Security fixes ship in a new release of the latest major version, currently 2.x. Earlier versions are not patched, so update to the latest release.

If you discover a security issue, please use GitHub's private vulnerability reporting. If you cannot use the private report form, email opensource@heirloomlogic.com. Do not open a public issue.

We will acknowledge your report within 48 hours and follow up with next steps.