Fix the two private security advisories before the release #208

Two reports from the security review of 2026-11-09 are private advisories, as SECURITY.md asks. Only the maintainer can open them:

• GHSA-9x2m-75cc-22gg (medium)
• GHSA-w7qh-qfh4-4v6m (low)

Each advisory has the places in the code, the fix and the tests to write first. The fixes are made in the private fork of the advisory or in a pull request that does not describe the problem, and each advisory is published with the release that has its fix.

This issue is closed when both are fixed and released.