The project currently publishes 0.x releases; v0.19.4 is the current release. Use the latest published release and review its upgrade notes when applying fixes. There is no published 1.x release to upgrade to.

This repository does not define a separate backport or long-term-support schedule for older releases. When reporting a vulnerability, include the installed version and whether it also affects the latest release. A historical release tag alone does not establish an ongoing maintenance commitment.

If you discover a security issue, please report it responsibly:

1. Private disclosure (preferred)
   Open a private security advisory on GitHub: Security Advisories.
   This allows us to fix the issue and coordinate disclosure before it is made public.

2. Public disclosure
   You may open a public issue if you prefer; please avoid including proof-of-concept or exploit details that could put others at risk before a fix is available.

We will acknowledge your report and work with you on a fix and disclosure timeline. Thank you for helping keep apt-proxy and its users safe.