The newest npm latest release and any explicitly listed security-maintenance release receive security fixes. Release candidates on next are supported only until their corresponding stable release is published.

Do not open a public issue for a suspected vulnerability or exposed credential. Use GitHub's private vulnerability report for this repository:

https://github.com/guoxiucai/dsh-code/security/advisories/new

Include the affected version, platform, reproduction steps, impact, and any suggested mitigation. Please allow the maintainer time to reproduce and coordinate a fix before public disclosure.

Never include real API keys, npm tokens, session files, or crash logs that have not been reviewed and redacted.