Security patches go to the latest released minor line only, shipped as a new patch release. There is no long-term support branch, and earlier minor lines are not backported to.
| Version | Supported |
|---|---|
| Latest minor line | ✅ |
| Any earlier minor line | ❌ |
See the latest release for which version that is, and upgrade to it before reporting a vulnerability so the report is against supported code.
v1.0.0-v1.4.0 were published in error and are retracted. They receive no
fixes, and go get will not select them — v1.5.0 is the first supported v1
release. If you pinned one of them, upgrade.
The experimental acor/server module publishes no tags of its own; fixes for it
land on main and are consumed from there.
If you discover a security vulnerability within ACOR, please report it responsibly.
Please do not report security vulnerabilities through public GitHub issues.
Instead, please report them privately through GitHub Security Advisories.
When reporting, please include:
- A description of the vulnerability
- Steps to reproduce the issue
- Potential impact of the vulnerability
- Any suggested fixes (if applicable)
We aim to acknowledge vulnerability reports within 48 hours and provide a timeline for fixes based on severity:
- Critical: Fix within 7 days
- High: Fix within 30 days
- Medium: Fix within 90 days
- Low: Fix in next release
We follow a coordinated disclosure process and will work with reporters to:
- Confirm the vulnerability
- Develop and test a fix
- Release a patched version
- Credit reporters (unless anonymity is requested)
ACOR is licensed under the Apache License 2.0.