Only the latest minor of each maintained major receives security fixes. There is no support branch for older v1 minors — upgrade to the latest published v1 minor to receive fixes. After v1.10.0 is published, that supported line is v1.10.x. The v1 security-support period ends on 2027-06-30; v1 is end-of-life from 2027-07-01. See the versioning policy for the active-maintenance and security-only phases. v0.x is unsupported.

Do not open a public issue for security-relevant reports.

Use GitHub's Private Vulnerability Reporting to file the report privately:

What to include:

• Affected version(s)
• Reproduction steps or proof-of-concept
• Impact assessment (data exposure, RCE, DoS, etc.)
• Whether the issue is already public

• Acknowledgement: within 5 business days
• Severity triage: within 10 business days
• Fix for high-severity issues: within 30 days where feasible

We coordinate disclosure timing with the reporter and credit reporters in release notes (with permission).

This is a test-only library — it has no runtime production surface. The relevant attack vectors are:

• Selecting entry specs by name — nested names are allowed, but traversal, absolute paths, and symlinks cannot escape spec_base_path
• Resolving local external $refs — canonical targets are confined to spec_base_path; use the narrowest trusted common directory
• Resolving #[BoundToOpenApiEnum] files — canonical targets are confined to enum_spec_base_path, falling back to spec_base_path when unset
• Resolving HTTP(S) $refs (opt-in, off by default) — verify any untrusted spec source before enabling allowRemoteRefs
• YAML spec loading (opt-in via symfony/yaml) — symfony/yaml is generally safe but spec inputs should still be trusted
• Coverage sidecar files written under sys_get_temp_dir() in paratest mode — use a dedicated non-symlink directory that is not group/world writable; merge rejects unsafe directories, symlink sidecars, and writable-by-others sidecars

Issues outside that scope (e.g. opis/json-schema validation behaviour) are forwarded upstream.