Mention the security fixes of 1.7.1

Author: lyrixx

.github/SECURITY.md

@@ -2,10 +2,10 @@
 
 ## Supported Versions
 
-Only 2.x gets security fixes: 1.x is no longer maintained. 2.0 fixes security
-issues 1.x has, which won't be fixed there, like revisions and URLs starting
-with a dash, which git reads as options, or the credentials of URLs in the
-messages of exceptions. To upgrade, see
+Only 2.x gets security fixes: 1.x is no longer maintained. 1.7.1 has the
+security fixes of 2.0 that break nothing of 1.x, and
+[its changelog](https://github.com/gitonomy/gitlib/blob/1.x/CHANGELOG.md) lists
+the ones it doesn't have. To upgrade, see
 [UPGRADE-2.0.md](https://github.com/gitonomy/gitlib/blob/main/UPGRADE-2.0.md).
 
 After each new major release from 3.0 on, the previous release will be

CHANGELOG.md

@@ -139,6 +139,9 @@ all deprecated since 1.7.
 
 ### Security
 
+1.7.1 has those that break nothing of 1.x: see
+[its changelog](https://github.com/gitonomy/gitlib/blob/1.x/CHANGELOG.md).
+
 -   Refuse a revision, a reference, a hash or a URL starting with a dash, which git read as an
     option: `getRevision('--output=/path')`, `WorkingCopy::checkout()` or `merge()` could write
     a file, and `Repository::isValidRepository('--upload-pack=...')` run a command. A path may