docs(security): say which versions are supported - #69
Merged
Merged
Conversation
The policy had no supported-versions section at all. Five releases are on nuget.org and nothing told a reporter whether the one they are running still gets fixes -- the first question the document exists to answer. Says the policy the readme already states, without naming a number: the 0.x line is pre-release, only the most recent release is supported, and a fix ships as a new release rather than a patch to an earlier one. All four packages carry one VersionPrefix from src/Directory.Build.props and no project overrides it, so "they move together" is a fact about the build rather than a convention. Placed first, which is where the other repositories in this set put it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SECURITY.mdhad no supported-versions section at all. Five releases are on nuget.organd nothing told a reporter whether the one they are running still gets fixes — the first
question the document exists to answer.
What it now says
The policy the readme already states, without naming a number:
"They move together" is checked rather than assumed:
VersionPrefixis declared once insrc/Directory.Build.propsand no project overrides it, so all four packages cannotdiverge.
Deliberately not a table of version numbers. The sibling repositories that did carry one
had gone stale by three majors and six minors respectively, with nothing failing in
between — which is the argument against writing the number down at all.
Placed first, which is where the other repositories in this set put it.
ReleaseVersionTestsandPackageContentTestsstill pass.🤖 Generated with Claude Code