Please do not open a public issue for a vulnerability.

Report it privately with GitHub's "Report a vulnerability" button (private vulnerability reporting / security advisories) on the affected repository. We aim to acknowledge reports within three business days and to share a fix plan within ten.

Supported: the latest release of each repository. Older releases get fixes at our discretion.

We credit reporters in release notes unless you ask us not to.