When a release of Depotex fixes a security problem, it is announced here, with the versions affected, the version that fixes it and what to do until you can upgrade. Administrators should subscribe to the feed; everyone else can check here when asked to upgrade.
1. Subscribe
Add this address to your feed reader, Slack or Microsoft Teams RSS app, or monitoring tool:
https://docs.vectored.dev/depotex/advisories.xmlOpen the RSS feed. Each item links to its advisory below. Most browsers and feed readers also find the feed on their own from this page.
To get advisories by email as well, write to support@vectored.dev with the address to send them to and your licensee name.
2. Advisories
No security advisories have been issued for Depotex.
3. DPX-NOTICE-2026-001
Security advisory feed opened
- Published: 2026-11-02
Depotex security advisories are now published on this page and in an RSS feed. No advisories have been issued so far.
What to do: Subscribe to the feed to hear about future advisories.
4. Severity
Each advisory has a CVSS score and one of these ratings, which say how soon to act:
| Rating | CVSS | Means | Act |
|---|---|---|---|
| Critical | 9.0–10.0 | Exploitable from the network without an account, or leads to a full takeover | Upgrade at once, or apply the workaround now |
| High | 7.0–8.9 | Serious, but needs an account, a particular setting or a step from someone | Upgrade in your next maintenance window, within days |
| Medium | 4.0–6.9 | Limited impact or hard to exploit | Upgrade with your regular updates |
| Low | 0.1–3.9 | Minor, defense in depth | Upgrade with your regular updates |
5. What an advisory contains
- An ID (DPX-SA-<year>-<number>) and, where one is assigned, the CVE.
- What could happen and who is exposed: which features, settings, license tiers or deployment modes are affected.
- Affected versions and the version that fixes it. Fixes ship in a new release of the server image and the web app image together.
- A workaround or mitigation when there is one, and how to tell whether you were affected (audit log entries, log lines).
- Credit to the person who reported it, if they want it.
Problems in components Depotex is built with (Go, Next.js, PostgreSQL client libraries and others) get an advisory when they affect Depotex as shipped. Upgrading to the latest release always brings their fixes; see Upgrades.
6. Check your version
The footer of every page, and ? → About, show the version and build of the server that answered. In a cluster check each server: Settings → Clustering lists every server's version. From a script, GET /api/health answers with the version without signing in.
7. Report a vulnerability
Found a security problem in Depotex? Please tell us privately, not in a public issue or forum, so we can fix it before it's widely known.
- Write to us — Email security@vectored.dev with the version, how to reproduce it, and what an attacker could do. Don't include real customer data, credentials or keys.
- We confirm — We acknowledge your report, confirm whether it's a vulnerability, and keep you informed while we fix it.
- We fix and publish — The fix ships in a release, then the advisory is published here and in the feed, crediting you if you wish.
Please give us reasonable time to release a fix before you disclose it, test only against installations you own, and don't access or change other people's data. We won't take action against research done in good faith under these terms.
For help with your own installation (configuration, an error you see) use Support instead.