Please do not open a public issue. Use GitHub private vulnerability reporting instead.

You can expect a first response within 7 days. Confirmed issues get a fix, a regression test and a GitHub security advisory.

Only the latest major version receives security fixes.

Every version is published from GitHub Actions with npm provenance, so you can verify that the package on npm was built from this repository.