You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: .github/SECURITY.md
+5-2
Original file line number
Diff line number
Diff line change
@@ -6,8 +6,11 @@ Security fixes are applied to the latest version.
6
6
7
7
## Reporting a Vulnerability
8
8
9
-
If you find a potential security issue, please report it to info@martin-thoma.de
10
-
(the current maintainer).
9
+
If you find a potential security issue, please report it using the
10
+
[private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) feature of GitHub to
11
+
automatically inform all relevant team members. Otherwise, please
12
+
get in touch with stefan6419846 through e-mail (current maintainer,
13
+
address in GitHub profile).
11
14
12
15
We will try to find a fix in a timely manner and will then issue a security
pypdf is currently maintained by me, Martin Thoma. I want to avoid that
3
+
pypdf is currently maintained by stefan6419846. We want to avoid that
4
4
pypdf ever goes unmaintained again. This document serves as a guide to avoid
5
5
that if I become unavailable, e.g. due to severe health issues.
6
6
7
7
This currently is just an abstract scenario. I'm fine and I will likely do this
8
8
for several more years, but I have seen how projects stand still for many years
9
9
because of the maintainer becoming inactive.
10
10
11
-
I've also followed the [GitHub Deceased User Policy](https://docs.github.com/en/site-policy/other-site-policies/github-deceased-user-policy)
12
-
and added a [pre-designated successor](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-access-to-your-personal-repositories/maintaining-ownership-continuity-of-your-personal-accounts-repositories).
13
-
14
11
## What belongs to pypdf?
15
12
16
13
The resources needed for maintaining pypdf are:
@@ -21,20 +18,19 @@ The resources needed for maintaining pypdf are:
21
18
22
19
## When may somebody take ownership?
23
20
24
-
**No activity in 180 days**: If I don't answer e-mails (info@martin-thoma.de)
21
+
**No activity in 180 days**: If I don't answer e-mails (see my GitHub profile)
25
22
and don't make any commits / merges for half a year, you can consider pypdf "not
26
23
maintained".
27
24
28
25
## Who may take ownership?
29
26
30
-
Preferably, one of the owners of the Github`py-pdf` organization takes care of
27
+
Preferably, one of the owners of the GitHub`py-pdf` organization takes care of
31
28
that.
32
29
33
-
From my current perspective (Martin Thoma, 27th of August 2023), the following
34
-
people might be candidates:
30
+
As of 27th of August 2023, the following people might be candidates:
35
31
36
32
*[Lucas-C](https://github.com/Lucas-C): He maintains fpdf2 and is a py-pdf owner
37
-
*[pubpub-zz](https://github.com/pubpub-zz): He is the most active contributor
33
+
*[pubpub-zz](https://github.com/pubpub-zz): He is one of the most active contributors
38
34
to pypdf
39
35
*[Matthew Peveler](https://github.com/MasterOdin): Less active, but he is very
40
36
careful about breaking changes and an experienced software developer.
@@ -44,5 +40,5 @@ people might be candidates:
44
40
## How to take ownership?
45
41
46
42
* PyPI: Follow [PEP 541 – Package Index Name Retention](https://peps.python.org/pep-0541/)
47
-
*Github: Talk with one of the other py-pdf organization owners
43
+
*GitHub: Talk with one of the other py-pdf organization owners
48
44
* ReadTheDocs: Follow the [Abandoned projects policy](https://docs.readthedocs.io/en/latest/abandoned-projects.html)
0 commit comments