[yocto-ab] Yocto Project Compatible Version?

[akuster]

Hello all,

I had a inquire from a customer and they asked if we could update a 
package to a later version. The task is simple enough but I wondered how 
it would impact on being Yocto Compliant. Would I have to submit a patch 
against OE-core or can I put this update in my own layer? If I can 
update packages, what is keeping me from updating to master and still 
saying I am version "x" compliant? What are the bounds? I am seeking 
your guidance so I can inform my Employer on the correct course of action.

Kind regards,
Armin