Security fixes are handled on the latest released minor version.

Report security issues through GitHub's private vulnerability reporting form. If that form is unavailable, open a public issue that asks the maintainers to enable a private contact path, but do not include vulnerability details in that issue.

Do not open a public issue for a vulnerability until maintainers have confirmed that disclosure is appropriate.