Redocly actively monitors its product packages for known security vulnerabilities and follows a defined process to address them.
We run automated daily audits against the published stable versions of our packages. When a vulnerability is found in the dependency tree, our engineering team triages the advisory and determines the appropriate fix.
Redocly follows a monthly release cycle for stable versions. Security fixes are released as patches between stable releases according to the following policy:
| Severity | Release timeline |
|---|---|
| Critical | A dedicated patch release is published as soon as the fix is ready. |
| High, Moderate, Low | Fixes are accumulated and released as a single patch within 14 days of the most recent stable release. |
All security patches include a changeset entry in the changelog, so you can track exactly what was fixed.
- Reunite users — if your project does not pin a version in
package.json, it picks up the latest version automatically on each build. If you do pin a version, update it inpackage.jsonand trigger a new build. - Local development users — update the version in your
package.jsonand reinstall dependencies. See Upgrade product version for detailed instructions.
If you discover a security vulnerability in a Redocly product, please contact us at security@redocly.com.