From c1da673b085a845a014db5b4c2f0e30bb205bd8a Mon Sep 17 00:00:00 2001 From: Timur Tukaev Date: Mon, 10 Aug 2026 19:02:50 +0500 Subject: [PATCH] docs(security): align the reporting paragraph with the undocumented backport rule The vulnerability-reporting paragraph named severity and upgrade impact as the basis for backporting to an older line, two paragraphs after the table says no rule is documented. Both sentences were added by this branch, so this is an internal inconsistency of its own making rather than inherited text. Point at the same absence instead of naming a basis. Assisted-By: Claude Signed-off-by: Timur Tukaev --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 9c852e4ff..2e57d0a1e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -28,7 +28,7 @@ This table describes the support the project provides in practice. It is not a c Applied today, the activity test classifies every `1.x` line from `1.0` to `1.6` as supported, because each has had a patch release within six months. That is a wide set, and it is deliberate rather than accidental — the project cuts minors frequently and adopters do not all move at that pace. It does not mean every line receives every fix: whether a given fix is backported to a given supported line is a maintainer decision taken per fix, and the project does not currently document a rule for it. The lower rows of the table are therefore forward-looking today: no `1.x` line has yet gone six months without a patch. -Reporting a vulnerability against a line with limited support or at end of life is still welcome. We will confirm whether the issue also affects a maintained line and fix it there; whether the fix is additionally backported to an older line is a maintainer decision based on severity and upgrade impact. +Reporting a vulnerability against a line with limited support or at end of life is still welcome. We will confirm whether the issue also affects a maintained line and fix it there; whether the fix is additionally backported to an older line is a maintainer decision taken per fix, on the same undocumented basis noted above. ## Reporting a Vulnerability