The latest 0.x release receives security fixes. After 1.0, the latest minor release of the newest major version will be supported.

Please use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability). Do not open public issues for security reports.

You can expect an initial response within seven days. Fixes are released as patch versions and noted in the changelog once a report is resolved.