The latest main branch and the two most recent minor releases.

• E-mail the maintainers (see the repository owner contact) or open a private GitHub security advisory.
• Please do not disclose an unfixed issue in a public issue or PR.
• We acknowledge within 7 days and agree a disclosure timeline with you.

• affected version and environment
• reproduction steps, and a proof of concept if you have one
• impact assessment and any suggested fix