Both processing paths of dynamic-ssz are production ready:

• Reflection-based dynamic marshaling/unmarshaling/HTR: Battle-tested across various Ethereum toolings
• Code generator (dynssz-gen): Feature complete, validated against the official consensus spec tests and continuously verified through differential fuzzing against the reflection implementation

dynamic-ssz follows semantic versioning:

• Major versions are the only place where breaking changes may occur. Within the same major version, the public API of the root package, treeproof, hasher and sszutils and the behavior of generated code remain backward compatible.
• Minor versions introduce bigger features and new functionality.
• Patch versions contain bugfixes and small improvements.

The reflection, ssztypes and codegen packages and the dynssz-gen command are engine internals: their Go API and flags may change in a minor version. Code they generated stays covered by the guarantee above.

Backward compatibility is not just a promise: code generated by every previous v1.x release is archived in codegen/compat-tests and actively checked by the CI on every change, ensuring that generated code from older releases keeps working with newer library versions.

I take the security of the dynamic-ssz library seriously. If you believe you have found a security vulnerability in dynamic-ssz, please report it to me in a responsible manner.

Please do not report security vulnerabilities through public GitHub issues.

For critical security issues, please use one of the following methods:

• GitHub Security Advisories: Report a vulnerability (preferred)
• Matrix: @pk910:matrix.org
• Twitter: @pk910
• Discord: pk910 (find me at EthStaker or ETH R&D communities)

I appreciate your effort to responsibly disclose your findings.

Your report should include:

• The conditions under which the vulnerability occurs.
• Detailed steps to reproduce the vulnerability.
• Any relevant logs, error messages, or outputs.
• If possible, a proof-of-concept or exploit code.

Upon receiving a report of a vulnerability:

• I will assess the vulnerability for its veracity and potential impact.
• I may contact you for further information.
• I will work on addressing the issue and keep you updated on the progress.

I aim to collaborate with the security community to identify and resolve vulnerabilities responsibly. I will keep the community informed of security issues that may arise during the development process.

Thank you for helping ensure the security and reliability of dynamic-ssz.