Update security policy regarding backporting patches #1961
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lgritz
reviewed
Jan 25, 2025
SECURITY.md
Outdated
| | 3.0.x | :warning: Only the most critical fixes, only if they can be easily backported. | | ||
| | 2.5.x | :warning: Only the most critical fixes, only if they can be easily backported. | | ||
| | <= 1.x | :x: No longer receiving patches of any kind. | | ||
| | main | :white_check_mark: :construction: All fixes immediately, although this branch is under development with potential unstabe ABI/API |
There was a problem hiding this comment.
Suggested change
| | main | :white_check_mark: :construction: All fixes immediately, although this branch is under development with potential unstabe ABI/API | |
| | main | :white_check_mark: :construction: All fixes immediately, although this branch is under development with potential unstable ABI/API |
SECURITY.md
Outdated
Comment on lines
74
to
75
| | 2.5.x | :warning: Patch releases considered in response to specific requests | ||
| | <= 1.x | :x: No longer receiving patches of any kind | |
lgritz
approved these changes
Jan 26, 2025
This wording captures our policy: we commit to fixes for main and the most recent minor release, but prior to that, discussed on a case-by-case basis. Better to leave it at than than attempt to be more specific, since those specifics can be determined based on the situation. Signed-off-by: Cary Phillips <[email protected]>
2.4 was the first release by the ASWF, recent enough to negotiate patches. Prior to that our knowledge is so limited, and CMake support was so fragile, that we should not even entertain the possibility. Signed-off-by: Cary Phillips <[email protected]>
cary-ilm
force-pushed
the
security-statement
branch
from
727cd84 to
29d1065
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This wording captures our policy: we commit to fixes for main and the most recent minor release, but prior to that, discussed on a case-by-case basis. Better to leave it at than than attempt to be more specific, since those specifics can be determined based on the situation.