Until tagged releases are published, security fixes are provided only for the current main branch. Fixes are not backported to older commits.

Do not report suspected vulnerabilities through public issues, discussions, or pull requests.

Use the repository's Security tab, open Advisories, and select Report a vulnerability. Include the affected version or commit, reproduction steps, potential impact, and any suggested mitigation.

Please keep the report private until a fix and coordinated disclosure are complete.

Use the public issue tracker for ordinary bugs, feature requests, and support questions.