Security fixes are applied to the latest released major version on the default branch (develop / published releases). Older majors may not receive patches.
Please do not open a public GitHub issue for unfixed security vulnerabilities.
Use GitHub’s private vulnerability reporting for this repository:
- Open the repository Security tab
- Choose Report a vulnerability
- Include steps to reproduce, impact, and affected versions when possible
We will acknowledge the report, triage it privately, and coordinate disclosure through a security advisory when appropriate.