Please report vulnerabilities privately through GitHub's private vulnerability reporting, not in public issues or pull requests. Include the affected package and version, how to reproduce it, and what an attacker gains.

You should get a reply within a week. Fixes are released as patch versions of the latest release line, and the advisory is published once a fix is out.

Only the latest release receives security fixes.