Please report a vulnerability privately, through GitHub security advisories, and not in a public issue. Include what you found, how to reproduce it, and the versions affected. You can expect a first reply within a week.

Fixes go into the latest release; only the latest release is supported.