Security fixes are provided for the latest minor release of the current major version.

Please report security vulnerabilities privately via GitHub's private vulnerability reporting.

Include a description of the issue, the affected versions, and (if possible) a minimal reproduction. You can expect an initial response within 7 days. Once confirmed, a fix will be released in a patch or minor update, and an advisory will be published after the fix is available.