Report security vulnerabilities through GitHub private vulnerability reporting:
Do not open a public issue for a vulnerability. Do not send secrets, passwords, keys or plaintext exploit payloads outside the private advisory flow.
Only the latest minor of the current major line receives security fixes.
| Version | Supported |
|---|---|
| Latest 1.x minor | yes |
| Older minors or majors | no |
Fixes ship as new versions on the supported line. Unsupported lines do not receive backports.