Fixes go into the latest release. If you are on an older major version, update to the current one first and check whether the problem is still there.

Please do not open a public issue for a security problem. Report it privately through GitHub's security advisories instead. Only the maintainer can see it there.

Describe what you found, how to reproduce it and which version you tested. You will get a reply within a week. Once a fix is out, the advisory is published with credit to you, unless you would rather stay anonymous.