Security fixes are made on the latest published release.

Please do not open a public issue. Use GitHub private vulnerability reporting and include reproduction steps, affected versions, and impact. You can expect an acknowledgement within seven days.