How do I determine the most recommended (safest to use) version of Solidity?

Question

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests the following: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen time and time again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.

UPDATE: It seems that most of the bugs found in recent versions of Solidity have a tendency to affect all prior versions of Solidity. This supports the argument for using the latest version of Solidity.

Answer 1

Generally, you should always only use the latest released version available, no prior version whatsoever.

As far as I know, there has not been major exploits caused by a Solidity compiler error ever. Thus, the only non-subjective historic data point we have is that "any Solidity compiler version has always been safe."

Personally I prefer the major version that is one step behind the latest major, as major changes 0.7 -> 0.8 include more changes and more changes are likely to introduce more bugs.

However, some Solidity versions are objectively safer, like Solidity 0.8 because it includes "no unsafe math by default" semantics.