Please report vulnerabilities privately — do not open a public issue.

Use GitHub's private vulnerability reporting for this repository (Security → Report a vulnerability). We aim to acknowledge within a few days.

There are no supported "old" releases: fixes land on main and in the next tagged release.