| Version | Security fixes |
|---|---|
3.x, pre-releases included (next) |
yes |
| 2.x and older | no |
Report it privately through GitHub's vulnerability reporting, not in a public issue. Include the affected version and a minimal reproduction.
A confirmed vulnerability is fixed in 3.x and published as a GitHub security advisory.