Security fixes are released for the latest minor version only. Upgrade to the latest release to receive them.

Do not open a public issue, pull request, or discussion for a security problem.

Report it privately through GitHub:

1. Open the Security tab of the affected repository.
2. Click Report a vulnerability.

Include as much of the following as you can:

• the affected package and version
• a description of the problem and its impact
• steps or code to reproduce it
• a suggested fix, if you have one

• We acknowledge new reports within 5 business days.
• We confirm or rule out the problem, and keep you updated while we work on a fix.
• We aim to release a fix within 90 days of the report.
• Once a fixed version is released, we publish a GitHub security advisory, request a CVE when the issue warrants one, and credit you unless you ask us not to.

Please keep the report private until the advisory is published.