Security fixes are made against the latest released minor version. Pre-1.0 releases do not receive a long-term support window.

Please use GitHub's private vulnerability reporting for suspected vulnerabilities. Include affected versions, impact, a minimal reproduction when practical, and any suggested mitigation.

Do not disclose an unpatched vulnerability in a public issue or discussion. The project will acknowledge a report through the private advisory and coordinate validation, a fix, and disclosure there.