The latest released minor series and the current main branch receive security fixes. Older 0.x lines may receive a fix when the change is low risk, but they are not a standing compatibility promise.

Use GitHub’s private vulnerability-reporting form for this repository. Include the affected version or commit, platform, impact, and the smallest reproduction you can share safely. Do not open a public issue for a vulnerability that has not been coordinated.

The maintainer will acknowledge a report, assess severity and affected artifacts, and coordinate a fix and disclosure timeline with the reporter. Registry credentials, tokens, private paths, and customer data must never be included in a public advisory or test fixture.