Please do not report a vulnerability in a public issue. Report it privately on GitHub instead: in the Security tab of the repository, choose Report a vulnerability. Only the maintainers see the report.
Fixes are made on the latest version of the packages.