Security fixes are provided for the latest v1 release line after the first public release.

Pull requests that change dependencies are checked by GitHub Dependency Review. This is a preventive control for dependency changes and does not replace private vulnerability reporting.

Do not open a public Issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository and include impact, reproduction steps, and any proposed mitigation. The maintainer will acknowledge the report and work with you on disclosure.