Only the latest release receives security fixes. If you are on an older version, upgrade first: the issue may already be fixed.

Report vulnerabilities privately via GitHub Security Advisories ("Report a vulnerability" button on the Security tab). Please do not open a public issue for security reports.

Include a description, reproduction steps, and the impact you expect. You will get an answer as soon as possible; a fix and a coordinated disclosure follow.