Skip to content

Clarify pre announcements for security advisories #1181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 10, 2025
Merged

Clarify pre announcements for security advisories #1181

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
08fae07
pages: explicit what to expect from vulnerabilities pre-announcements
darosior Oct 7, 2025
ec68307
pages: reword/cleanup paragraph on vulnerability disclosure timeline
darosior Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions _posts/en/pages/2024-06-26-security-advisories.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,12 +89,14 @@ Examples:

---

**Low** severity bugs will be disclosed 2 weeks after a fixed version exists on the current major release branch.
A pre-announcement will be made at the same time as the release.

**Medium** and **High** severity bugs will be disclosed 2 weeks after the [last
affected release goes EOL](/en/lifecycle/). This is a year after a fixed version was first
released. A pre-announcement will be made 2 weeks prior to disclosure.
**Low** severity vulnerabilities will be disclosed 2 weeks after the release of a major version
containing the fix. **Medium** and **High** severity vulnerabilities will be disclosed 2 weeks after
the last affected release goes [End of Life](/en/lifecycle/) (approximately a year after a major
version containing the fix was first released).

A pre-announcement will be made two weeks prior to releasing the details of a vulnerability. This
pre-announcement will coincide with the release of a new major version and contain the number of
fixed vulnerabilities and their severity levels.

**Critical** bugs are not considered in the standard policy, as they would most likely require an
ad-hoc procedure. Also, a bug may not be considered a vulnerability at all. Any reported issue
Expand Down