The latest release in the v3 series is the actively supported version.
| Version | Security support |
|---|---|
| Latest v3 release | Supported |
| Earlier v3 releases | Please upgrade; fixes are evaluated case by case |
| v2 | Evaluated case by case, depending on severity and feasibility |
| v1 | Not supported |
We recommend upgrading to the latest v3 release before reporting an issue that may already have been fixed.
Please report suspected vulnerabilities through GitHub's private vulnerability reporting.
Do not open a public issue or discussion for an undisclosed vulnerability. In your private report, include the following when possible:
- The affected package and version
- A description of the impact and attack scenario
- Minimal steps or code needed to reproduce the issue
- Any suggested mitigation or fix
Please do not include credentials, production data, or other secrets in the report.
The maintainers will review reports as availability allows. Response and fix timelines cannot be guaranteed and depend on the severity and complexity of the issue. Please allow time for investigation and coordinated disclosure before publishing details.