Only the latest 2.x release receives security patches. Upgrade to the latest release before reporting vulnerabilities.

When a CVE is published against a direct or transitive dependency of tapps-brain, the maintainers follow these timelines:

"Resolution" means a release is published with the vulnerable dependency bumped or replaced. If an upstream fix is not yet available, the advisory will document workarounds and the tracking issue will remain open.

Enterprise consumers who require an SBOM can generate one locally using CycloneDX:

pip install cyclonedx-bom
cyclonedx-py environment -o sbom.json --output-format json

Or from the locked dependency graph:

cyclonedx-py requirements -i requirements.txt -o sbom.xml

SBOM generation is not yet automated in CI. This is tracked for future release workflow integration. When added, SBOM artifacts will be attached to GitHub Releases.

If you discover a security vulnerability in tapps-brain, please report it responsibly:

1. Preferred: Open a GitHub Security Advisory (private by default).
2. Alternative: Email the maintainers at the address listed in the repository's GitHub profile.
3. Public issues: If the vulnerability is in a third-party dependency and already has a public CVE, you may open a regular GitHub issue linking the CVE.

Please do not open a public issue for vulnerabilities in tapps-brain's own code before the maintainers have had a chance to assess and patch.

• Core dependencies (pydantic, structlog, pyyaml) use compatible-release pins (>=x.y,<next-major) to balance stability and security updates.
• Optional extras follow the same pinning strategy.
• uv.lock is committed to the repository for reproducible builds.
• Dependabot or equivalent automated scanning is recommended for forks and downstream consumers.