Security fixes are released for the latest v1.4.x tag on the main branch.

Do not open a public issue or pull request for a security problem.

Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Include the affected version or commit, the component, and the steps needed to reproduce the problem.

You will get an acknowledgement within 3 working days. The fix is developed in private and released as a new patch tag; the advisory is published after the release.