From e631a558903b2a32a7bc0d547886b58a89894111 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 1 Sep 2026 07:12:10 +0000 Subject: [PATCH] docs: correct the supported-version table and pin the hand-maintained bumps SECURITY.md still said "The project has not yet cut a versioned release" and listed 0.1.0-SNAPSHOT as the only supported version, five releases after 1.0.0. It would have shipped that way with 1.2.0. The table now names the current release line, says older lines are not patched retroactively, and notes why upgrading within a line is only a version bump: the three artifacts are released together from one parent pom at a single version. That defect exists because `versions:set` rewrites only the poms and the runbook never said what else carries a version literal. Step 1 now lists them -- both READMEs, CLAUDE.md, SECURITY.md, the CHANGELOG heading and its two link refs -- with the grep that finds whatever was missed, to be run before the tag rather than after. --- SECURITY.md | 11 +++++++---- docs/RELEASE.md | 12 ++++++++++++ 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f91de0ba..b5f9b030 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,13 +2,16 @@ ## Supported versions -The project has not yet cut a versioned release. Security fixes are applied directly on `main` against the current development snapshot. +Security fixes land on `main` and ship in the next release from the current minor line. Older lines +are not patched retroactively: the three artifacts (`srcmorph`, `srcmorph-cli`, +`srcmorph-maven-plugin`) are released together from one parent pom at a single version, so upgrading +within a line is a version bump and nothing else. | Version | Supported | |---------|-----------| -| 0.1.0-SNAPSHOT (development, unreleased) | Security fixes applied on `main` | - -> Note: once the first SemVer release is cut, this table will be updated to list the supported release line(s). +| 1.2.x (current release line) | ✅ Security fixes released from `main` | +| 1.1.x and older | ❌ Upgrade to the current line | +| `main` (development) | ✅ Fixes land here first | --- diff --git a/docs/RELEASE.md b/docs/RELEASE.md index 8aa98a24..07f5f0b6 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -15,6 +15,18 @@ procedure: (No `-Dexcludes` needed — the reactor's former 4th module, a relocation-stub POM for the retired `net.ladenthin:llamacpp-ai-index-maven-plugin` coordinates, was removed after its one `1.0.4` release; see `CLAUDE.md`.) + + **`versions:set` rewrites only the poms.** These version literals are hand-maintained and must be + bumped in the same commit, or the published docs point consumers at the previous release: + - `README.md` — the ``/`` snippets **and** the "Current reactor version / + Last released version" line; + - `srcmorph-maven-plugin/README.md` — its own `` snippet; + - `CLAUDE.md` — the reactor version and "Last released version" in the overview and layout blocks; + - `SECURITY.md` — the supported-release-line table; + - `CHANGELOG.md` — the `## [X.Y.Z] - ` heading and the two link refs at the bottom. + + `grep -rn "" --include="*.md" .` finds what was missed; run it before tagging, + not after. 2. **Commit, push, merge to `main`.** 3. **Tag the merge commit and push the tag:** ```bash