Security fixes are released for the latest major.minor release line. Maintainers may also backport a fix to earlier lines.

Please report a vulnerability privately, through one of:

• GitHub private vulnerability reporting
• the Tidelift security contact, which will coordinate the fix and disclosure

Don't open a public issue. See the security page for what to include and what happens next.