This document says which versions receive security fixes and how to report a vulnerability privately.
Only the newest release is supported. When a new release is published, every earlier release stops receiving fixes: there are no maintenance branches, no long-term-support line and no backports. If you are not on the newest release, upgrade; upgrading is free. Under the Cyber Resilience Act, Cadasto B.V. commits to keep publishing security fixes for at least five years after each release (Regulation (EU) 2024/2847 Art 13(8)) and ships them only in the newest release (Art 13(10)).
| Artifact | Supported version | Where fixes ship |
|---|---|---|
| Every published FerroSMART artifact | the newest published release | the newest release |
main is unreleased and best effort.
Do not open a public issue for a security vulnerability. Report it privately through GitHub's private vulnerability reporting: https://github.com/FerroHEALTH/FerroSMART/security/advisories/new. You will get an acknowledgement within seven days. If that window passes with no response, public disclosure to protect other users is your call.