You should use 4.0 on all new sites you install WP All Import on. If you are installing WP All Import for the first time on a WordPress installation, use WP All Import 4.0.
You do not have to upgrade your existing sites. Upgrading is optional.
There are no known security issues in the latest 3.x release.
If we find out about a security issue in 3.x down the road, we will alert you via e-mail. As long as you didn't unsubscribe to our e-mails, you'll be notified if there is a security issue in 3.x that requires an upgrade to 4.x. One note about security: 4.0 has enhanced security for uploaded/imported files. In 3.x, these files can be publicly accessible if someone is able to guess the URL to the file - just like any other file stored in your /wp-content/ folder. In 4.0, we added a feature that randomizes the directory names the files are stored in, making it much less likely that someone would be able to guess.
Technical support will continue to be provided to 3.x users. We are happy to continue answering questions about how to use 3.x. If you need a bug fix though, you'll probably have to upgrade to 4.0, unless we opt to release a patch for 3.x - which we will only do for significant bugs.
If you have a site running 3.x that you have already set up and now it's just running on auto-pilot - there's no reason to upgrade. For example, maybe you set up a site for a client a while back, and it's running 3.x and working fine. There's no reason to upgrade that site to 4.0. Unless the client needs some new 4.0 only features.
We will not be continuing to update the 3.x branch to be compatible with changes to WordPress, nor will be updating the 3.x versions of our add-ons to be compatible with changes to WooCommerce or Advanced Custom Fields. If changes are made to WordPress, Advanced Custom Fields, or WooCommerce that break 3.x, you'll then need to upgrade to 4.0. However, it is highly unlikely WooCommerce, WordPress, or Advanced Custom Fields will make changes to the way they store data that are significant enough it will cause WP All Import to stop working.
If you are using the WPML add-on for WP All Import, don't upgrade to 4.0. We've discontinued the WPML add-on. You can still use it in 3.x, but it is no longer for sale and not compatible with 4.0.
