Security fixes are applied to the latest release only. Older versions do not receive backported security patches.
| Version | Supported |
|---|---|
| Latest release | Yes |
| Older releases | No |
Please do not report security vulnerabilities through public GitHub issues.
Report vulnerabilities privately using GitHub's private vulnerability reporting, or send an email to tim@avaloniaui.net or javier@avaloniaui.net.
Include as much of the following as possible:
- A description of the vulnerability and its potential impact
- The affected component, file, or version
- Steps to reproduce or a proof-of-concept
- Any suggested mitigations, if known
We aim to acknowledge reports within 5 business days and to provide a resolution timeline within 14 business days. We will keep you informed of progress and credit you in the advisory unless you prefer to remain anonymous.
This policy covers the packages published from this repository:
Avalonia.Controls.MauiAvalonia.Controls.Maui.DesktopAvalonia.Controls.Maui.EssentialsAvalonia.Controls.Maui.CompatibilityAvalonia.Controls.Maui.SkiaSharp.ViewsAvalonia.Controls.Maui.SourceGenerators
Security issues in Avalonia itself should be reported to the Avalonia repository. Issues in .NET MAUI should be reported to Microsoft.