Security fixes are released for the latest major version of each package published from this repository. Older major versions are not patched, so please upgrade to receive fixes.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately through GitHub's private vulnerability reporting.

Please include as much of the following as you can:

• The affected package(s) and version(s)
• The type of issue (for example prototype pollution, ReDoS or a cryptographic weakness)
• Steps to reproduce, ideally with a minimal proof of concept
• The impact, and how an attacker might exploit it

• You should receive an acknowledgement within 7 days.
• Once the issue is confirmed, a fix will be developed privately and released as a patch to the affected packages.
• A GitHub security advisory will be published once a fix is available. You will be credited unless you prefer not to be.

Please give us a reasonable amount of time to release a fix before disclosing the issue publicly.