Security fixes are released for the latest minor version of the current major release. Older versions do not receive security updates, upgrade to the latest version to receive fixes.

Do not open a public issue for security vulnerabilities.

Report vulnerabilities privately through GitHub private vulnerability reporting. If you cannot use GitHub, email rtivital@gmail.com.

Include the affected package and version, a minimal reproduction, and the impact you have identified. You will receive a response within 7 days with the next steps. Once a fix is released, you will be credited in the advisory unless you prefer to stay anonymous.