are applied, the micro/patch version (the third number in the version) is incremented. Here's a snapshot of what it looks like as of when this was written, from the same document:
17.1.4. Summary
There are 6 open branches right now in the Git repository:
- the master branch accepts features and bugs fixes for the future 3.8.0 feature release (RM: Łukasz Langa)
- the 3.7 branch accepts bug, regression, and doc fixes for the upcoming 3.7.0 feature release (RM: Ned Deily)
- the 3.6 branch accepts bug fixes for future 3.6.x maintenance releases (RM: Ned Deily)
- the 3.5 branch accepts security fixes for future 3.5.x security releases (RM: Larry Hastings)
- the 3.4 branch accepts security fixes for future 3.4.x security releases (RM: Larry Hastings)
- the 2.7 branch accepts bug fixes for future 2.7.x maintenance releases (RM: Benjamin Peterson)