If you believe you have found a security vulnerability in any package published from this repository (or in the repository tooling itself), please do not open a public issue.

Use GitHub Private Vulnerability Reporting instead:

1. Go to the Security tab of this repository.
2. Click Report a vulnerability.
3. Fill in the form. The maintainers receive the report privately and coordinate a fix and disclosure with you.

Only the latest published version of each package is supported with security fixes. Older majors do not receive backports unless explicitly called out in a release note.

In scope:

• The packages published from packages/* to npm under the ui5-community org.
• The CI workflows under .github/workflows/ and the release configuration that produces those packages.

Out of scope:

• Demo applications under showcases/*. These exist to exercise the middleware/task extensions and are not intended for production use.
• Vulnerabilities in third-party dependencies that are already tracked by Dependabot or upstream advisories — please report those upstream.