Document a risk-based bump window for vendored msgpack-c and NAN

SECURITY.md / README inventory the vendored msgpack-c pin (c-7.0.2). That is not a severity-based patch SLA for msgpack-c or compile-in NAN.

Document a risk-based bump window (e.g. critical native advisories within N days).

Implemented in #14 (branch fix/review-open-6-13).

Tracked upstream: msgpack#25702

Closing this fork issue as a duplicate of that ticket. Numbering on enochgroot/msgpack-node is a different sequence from msgpack/msgpack-node.

Navigation Menu