Sync with upstream 21.08.2026

CONTRIBUTING.adoc

@@ -45,10 +45,13 @@ If you are reporting a bug, please help to speed up problem diagnosis by providi
 
 == Reporting Security Vulnerabilities
 
-If you think you have found a security vulnerability in Spring Boot please *DO NOT*
+If you think you have found a security vulnerability in springdoc-openapi please *DO NOT*
 disclose it publicly until we've had a chance to fix it.
 Please don't report security vulnerabilities using GitHub issues, instead head over to support@springdoc.org and learn how to disclose them responsibly.
 
+To report a security vulnerability, you can also use the https://tidelift.com/security[Tidelift security contact].
+Tidelift will coordinate the fix and disclosure.
+
 == Code Conventions and Housekeeping
 
 None of these is essential for a pull request, but they will all help.

README.md

@@ -35,6 +35,8 @@ This project is sponsored by
 # Table of Contents
 
 - [Full documentation](#full-documentation)
+- [Security contact information](#security-contact-information)
+- [Versioning](#versioning)
 - [**Introduction**](#introduction)
 - [**Getting Started**](#getting-started)
     - [Library for springdoc-openapi integration with spring-boot and swagger-ui](#library-for-springdoc-openapi-integration-with-spring-boot-and-swagger-ui)
@@ -56,6 +58,21 @@ This project is sponsored by
 
 # [Full documentation](https://springdoc.org/)
 
+## Security contact information
+
+To report a security vulnerability, please use the
+[Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure.
+
+## Versioning
+
+springdoc-openapi follows [Semantic Versioning](https://semver.org/).
+MAJOR version increments are released in lockstep with Spring Boot MAJOR
+releases and may include incompatible/breaking changes. MINOR and PATCH
+releases follow standard SemVer conventions for backwards-compatible
+features and fixes, respectively. See [CHANGELOG.md](CHANGELOG.md) for the
+full release history.
+
 # **Introduction**
 
 The springdoc-openapi Java library helps automating the generation of API documentation
@@ -80,7 +97,7 @@ The following video introduces the Library:
 * [https://youtu.be/utRxyPfFlDw](https://youtu.be/utRxyPfFlDw)
 
 For *Spring-boot v4* support, make sure you
-use [springdoc-openapi v2](https://springdoc.org/)
+use [springdoc-openapi v3](https://springdoc.org/)
 
 This is a community-based project, not maintained by the Spring Framework Contributors (
 Pivotal)

SECURITY.md

@@ -2,13 +2,25 @@
 
 ## Supported Versions
 
-| Version       | Supported          |
-|---------------|--------------------|
-| latest-stable | :white_check_mark: |
+Security fixes are backported to the **latest minor release of the current major
+version** and the **latest minor release of the immediately preceding major version**.
+Older major/minor streams do not receive security patches.
+
+| Version stream                     | Supported          |
+|-------------------------------------|--------------------|
+| Latest minor of the current major  | :white_check_mark: |
+| Latest minor of the previous major | :white_check_mark: |
+| Anything older                     | :x:                |
 
 ## Reporting a Vulnerability
 
-If you think you have found a security vulnerability in Spring Boot please *DO NOT*
+If you think you have found a security vulnerability in springdoc-openapi please *DO NOT*
 disclose it publicly until we've had a chance to fix it. Please don't report security
 vulnerabilities using GitHub issues, instead head over to support@springdoc.org and
 learn how to disclose them responsibly.
+
+## Security contact information
+
+To report a security vulnerability, please use the
+[Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure.