Skip to content

docs: point the 7.x security line at 7.1.3 #394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
plrthink merged 1 commit into from
Sep 28, 2026
Merged

docs: point the 7.x security line at 7.1.3 #394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
## [Unreleased]

- Process: each 9.x minor gets an Announcements GitHub Discussion linked from the GitHub Release (`.github/announcements/vX.Y.md`, RNZA-28). [9.5 Discussion](https://github.com/mockingbot/react-native-zip-archive/discussions/389)
- SECURITY.md: 7.x install line is **7.1.3** (`maintenance-7`). 7.1.2 has the Zip Slip backport but does not compile on Android (#390).

## [9.5.1] - 2026-09-05

Expand Down
2 changes: 1 addition & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
| **7.x** | Security fixes only through **2027-02-19**. After that, 7.x is unsupported. Stay on 7.x if you are on React Native < 0.70 until you upgrade RN. 7.x will not be deleted or unpublished. |
| **< 7** | Unsupported except for critical issues |

Zip Slip / symlink fixes shipped in 9.x will be **evaluated for 7.x backports**. If a patch is warranted, it will be published as `7.x.y`. **7.1.2** (`maintenance-7` dist-tag) backports Zip Slip validation and symlink skipping for Android and iOS extract paths. 7.x stays on security-only support through the EOL date above; it is not unpublished.
Zip Slip / symlink fixes shipped in 9.x will be **evaluated for 7.x backports**. If a patch is warranted, it will be published as `7.x.y`. **7.1.3** (`maintenance-7` dist-tag) is the 7.x release to install: it includes the Zip Slip / symlink backport from 7.1.2 and the Android compile fix for `compressionLevel` (#390). 7.1.2 has the security backport but does not compile on Android. 7.x stays on security-only support through the EOL date above; it is not unpublished.

## Reporting a vulnerability

Expand Down
Loading