Security fixes are released for the latest 2.x release.
| Version | Supported |
|---|---|
| 2.17.x | ✅ |
| < 2.17 | ❌ |
| 3.0.0.rc* | ❌ |
Every 2.x release is a safe upgrade from any earlier 2.x version. If you are on an older release, upgrade to the latest 2.x before reporting. The 3.0.0 release candidates are abandoned and should not be used.
Please do not report security issues through public GitHub issues.
Instead, report a vulnerability privately through GitHub. You will get an acknowledgement within 7 days. Please keep the report confidential until a fix is released.
This policy covers the savon gem. For issues in one of the companion gems (akami, gyoku, httpi, nori, wasabi), report to the affected repository in the savonrb organization. If you are not sure which gem is affected, report it here.