Security fixes are released for the latest minor version only.

Please do not open a public issue for security vulnerabilities.

Report them privately through GitHub's private vulnerability reporting. Include a description of the issue, the affected version, and steps to reproduce it if possible.

You can expect an acknowledgement within a week. Once the issue is confirmed, a fix is released as soon as practical and the advisory is published afterwards, crediting the reporter unless they prefer otherwise.