Please do not report security issues in the public issue tracker, discussions, or pull requests.

Report them privately through GitHub's private vulnerability reporting: go to the Security tab, choose Report a vulnerability, and fill in the form (direct link). Only the maintainers can see the report.

Please include:

• the affected package and version or commit,
• a description of the issue and its impact,
• steps or a test case that reproduce it.

We'll respond in the advisory, work with you on a fix, and publish the advisory (with a CVE where warranted) once a fixed release is available. Please give us a chance to ship that fix before disclosing the issue publicly.

Fixes are made on main and included in the next release.