We provide security updates for the following releases. For more on Spack's release structure, see README.md.

To report a vulnerability or other security issue, email [email protected].

You can expect to hear back within two days. If your security issue is accepted, we will do our best to release a fix within a week. If fixing the issue will take longer than this, we will discuss timeline options with you.