In MDL-69877 a new security.txt file, following the information @ security.txt was introduced.

The security.txt file located in /security.txt must be updated regularly, shortly before it expires (defined by the Expires element within the file).

The updates should be made to main, as well as all other security supported Moodle versions that contain security.txt. This means all supported versions have an identical security.txt file (including the same expiry).

This task must only land in the minor release versions that are scheduled for release alongside the relevant major release  (for example if 4.5 is the major release, then 4.4.3 4.4.4 will be one of the minors receiving the update). Therefore, the ideal window for landing this issue is 2-6 weeks prior to release.

As a minimum, this will involve updating the Expires value, which needs to be set to [expected subsequent major release date] + 3 WEEKS. This provides a small buffer in case the major release is delayed. If any of other details in the security.txt need to be amended, they should also be completed at the same time. We should also check the RFC in case of any changes (see the Github repo to check if any versions have been released since the previous LMS release).

Detailed information (to be modified for each clone of this issue):

• Branches affected: main (45), 44, 43, 42, 41
• Expiry (5.0 release + 3 weeks): 14 April 2025 + 3 weeks = 5 May 2025
• Other changes: ... add any further changes required here

Exact formatted expiry date to use: 2025-05-05T01:00:00.000Z

How the date format was calculated (in line with the latest spec):

date --date='5 May 2025 01:00' -u +"%FT%H:%M:%S.000Z"

(This issue is part of the release process, 2 weeks before release, and will be cloned as part of it.)