mirror of
https://github.com/kucherenko/jscpd.git
synced 2026-09-19 08:11:03 +08:00
apk
d790c6c1d3
Everything belonging to the v4 TypeScript engine moves to the master-v4 branch: apps/, packages/, build-utils/, changesets, pnpm workspace, turbo, the Node.js CI workflow and the ts-* release jobs. What remains is the Rust workspace under rust/, the npm wrapper and platform packages, the GitHub Action, Docker image, flake, skills, benchmark and fixtures/. - rust.yml gains a smoke job that runs the release binary against fixtures/ (json, sarif, html) and asserts clones and reporters - release.yml keeps only the Rust jobs; pnpm removed from every workflow; audit.yml keeps cargo audit + cargo deny; dependabot drops the root npm entry - root package.json becomes a thin private package depending on the exact jscpd@5 version so the pre-commit hook keeps installing the binary; sync-version.mjs keeps it in step - .pre-commit-hooks.yaml used v4-only flags that the v5 CLI rejects; fixed - FORMATS.md is now generated from the Rust tokenizer (224 formats) - README, docs, CONTRIBUTING, SECURITY, package and crate descriptions, benchmark and skills rewritten for v5 on its own terms: no v5-vs-v4 speed multipliers anywhere, a single "Looking for v4?" pointer to master-v4
23 lines
1.3 KiB
Markdown
23 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Branch | Supported |
|
|
| ------- | ------ | --------- |
|
|
| 5.x (Rust engine) | [`master`](https://github.com/kucherenko/jscpd) | :white_check_mark: Active development |
|
|
| 4.x (TypeScript engine) | [`master-v4`](https://github.com/kucherenko/jscpd/tree/master-v4) | :white_check_mark: Security fixes only |
|
|
| < 4.0 | — | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please report security vulnerabilities **privately** — do not open a public issue.
|
|
|
|
- Preferred: [GitHub private vulnerability reporting](https://github.com/kucherenko/jscpd/security/advisories/new)
|
|
- Alternatively: email kucherenko.andrey@gmail.com with "jscpd security" in the subject
|
|
|
|
Please include a description of the issue, steps to reproduce, affected versions, and any known impact.
|
|
|
|
You can expect an acknowledgement within 7 days. Once a fix is available, it is released for the supported version lines and the advisory is published with credit to the reporter (unless you prefer to stay anonymous).
|
|
|
|
Fixed vulnerabilities are identified in the release notes and changelog of the release that contains the fix, with a reference to the published advisory: [`rust/CHANGELOG.md`](rust/CHANGELOG.md) for 5.x, and `CHANGELOG.md` on the `master-v4` branch for 4.x.
|