The latest 0.x release receives security fixes. After 1.0, the latest minor release of the newest major version will be supported.

Use GitHub private vulnerability reporting for this repository (Security → Report a vulnerability). Do not open a public issue.

Expect an initial response within seven days. Resolved reports receive patch releases and changelog entries after coordinated disclosure.