Security fixes are applied to:
| Version | Supported |
|---|---|
| Latest stable tag | Yes |
| Latest release candidate tag | Yes |
main |
Best effort |
| Older release channels | No |
Use GitHub private vulnerability reporting for this repository when available. If private reporting is not enabled, contact the repository owners directly before opening a public issue.
Include:
- affected version or commit
- impact summary and prerequisites
- reproduction steps or proof of concept
- any mitigation already identified
Do not publish proof-of-concept details until the issue has been acknowledged and a disclosure timeline has been agreed.
- Initial triage target: 3 business days
- Remediation plan target for confirmed issues: 7 business days
- Critical issues may receive out-of-band releases