Skip to content

Docs: Update the security policy and add the machine-generated contributions section #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
timmywil wants to merge 1 commit into
base: main
Choose a base branch
from
+36 −10
Open

Docs: Update the security policy and add the machine-generated contributions section #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@
1. [Getting Involved](#getting-involved)
2. [Questions and Discussion](#questions-and-discussion)
3. [How To Report Bugs](#how-to-report-bugs)
4. [Specific Projects](#specific-projects)
4. [Unsolicited and Machine-Generated Contributions](#unsolicited-and-machine-generated-contributions)
5. [Specific Projects](#specific-projects)

## Getting Involved

Expand Down Expand Up @@ -55,6 +56,18 @@ When experiencing a problem, [reduce your code](https://webkit.org/quality/reduc

Go to the GitHub issue tracker for the project and make sure the problem hasn't already been reported. If not, create a new issue there and include your test case.

## Unsolicited and Machine-Generated Contributions

jQuery is a mature, stability-focused project. Changes carry real compatibility risk, and every pull request costs maintainer time to review. To keep that time focused on work that benefits actual users, we require the following:

**Contributions must address a real, demonstrated need.** Pull requests should correspond to an existing reported issue, a problem you personally encountered in real usage, or a change previously discussed with the maintainers. PRs that fix hypothetical problems, restyle working code, or make speculative "improvements" no user has asked for will be closed without review.

**You must be able to engage with review as the author.** Whatever tools you use to write code, you are responsible for understanding and defending every line you submit. If you cannot explain why a change was made, answer questions about its approach, or revise it based on feedback, the PR will be closed.

**Do not submit auto-generated issues or pull requests.** Issues and PRs produced by pointing an automated tool at this repository — rather than originating from genuine use of jQuery — are not welcome, whether you submit one or many. These will be closed without review, and repeat submissions may result in a ban from the project.

Opening an issue describing a problem you actually hit, and discussing it before writing code, is always the best path to a merged contribution.

## Specific Projects

Refer to the appropriate GitHub repository's CONTRIBUTING.md for specific details on how to contribute to that project.
Expand All @@ -64,4 +77,4 @@ Refer to the appropriate GitHub repository's CONTRIBUTING.md for specific detail

Contributions to jQuery Mobile are no longer accepted.

Contributions should usually be made in the form of a pull request. Find more information on how to contribute to jQuery projects at [contribute.jquery.org](https://contribute.jquery.org).
Contributions should usually be made in the form of a pull request. Find more information on how to contribute to jQuery projects at [contribute.jquery.org](https://contribute.jquery.org).
29 changes: 21 additions & 8 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,15 @@

Please check which versions of the jQuery project you are using are currently supported.

- The [latest released version of jQuery UI](https://github.com/jquery/jquery/releases) is supported.
- The [latest released version of jQuery](https://github.com/jquery/jquery/releases) is supported.
- The [latest released version of jQuery UI](https://github.com/jquery/jquery-ui/releases) is supported, but jQuery UI supports multiple versions of jQuery. More information can be found at https://jqueryui.com/.
- [jQuery Mobile](https://github.com/jquery-archive/jquery-mobile) is no longer supported.

Fixes are not backported to earlier versions. Commercial support for previous versions is available from third parties; see the [jQuery README](https://github.com/jquery/jquery#version-support).

@mgol mgol Oct 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not true in all cases for jQuery, we e.g. backported quite a lot of things to the upcoming 3.8.0.

We don't guarantee that and e.g. after 3.8.0 we will generally avoid such backports, but I wonder if this language is not too strong.


## jQuery Websites

The jQuery instrastructure is maintained with puppet and the configuration is publicly available and documented at https://github.com/jquery/infrastructure-puppet.
The jQuery infrastructure is maintained with puppet and the configuration is publicly available and documented at https://github.com/jquery/infrastructure-puppet.

Content for individual sites can be found in their respective repositories. For example, the content for jquery.com is available at https://github.com/jquery/jquery.com.

Expand All @@ -24,20 +26,31 @@ Please report security issues **privately**:

**Do not** file public GitHub issues for security problems.

When reporting, please include:
- Affected project/repo and version(s)
- Impact and component(s) involved
- Reproduction steps or PoC (if available)
Reports **must** include:
- The version(s) you tested, with the commit SHA if you tested a build from `main`
- The specific API involved, with the file and line in the project's source you believe is at fault

@mgol mgol Oct 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This repeats a lot that's also added in jquery/jquery#5925, so let's align on the final version there before merging.

- A proof of concept that runs against an unmodified build of the version you name
- A description, in your own words, of what the library is doing that you consider unsafe and what the impact is
- Your contact and preferred credit name

If you do not receive an acknowledgement of your report within **6 business days**, or if you cannot find a private security contact for the project, you may **escalate to the OpenJS Foundation CNA** at `security@lists.openjsf.org`.
Reports missing any of the above will be closed with a request for the missing information.

### Report quality and automated submissions

Most reports we receive are produced by automated tools or language models and do not describe a real vulnerability. Reviewing them costs maintainer time that would otherwise go to real issues.

You may use whatever tools you like to find and write up an issue, but you are responsible for every claim in your report. Reports that cite APIs, files, or lines that do not exist, that restate documented behavior as a vulnerability, or that name a vulnerability class without demonstrating a specific path through the library will be closed. We will ask follow-up questions and expect answers in your own words; if you cannot answer them, the report will remain closed. Repeat submissions of this kind may result in a ban from the project and withdrawal of any credit previously given.

This applies regardless of how the report reaches us: email, a GitHub security advisory, or escalation through the OpenJS Foundation CNA. See also [Unsolicited and Machine-Generated Contributions](CONTRIBUTING.md#unsolicited-and-machine-generated-contributions) in CONTRIBUTING.md.

If you receive no response (including a closure or a request for more information) within **6 business days**, or if you cannot find a private security contact for the project, you may **escalate to the OpenJS Foundation CNA** at `security@lists.openjsf.org`.

If the project acknowledges your report but does not provide any further response or engagement within **14 days**, escalation is also appropriate.

## Coordination & Disclosure

Important:
- If the vulnerability is considered valid and accepted, a patch will be made for the latest jQuery version.
- If the vulnerability is considered valid and accepted, a patch will be made for the latest version of the affected project.
- If the vulnerability is deemed invalid, no further action is required.

We follow coordinated vulnerability disclosure:
Expand Down