Only the latest release is supported. Fixes land on main and go out in the next release; there are no backports to earlier tags.

Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than opening a public issue.

Expect an initial response within a week. If the report is accepted you'll be credited in the advisory unless you'd rather not be.