We provide security updates for main and for the most recent minor (X.Y) release series of TorchGeo. Security updates will be made available as patch (X.Y.1, X.Y.2, etc.) releases.

For more on TorchGeo's release structure, see our Wiki.

You can report a vulnerability using GitHub's private reporting feature:

1. Go to https://github.com/torchgeo/torchgeo/security.
2. Click "Report a vulnerability" in the upper right corner of that page.
3. Fill out the form and submit your draft security advisory.

More details are available in GitHub's docs.

You can expect to hear back about security issues within two days. If your security issue is accepted, we will do our best to release a fix within a week. If fixing the issue will take longer than this, we will discuss timeline options with you.