OpenShield supports the latest published minor release. Security fixes may also be issued for the immediately preceding minor release when an upgrade cannot be completed promptly. Older releases are unsupported unless a GitHub Security Advisory explicitly states otherwise.
The authoritative release list is the project's GitHub Releases page. Users should include the release tag or commit SHA when reporting a defect.
- Read
CHANGELOG.mdand the target GitHub Release notes. - Back up the database and deployment configuration.
- Install the target source and its pinned dependency manifests.
- Run
alembic upgrade headbefore starting the API. - Validate
/health, authentication, scanning and dashboard connectivity in a non-production environment before promotion.
Database-specific migration instructions are in
docs/database-migrations.md. Breaking changes and required operator actions
must be identified in release notes.
Do not report vulnerabilities through a public issue. Follow
.github/SECURITY.md for the private reporting and coordinated disclosure
process.