Only the current state of the main branch is supported. Fixes land on main; no patches are issued for earlier commits.

Report vulnerabilities through GitHub private vulnerability reporting:

Report a vulnerability

Do not open a public issue, pull request, or discussion for a security report.

Include the commit you tested, steps to reproduce, and the impact you believe it has. A minimal reproduction is the most useful thing you can attach.

You will get an acknowledgement on the advisory thread, and updates there as the report is triaged and fixed. Once a fix is released the advisory is published with credit to the reporter unless you ask otherwise.