kingchenc
099ae66b57
Version bump for the 0.5.0 release, which ships the relicense to MIT OR Apache-2.0. Stacked on #158 (base branch `chore/relicense-mit-apache`) so this PR's diff is the bump only. After #158 merges to main, GitHub retargets this PR to main; merge it, then tag `v0.5.0` to publish. ## Changes - Bump 0.4.7 -> 0.5.0 across the Cargo workspace, Python `pyproject.toml`, Node `package.json` + 6 platform manifests + 2 lockfiles, and `Cargo.lock`. - CHANGELOG: cut the [0.5.0] section (the relicense) and add compare URLs. - SECURITY.md: supported versions 0.4.x -> 0.5.x. Minor (not patch) bump: a relicense is a significant change. No code changes. NOTE: do not tag/release until you give the go (irreversible publish to crates.io/PyPI/npm). Suggested merge order: #158 -> this -> tag `v0.5.0` -> then the downstream PRs.
44 lines
1.4 KiB
Markdown
44 lines
1.4 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Wickra is pre-1.0. Security fixes are applied to the latest released `0.5.x`
|
|
version only; please upgrade to the newest release before reporting an issue.
|
|
|
|
| Version | Supported |
|
|
| --- | --- |
|
|
| 0.5.x (latest) | :white_check_mark: |
|
|
| older 0.5.x | :x: |
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Do not open a public issue for a security vulnerability.**
|
|
|
|
Report it privately through one of:
|
|
|
|
- GitHub's [private vulnerability reporting](https://github.com/wickra-lib/wickra/security/advisories/new)
|
|
("Report a vulnerability" under the repository's *Security* tab), or
|
|
- email to **support@wickra.org** with a subject line starting with
|
|
`[wickra security]`.
|
|
|
|
Please include:
|
|
|
|
- the affected version(s) and platform / language binding,
|
|
- a description of the issue and its impact,
|
|
- steps to reproduce, ideally a minimal proof of concept.
|
|
|
|
## What to expect
|
|
|
|
- An acknowledgement within **5 working days**.
|
|
- An assessment and, if confirmed, a planned fix with a target release.
|
|
- Coordinated disclosure: we will agree on a disclosure date with you and
|
|
credit you in the release notes unless you prefer to stay anonymous.
|
|
|
|
## Scope
|
|
|
|
In scope: the published crates (`wickra-core`, `wickra-data`, `wickra`), the
|
|
PyPI/npm packages, and the build/release workflows in `.github/workflows/`.
|
|
|
|
Out of scope: vulnerabilities in third-party dependencies (report those
|
|
upstream; we track them via Dependabot and `cargo-deny`).
|