We are currently providing security updates to the following http4s core versions:

For other repos in the http4s org on different release cycles, see their documentation.

To report a security issue, please use one of the following methods:

1. Navigate to the "Security and quality" tab at the top of the relevant repository, click the "Report a vulnerability" button, and complete the form as much as possible.
2. Email the Security Team with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue.

The Security Team will attempt to respond within 3 working days of your report. If the issue is confirmed as a vulnerability, we will open a Security Advisory. This project follows a 90 day disclosure timeline.

1. A GitHub Security Advisory will be created in the appropriate repository.
2. A project member works privately with the reporter to resolve the vulnerability.
3. The project creates a new release of the package the vulnerabilty affects to deliver its fix.
4. The project publicly announces the vulnerability and describes how to apply the fix.

We strongly recommend users of our libraries to use Scala Steward or something similar to automatically receive updates.