The supported line is tested only against the exact host and TypeScript rows in Language servers. Those rows are compatibility evidence, not a promise to support every release of the listed operating systems.

Use GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability.

Include:

• the affected commit or version;
• the Pi, Node.js, and operating-system versions;
• the affected language server or installation recipe;
• the smallest sanitized reproduction;
• expected and observed behavior;
• impact and any known workaround.

Remove credentials, tokens, prompts, file contents, private paths, identifiers, and active configuration values.

pi-lsp-manager coordinates language-server processes and may invoke allowlisted package-manager recipes. It is not an operating-system sandbox. A language server runs with the same operating-system permissions as Pi and may read project files or invoke language tooling.

A valid report may involve command selection, project trust, path resolution, recipe or architecture admission, concurrent installation, cancellation, process lifecycle, workspace-edit validation, rollback, output sanitization, or unintended network and filesystem access. Resource operations such as file creation, rename, and deletion are rejected in v1 rather than sandboxed.

See the security model for the documented trust, installation, process, mutation, logging, and audit boundaries.

The maintainer will review the private report, reproduce it when possible, and coordinate a fix and disclosure through the advisory. Do not disclose the vulnerability before that coordination is complete.