The newest published release of each feature under src/ is supported. Fixes are released as a new feature version and picked up by the floating tags (1, 1.1, latest); earlier versions are not patched in place.

You can report a vulnerability privately via private vulnerability reporting on GitHub. See GitHub Docs for more information.