From e39dcf926cc9f7db6ff92822d401fe59a4fcf976 Mon Sep 17 00:00:00 2001 From: Laurianti Date: Fri, 9 Oct 2026 22:30:17 +0200 Subject: [PATCH 1/2] Say in SECURITY.md and CONTRIBUTING.md that the package is deprecated and the provider moved --- CONTRIBUTING.md | 4 ++-- SECURITY.md | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 291b427..a176da4 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,10 +1,10 @@ # Contributing -Issues and pull requests are welcome. +The provider moved to [CommunityToolkit.VectorData.Chroma](https://www.nuget.org/packages/CommunityToolkit.VectorData.Chroma) and is developed in [CommunityToolkit/AI](https://github.com/CommunityToolkit/AI): open issues and pull requests there. This repository will be archived. ## Build and test -See [Building and testing](README.md#building-and-testing) for: +See [Building and testing](https://github.com/ChromaDotNet/ChromaDB.VectorData/blob/v0.4.3/README.md#building-and-testing), in the README of 0.4.3, for: - the commands - Docker diff --git a/SECURITY.md b/SECURITY.md index 019d212..d3020a1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,9 @@ ## Supported versions -Security fixes go into the latest release of `ChromaDotNet.VectorData` on NuGet. Earlier versions do not get fixes: update to the latest one. +`ChromaDotNet.VectorData` is deprecated: 0.4.4 is its last release, and no version gets fixes any more, security fixes included. Move to [CommunityToolkit.VectorData.Chroma](https://www.nuget.org/packages/CommunityToolkit.VectorData.Chroma), the same provider in the [AI Community Toolkit](https://github.com/CommunityToolkit/AI). + +A vulnerability in `CommunityToolkit.VectorData.Chroma` goes to the AI Community Toolkit. A vulnerability in `ChromaDotNet.Client` goes to its [security policy](https://github.com/ChromaDotNet/ChromaDB.Client/blob/main/SECURITY.md). ## Reporting a vulnerability @@ -16,7 +18,7 @@ Include the version of the package, the version of Chroma or Chroma Cloud, and t - We acknowledge the report within 7 days. - We confirm or rule out the vulnerability within 14 days, and keep you informed of the progress. -- A confirmed vulnerability is fixed in a new release. A GitHub security advisory follows the release, with credit to you unless you prefer otherwise. +- A confirmed vulnerability gets a GitHub security advisory that says which package to move to, with credit to you unless you prefer otherwise. This package gets no new release. - Please keep the details private until the advisory is published, and for at most 90 days from the report. ## How the package is published From 27b3258f5b16765ebf7225f86652e30d79684f50 Mon Sep 17 00:00:00 2001 From: Laurianti Date: Fri, 9 Oct 2026 22:34:58 +0200 Subject: [PATCH 2/2] Say in SECURITY.md which reports the form takes, and where they go --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index d3020a1..c783096 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,7 @@ `ChromaDotNet.VectorData` is deprecated: 0.4.4 is its last release, and no version gets fixes any more, security fixes included. Move to [CommunityToolkit.VectorData.Chroma](https://www.nuget.org/packages/CommunityToolkit.VectorData.Chroma), the same provider in the [AI Community Toolkit](https://github.com/CommunityToolkit/AI). -A vulnerability in `CommunityToolkit.VectorData.Chroma` goes to the AI Community Toolkit. A vulnerability in `ChromaDotNet.Client` goes to its [security policy](https://github.com/ChromaDotNet/ChromaDB.Client/blob/main/SECURITY.md). +The form below takes reports about this package. It also takes reports about `CommunityToolkit.VectorData.Chroma`, and we pass them privately to the maintainers of the AI Community Toolkit. A vulnerability in `ChromaDotNet.Client` goes to its [security policy](https://github.com/ChromaDotNet/ChromaDB.Client/blob/main/SECURITY.md). ## Reporting a vulnerability