Only the latest stable release receives security fixes.
Before reporting, please check that the issue still happens on the latest version.
Use GitHub Security Advisories to report vulnerabilities privately.
If you are not familiar with this feature, read the GitHub documentation.
Important
GitHub Security Advisories is the only accepted channel. Reports sent by email, or posted in public issues, pull requests, or discussions, will not be considered.
- Affected version and configuration
- Description of the issue and its impact
- Steps to reproduce, or a proof of concept
Keep your report short and to the point, and verify the issue yourself before submitting it. Please do not submit long, AI-generated reports.
Reports that are vague, speculative, or that cannot be reproduced will be closed without further discussion.