From 448eabe633e43c73a33202e0edb3dbc3c48307a0 Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Fri, 18 Sep 2026 13:07:04 +0900 Subject: [PATCH] docs(security): say which versions are supported The policy had no supported-versions section at all. Five releases are on nuget.org and nothing told a reporter whether the one they are running still gets fixes -- the first question the document exists to answer. Says the policy the readme already states, without naming a number: the 0.x line is pre-release, only the most recent release is supported, and a fix ships as a new release rather than a patch to an earlier one. All four packages carry one VersionPrefix from src/Directory.Build.props and no project overrides it, so "they move together" is a fact about the build rather than a convention. Placed first, which is where the other repositories in this set put it. Co-Authored-By: Claude Opus 5 (1M context) --- SECURITY.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 89ad1e0..12f3120 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,14 @@ # Security Policy +## Supported versions + +Only the most recent release is supported. The `0.x` line is pre-release: breaking changes +are expected before `1.0.0`, and a fix ships in a new release rather than as a patch to an +earlier one. All four packages carry the same version and move together. + +Deliberately not a list of version numbers — one written here is correct on the day it is +written and wrong on the day the next release goes out, with nothing failing in between. + ## Reporting a vulnerability Please report security issues privately through