This repository holds a build definition only: ffmpeg-build.yml, its lock and the workflows that build and publish the releases. The builds themselves are made by ffmpeg-build, from each library's upstream source, pinned by commit or checksum in ffmpeg.lock.

Please report privately, through Security → Report a vulnerability on this repository; don't open a public issue.

• The builds or how they are made (what is downloaded and how it's checked, the toolchains, the workflows): report it to ffmpeg-build.
• FFmpeg or a bundled library's own code: report it upstream. Fixed upstream releases reach these builds through the daily lock update.
• Anything about this repository's configuration or releases: here.