Only the latest minor release receives security fixes.

Please do not open a public issue. Use GitHub's private reporting instead: Security → Report a vulnerability on this repository.

You will get an acknowledgement within 72 hours and a fix or mitigation plan within 14 days for confirmed issues. Credit is given in the release notes unless you prefer otherwise.