Only the latest released version on the Releases page receives fixes. There are no maintenance branches for older releases.

Please report security issues privately through GitHub's Report a vulnerability form. Do not open a public issue for a suspected vulnerability.

This is a small project maintained in spare time. Reports are handled on a best-effort basis -- expect an acknowledgement within a week or so, not a guaranteed response time. If a fix is warranted it ships in the next release and the advisory is published once users have had a chance to update.