Only the latest release receives security fixes.

Please use GitHub's private vulnerability reporting form: report a vulnerability.

Do not open a public issue for an unpatched vulnerability. Include reproduction details and a safe contact method.

Our target is to coordinate public disclosure within 90 days of the initial report. The schedule may change when a fix, coordination, or user communication requires more time.