Only 2.x gets security fixes: 1.x is no longer maintained. 1.7.1 has the security fixes of 2.0 that break nothing of 1.x, and its changelog lists the ones it doesn't have. To upgrade, see UPGRADE-2.0.md.

After each new major release from 3.0 on, the previous release will be supported for no less than 12 months, unless explicitly stated otherwise. This may mean that there are multiple supported versions at any given time.

If you discover a security vulnerability within this package, please send an email to security@tidelift.com. All security vulnerabilities will be promptly addressed. Please do not disclose security-related issues publicly until a fix has been announced.