From 72da6606bd21f3fba5e13b33302258d4f91bb30e Mon Sep 17 00:00:00 2001 From: Badr NASS LAHSEN Date: Fri, 21 Aug 2026 11:37:59 +0200 Subject: [PATCH 1/3] Create a discoverable security policy for maven/org.springdoc:springdoc-openapi --- CONTRIBUTING.adoc | 5 ++++- README.md | 7 +++++++ SECURITY.md | 8 +++++++- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc index 70a3b3981c..833e30e9b5 100644 --- a/CONTRIBUTING.adoc +++ b/CONTRIBUTING.adoc @@ -45,10 +45,13 @@ If you are reporting a bug, please help to speed up problem diagnosis by providi == Reporting Security Vulnerabilities -If you think you have found a security vulnerability in Spring Boot please *DO NOT* +If you think you have found a security vulnerability in springdoc-openapi please *DO NOT* disclose it publicly until we've had a chance to fix it. Please don't report security vulnerabilities using GitHub issues, instead head over to support@springdoc.org and learn how to disclose them responsibly. +To report a security vulnerability, you can also use the https://tidelift.com/security[Tidelift security contact]. +Tidelift will coordinate the fix and disclosure. + == Code Conventions and Housekeeping None of these is essential for a pull request, but they will all help. diff --git a/README.md b/README.md index 463bf623e1..3062e80714 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,7 @@ This project is sponsored by # Table of Contents - [Full documentation](#full-documentation) +- [Security contact information](#security-contact-information) - [**Introduction**](#introduction) - [**Getting Started**](#getting-started) - [Library for springdoc-openapi integration with spring-boot and swagger-ui](#library-for-springdoc-openapi-integration-with-spring-boot-and-swagger-ui) @@ -56,6 +57,12 @@ This project is sponsored by # [Full documentation](https://springdoc.org/) +## Security contact information + +To report a security vulnerability, please use the +[Tidelift security contact](https://tidelift.com/security). +Tidelift will coordinate the fix and disclosure. + # **Introduction** The springdoc-openapi Java library helps automating the generation of API documentation diff --git a/SECURITY.md b/SECURITY.md index fda5252c2b..be5f3db8e3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,13 @@ ## Reporting a Vulnerability -If you think you have found a security vulnerability in Spring Boot please *DO NOT* +If you think you have found a security vulnerability in springdoc-openapi please *DO NOT* disclose it publicly until we've had a chance to fix it. Please don't report security vulnerabilities using GitHub issues, instead head over to support@springdoc.org and learn how to disclose them responsibly. + +## Security contact information + +To report a security vulnerability, please use the +[Tidelift security contact](https://tidelift.com/security). +Tidelift will coordinate the fix and disclosure. From b868b20b0e60a450e6a188f186f41a9f1ff75893 Mon Sep 17 00:00:00 2001 From: Badr NASS LAHSEN Date: Fri, 21 Aug 2026 11:45:03 +0200 Subject: [PATCH 2/3] Set versioning scheme for maven/org.springdoc:springdoc-openapi --- README.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3062e80714..e33ca0fffb 100644 --- a/README.md +++ b/README.md @@ -36,6 +36,7 @@ This project is sponsored by - [Full documentation](#full-documentation) - [Security contact information](#security-contact-information) +- [Versioning](#versioning) - [**Introduction**](#introduction) - [**Getting Started**](#getting-started) - [Library for springdoc-openapi integration with spring-boot and swagger-ui](#library-for-springdoc-openapi-integration-with-spring-boot-and-swagger-ui) @@ -63,6 +64,15 @@ To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure. +## Versioning + +springdoc-openapi follows [Semantic Versioning](https://semver.org/). +MAJOR version increments are released in lockstep with Spring Boot MAJOR +releases and may include incompatible/breaking changes. MINOR and PATCH +releases follow standard SemVer conventions for backwards-compatible +features and fixes, respectively. See [CHANGELOG.md](CHANGELOG.md) for the +full release history. + # **Introduction** The springdoc-openapi Java library helps automating the generation of API documentation @@ -87,7 +97,7 @@ The following video introduces the Library: * [https://youtu.be/utRxyPfFlDw](https://youtu.be/utRxyPfFlDw) For *Spring-boot v4* support, make sure you -use [springdoc-openapi v2](https://springdoc.org/) +use [springdoc-openapi v3](https://springdoc.org/) This is a community-based project, not maintained by the Spring Framework Contributors ( Pivotal) From 9c260fde44eb46cbfb65da1080c0350c07c1534f Mon Sep 17 00:00:00 2001 From: Badr NASS LAHSEN Date: Fri, 21 Aug 2026 11:55:48 +0200 Subject: [PATCH 3/3] updated security maintenance plan --- SECURITY.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index be5f3db8e3..b9dcb04648 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,9 +2,15 @@ ## Supported Versions -| Version | Supported | -|---------------|--------------------| -| latest-stable | :white_check_mark: | +Security fixes are backported to the **latest minor release of the current major +version** and the **latest minor release of the immediately preceding major version**. +Older major/minor streams do not receive security patches. + +| Version stream | Supported | +|-------------------------------------|--------------------| +| Latest minor of the current major | :white_check_mark: | +| Latest minor of the previous major | :white_check_mark: | +| Anything older | :x: | ## Reporting a Vulnerability