Security fixes are released for the latest minor version only. Upgrade to the latest release to receive them.
Do not open a public issue, pull request, or discussion for a security problem.
Report it privately through GitHub:
- Open the Security tab of the affected repository.
- Click Report a vulnerability.
Include as much of the following as you can:
- the affected package and version
- a description of the problem and its impact
- steps or code to reproduce it
- a suggested fix, if you have one
- We acknowledge new reports within 5 business days.
- We confirm or rule out the problem, and keep you updated while we work on a fix.
- We aim to release a fix within 90 days of the report.
- Once a fixed version is released, we publish a GitHub security advisory, request a CVE when the issue warrants one, and credit you unless you ask us not to.
Please keep the report private until the advisory is published.