Security fixes target the latest master branch.

Please use GitHub private vulnerability reporting for this repository. Avoid opening public issues for suspected vulnerabilities until they have been triaged.

We aim to acknowledge reports within 3 business days and will coordinate disclosure timing through the private advisory.