5.0.0-beta.2 · Published beta · 13f4954c. Published on npm. Match your installed version.

Security reports and version support#

Report suspected vulnerabilities privately through GitHub's security advisory form. Do not include exploit details, credentials or private application data in a public issue. Include the affected package and exact version, a minimal reproduction, the expected trust boundary and the observed impact. Redact sensitive data.

This repository maintains marionette and the @mnjs/data, @mnjs/adapters, @mnjs/utils and @mnjs/radio packages. Maintainers review private reports and coordinate fixes and disclosure through the advisory. Ordinary bugs and support questions belong in the issue tracker.

Current development targets v5, which is in beta. A prerelease is not a stable support commitment. Reports about older releases should identify the affected version and whether the problem reproduces on the current beta; do not upgrade a production application solely to investigate a report. This community-maintained project does not promise a response deadline or automatic backports. A backport or supported-version window must be stated in the relevant release or advisory.

For application authors, rendering untrusted content safely describes the application's responsibilities. Reporting a vulnerability does not require demonstrating an issue in a real deployment; a minimal isolated example is sufficient.