Security updates are applied to the latest minor release on the main branch.

Please do not open public issues for security vulnerabilities.

Instead:

1. Open a private security advisory on GitHub, or
2. Contact the maintainers directly with reproduction steps and impact.

You can expect an initial response within 5 business days.