Security fixes are provided for the latest released minor version. Pre-1.0 older minors may not receive patches once a newer minor is available.

Please do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability reporting and include the affected version, deployment model, reproduction steps, and expected impact.

You should receive an acknowledgement within seven days. A coordinated fix and disclosure timeline will be agreed after the report is reproduced and triaged.