Open source maintainers announce security fixes through a mix of channels: a repository advisory, release notes, a project announce mailing list, and sometimes the public oss-security list. No single channel covers every project, so follow the ones your projects actually use and let tooling catch the rest.
The channels, side by side
Different projects publish in different places. The table below uses what three well known projects document about their own process.
| Channel | What it carries | Example from project docs |
|---|---|---|
| Project announce list | Notice of an upcoming or published security release | Go uses golang-announce, Django uses django-announce, Kubernetes uses kubernetes-security-announce |
| Repository advisory | Affected and patched versions, impact, workarounds, credits | GitHub advisories describe these fields |
| Release notes or changelog | What changed, sometimes with a security heading | Keep a Changelog defines a Security heading |
| oss-security list | Public discussion by projects, distributors and researchers | Charter says issues posted must already be public or become public by the post |
| Users list | Questions about whether a published issue affects you | Apache directs such questions to the project users list |
Each row answers a slightly different question. An announce list tells you something is coming. An advisory tells you what is affected. Release notes tell you which version to move to.
Start with the projects you cannot afford to miss
You do not need to watch every dependency by hand. Pick the handful that sit on your most exposed services: your language runtime, your web framework, your container platform. Join their announce lists with a shared mailbox, not a personal one, so the notice survives someone going on leave.
The Go security policy describes a pre-announcement sent to golang-announce three to seven days before certain security releases. Django says it notifies django-announce about a week before disclosure of the date and approximate time of the release and the severity of the issues. Kubernetes asks readers to join kubernetes-security-announce for security and major API announcements. These are the early signals worth routing to an on-call channel.
Use feeds for everything else
For the long tail of libraries, an announce list per project is unrealistic. Two things scale better. First, GitHub lets you watch a repository for specific event types, including releases and security alerts, so you can ignore the noise. Second, an SBOM-driven scanner matches new advisories to the exact versions you ship, so you hear about the packages you use and nothing else.
What to do with an announcement
- Identify the package and the affected version range.
- Check your inventory for that package, including transitive copies.
- Read the advisory for the patched version and any workaround.
- Decide a deadline based on exposure, not only on the headline score.
- Record what you did and when.
Our guide on triaging an advisory inbox in ten minutes covers steps 1 to 4 in more detail.
Where Safeguard fits
Safeguard builds an SBOM from your repositories and matches advisories to the versions you run, then uses reachability analysis to show whether the vulnerable code is called. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a new advisory in the demo and look at how quickly it is tied back to the components in an inventory.
Quick check
Is the oss-security list the place to learn about every fix?
No. Its charter says it is for public discussion and that advisories aimed only at end users are not welcome, so many fixes never appear there. Treat it as one source among several.
Do I need a mailing list if I use a scanner?
A scanner covers the long tail. Announce lists still help for your most critical runtimes because they can warn you days before the fix is public.
Sources
- Go Security Policy
- Django security policies
- Kubernetes security and disclosure information
- oss-security mailing list charter
- Apache Software Foundation security team
- Keep a Changelog 1.1.0
- GitHub Docs: configuring notifications
Last reviewed: 19 October 2026.
