Only the latest release on npm receives security fixes.

Please do not open a public issue for security problems.

Report vulnerabilities privately through GitHub's Report a vulnerability form. If that form is not available, contact the package maintainer listed on npm.

You can expect an initial response within a week. Confirmed issues are fixed in a new release and credited in the release notes unless you prefer otherwise.