From 8722695a2fcf7952ec0d3a167059cc66fef8f44b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 28 Sep 2026 02:36:17 +0000 Subject: [PATCH] docs: point the 7.x security line at 7.1.3 7.1.2 still has the Zip Slip backport, but it does not compile on Android. 7.1.3 is the maintenance-7 release to install. Co-authored-by: Perry --- CHANGELOG.md | 1 + SECURITY.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7323551..41a9f6b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## [Unreleased] - Process: each 9.x minor gets an Announcements GitHub Discussion linked from the GitHub Release (`.github/announcements/vX.Y.md`, RNZA-28). [9.5 Discussion](https://github.com/mockingbot/react-native-zip-archive/discussions/389) +- SECURITY.md: 7.x install line is **7.1.3** (`maintenance-7`). 7.1.2 has the Zip Slip backport but does not compile on Android (#390). ## [9.5.1] - 2026-09-05 diff --git a/SECURITY.md b/SECURITY.md index 2da836a..2259110 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -9,7 +9,7 @@ | **7.x** | Security fixes only through **2027-02-19**. After that, 7.x is unsupported. Stay on 7.x if you are on React Native < 0.70 until you upgrade RN. 7.x will not be deleted or unpublished. | | **< 7** | Unsupported except for critical issues | -Zip Slip / symlink fixes shipped in 9.x will be **evaluated for 7.x backports**. If a patch is warranted, it will be published as `7.x.y`. **7.1.2** (`maintenance-7` dist-tag) backports Zip Slip validation and symlink skipping for Android and iOS extract paths. 7.x stays on security-only support through the EOL date above; it is not unpublished. +Zip Slip / symlink fixes shipped in 9.x will be **evaluated for 7.x backports**. If a patch is warranted, it will be published as `7.x.y`. **7.1.3** (`maintenance-7` dist-tag) is the 7.x release to install: it includes the Zip Slip / symlink backport from 7.1.2 and the Android compile fix for `compressionLevel` (#390). 7.1.2 has the security backport but does not compile on Android. 7.x stays on security-only support through the EOL date above; it is not unpublished. ## Reporting a vulnerability