From 267b5efa5a40dd7018bce1a66f80e0685defea10 Mon Sep 17 00:00:00 2001 From: Timmy Willison Date: Thu, 15 Oct 2026 12:38:29 -0400 Subject: [PATCH] Docs: Update the security policy and add the machine-generated contributions section - SECURITY.md: require version/SHA, specific API with file and line, a runnable PoC, and an own-words description; add a "Report quality and automated submissions" subsection; count a closure or request for information as a response for escalation purposes; note that fixes are not backported - SECURITY.md: fix the jQuery bullet that was labelled "jQuery UI", and the "instrastructure" typo - CONTRIBUTING.md: lift "Unsolicited and Machine-Generated Contributions" from jquery/jquery so the SECURITY.md cross-reference resolves for every repo that inherits these files - Mirrors https://github.com/jquery/jquery/pull/5925 --- CONTRIBUTING.md | 17 +++++++++++++++-- SECURITY.md | 29 +++++++++++++++++++++-------- 2 files changed, 36 insertions(+), 10 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 50b066f..28c2e1b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -3,7 +3,8 @@ 1. [Getting Involved](#getting-involved) 2. [Questions and Discussion](#questions-and-discussion) 3. [How To Report Bugs](#how-to-report-bugs) -4. [Specific Projects](#specific-projects) +4. [Unsolicited and Machine-Generated Contributions](#unsolicited-and-machine-generated-contributions) +5. [Specific Projects](#specific-projects) ## Getting Involved @@ -55,6 +56,18 @@ When experiencing a problem, [reduce your code](https://webkit.org/quality/reduc Go to the GitHub issue tracker for the project and make sure the problem hasn't already been reported. If not, create a new issue there and include your test case. +## Unsolicited and Machine-Generated Contributions + +jQuery is a mature, stability-focused project. Changes carry real compatibility risk, and every pull request costs maintainer time to review. To keep that time focused on work that benefits actual users, we require the following: + +**Contributions must address a real, demonstrated need.** Pull requests should correspond to an existing reported issue, a problem you personally encountered in real usage, or a change previously discussed with the maintainers. PRs that fix hypothetical problems, restyle working code, or make speculative "improvements" no user has asked for will be closed without review. + +**You must be able to engage with review as the author.** Whatever tools you use to write code, you are responsible for understanding and defending every line you submit. If you cannot explain why a change was made, answer questions about its approach, or revise it based on feedback, the PR will be closed. + +**Do not submit auto-generated issues or pull requests.** Issues and PRs produced by pointing an automated tool at this repository — rather than originating from genuine use of jQuery — are not welcome, whether you submit one or many. These will be closed without review, and repeat submissions may result in a ban from the project. + +Opening an issue describing a problem you actually hit, and discussing it before writing code, is always the best path to a merged contribution. + ## Specific Projects Refer to the appropriate GitHub repository's CONTRIBUTING.md for specific details on how to contribute to that project. @@ -64,4 +77,4 @@ Refer to the appropriate GitHub repository's CONTRIBUTING.md for specific detail Contributions to jQuery Mobile are no longer accepted. -Contributions should usually be made in the form of a pull request. Find more information on how to contribute to jQuery projects at [contribute.jquery.org](https://contribute.jquery.org). \ No newline at end of file +Contributions should usually be made in the form of a pull request. Find more information on how to contribute to jQuery projects at [contribute.jquery.org](https://contribute.jquery.org). diff --git a/SECURITY.md b/SECURITY.md index d82ec3a..41038c3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,13 +4,15 @@ Please check which versions of the jQuery project you are using are currently supported. -- The [latest released version of jQuery UI](https://github.com/jquery/jquery/releases) is supported. +- The [latest released version of jQuery](https://github.com/jquery/jquery/releases) is supported. - The [latest released version of jQuery UI](https://github.com/jquery/jquery-ui/releases) is supported, but jQuery UI supports multiple versions of jQuery. More information can be found at https://jqueryui.com/. - [jQuery Mobile](https://github.com/jquery-archive/jquery-mobile) is no longer supported. +Fixes are not backported to earlier versions. Commercial support for previous versions is available from third parties; see the [jQuery README](https://github.com/jquery/jquery#version-support). + ## jQuery Websites -The jQuery instrastructure is maintained with puppet and the configuration is publicly available and documented at https://github.com/jquery/infrastructure-puppet. +The jQuery infrastructure is maintained with puppet and the configuration is publicly available and documented at https://github.com/jquery/infrastructure-puppet. Content for individual sites can be found in their respective repositories. For example, the content for jquery.com is available at https://github.com/jquery/jquery.com. @@ -24,20 +26,31 @@ Please report security issues **privately**: **Do not** file public GitHub issues for security problems. -When reporting, please include: -- Affected project/repo and version(s) -- Impact and component(s) involved -- Reproduction steps or PoC (if available) +Reports **must** include: +- The version(s) you tested, with the commit SHA if you tested a build from `main` +- The specific API involved, with the file and line in the project's source you believe is at fault +- A proof of concept that runs against an unmodified build of the version you name +- A description, in your own words, of what the library is doing that you consider unsafe and what the impact is - Your contact and preferred credit name -If you do not receive an acknowledgement of your report within **6 business days**, or if you cannot find a private security contact for the project, you may **escalate to the OpenJS Foundation CNA** at `security@lists.openjsf.org`. +Reports missing any of the above will be closed with a request for the missing information. + +### Report quality and automated submissions + +Most reports we receive are produced by automated tools or language models and do not describe a real vulnerability. Reviewing them costs maintainer time that would otherwise go to real issues. + +You may use whatever tools you like to find and write up an issue, but you are responsible for every claim in your report. Reports that cite APIs, files, or lines that do not exist, that restate documented behavior as a vulnerability, or that name a vulnerability class without demonstrating a specific path through the library will be closed. We will ask follow-up questions and expect answers in your own words; if you cannot answer them, the report will remain closed. Repeat submissions of this kind may result in a ban from the project and withdrawal of any credit previously given. + +This applies regardless of how the report reaches us: email, a GitHub security advisory, or escalation through the OpenJS Foundation CNA. See also [Unsolicited and Machine-Generated Contributions](CONTRIBUTING.md#unsolicited-and-machine-generated-contributions) in CONTRIBUTING.md. + +If you receive no response (including a closure or a request for more information) within **6 business days**, or if you cannot find a private security contact for the project, you may **escalate to the OpenJS Foundation CNA** at `security@lists.openjsf.org`. If the project acknowledges your report but does not provide any further response or engagement within **14 days**, escalation is also appropriate. ## Coordination & Disclosure Important: -- If the vulnerability is considered valid and accepted, a patch will be made for the latest jQuery version. +- If the vulnerability is considered valid and accepted, a patch will be made for the latest version of the affected project. - If the vulnerability is deemed invalid, no further action is required. We follow coordinated vulnerability disclosure: