From bc4b167bc71e483be0fee21d50f8b5e57c6073f5 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Thu, 29 Oct 2026 22:18:30 -0700 Subject: [PATCH] SECURITY.md: supported versions match the published policy Older releases were listed as never getting fixes. The previous series now gets three months of security fixes after a new one ships, and 2026.x gets them until three months after 27.1. The table says so and links the full policy at docs.inbuxa.org/versions/. --- SECURITY.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0f9f083..45d18d3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,13 +2,18 @@ ## Supported versions -INBUXA Admin is developed on `main`, and security fixes are applied there and -in the latest release. Older tags are not backported. +Security fixes go into the newest release and into every older line still +inside its security window. When a new series ships, the one before it gets +three more months of security fixes. The full policy is on +[Versions and upgrades](https://docs.inbuxa.org/versions/). | Version | Supported | | --- | --- | -| `main` and the latest release | :white_check_mark: | -| Older releases | :x: | +| `main` and the newest release | :white_check_mark: | +| The previous series, for three months after a new one ships | Security fixes only | +| 2026.x, until three months after 27.1 ships | Security fixes only | +| Release candidates | Replaced by the next candidate | +| Anything older | :x: | ## Reporting a vulnerability -- 2.54.0