Only the latest release and the current default branch receive security fixes. Fixes ship as new versions; published releases are not changed.

Report a suspected vulnerability privately through the repository's Report a vulnerability form (private vulnerability reporting; you need to be signed in to the forge). Please do not open a public issue for it.

A report should contain:

• the affected version or commit,
• a minimal reproduction,
• the impact you observed or expect.

Do not include passwords, API secrets, tokens or private data in a report.

The maintainers give a first answer within 14 days of a report. A fix has no promised date; how long it takes depends on the case. Please allow the maintainers to assess and fix an unpatched vulnerability before publishing exploit details. Ordinary bugs and feature requests belong in issues.