Security fixes are released for the latest minor version of the current major version.

Do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately with the GitHub form: Report a vulnerability (Security tab of this repository, "Report a vulnerability").

Please include the affected version, a description of the issue and of its impact, and the steps or the configuration to reproduce it. You will receive an answer as soon as possible. Once the vulnerability is confirmed, a fix is prepared in a private fork, released, and a security advisory is published, crediting you unless you prefer otherwise.