Fixes ship in a new release. They are not backported to older versions.

Please do not open a public issue for security problems.

Report vulnerabilities privately through GitHub's private vulnerability reporting. Include the affected file or component, steps to reproduce, and the impact you expect.

1. You get an acknowledgement within 14 days.
2. The report is assessed and you are told whether it is accepted, usually within 30 days of acknowledgement.
3. A fix is prepared privately. You are kept informed and may be asked to confirm the fix works.
4. The fix is released, and a GitHub Security Advisory is published with a CVE where one applies. The release notes list every fixed vulnerability by its advisory or CVE ID.
5. You are credited in the advisory unless you ask not to be.

Please keep the details private until the advisory is published. If a fix takes longer than 90 days, we will agree a disclosure date with you.

AI-generated code should not be trusted blindly. Users are entirely responsible for reviewing, testing, and securing the output produced by these agents before deployment.