From d8769a3389ae5c1a59aac232a0c2d79dff612f69 Mon Sep 17 00:00:00 2001 From: Matt Acciai Date: Wed, 7 Oct 2026 16:24:14 -0400 Subject: [PATCH 1/2] extend code freeze from 7 to 10 days --- SECURITY.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 9f2f4fc..fa47c91 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -156,9 +156,9 @@ release. ### Code freeze and public release -The private repositories are frozen for the last week of each month. During the -freeze no further patches are merged into that month's repositories. They go -into the next month's set instead, which is created seven days before the month +The private repositories are frozen for the last 10 days of each month. During +the freeze no further patches are merged into that month's repositories. They +go into the next month's set instead, which is created 10 days before the month begins so that it is ready to receive them. At the start of the following month, every patch in the frozen repositories is @@ -174,7 +174,7 @@ retention does not extend anyone's access. As an example, a vulnerability reported on August 12 and patched on August 15 reaches the private repositories the same week. Those repositories freeze on -August 25, their patches go public on September 1, and the repositories come +August 22, their patches go public on September 1, and the repositories come down on September 15. ### Critical vulnerabilities From f68f34aadb843a34ea3d333ebbd44eaae6cc491c Mon Sep 17 00:00:00 2001 From: Matt Acciai Date: Wed, 7 Oct 2026 16:28:24 -0400 Subject: [PATCH 2/2] update critical severity section --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index fa47c91..7820f02 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -184,7 +184,7 @@ through the security mailing list for that repository that the month's private repository contains a critical patch. And a critical is not merged into a month's repository within three days of its freeze; one that would be goes into the next month's repository instead, which pushes its public release out by a -month. Together with the week-long freeze, that leaves at least ten days between +month. Together with the 10 day long freeze, that leaves at least 13 days between a critical landing in a private repository and its public release. ### Active exploitation