Security fixes are not backported to older minor versions. They are either released as a patch to the latest minor version branch, or included in a new minor version.
When a new major version is released (1.0, 2.0, etc), the previous one (0.19.x) will receive bug fixes for at least 3 months and security updates for 6 months after that new release comes out.
(This policy may change in the future and exceptions may be made on a case-by-case basis.)
If you discover a security vulnerability within this package, please report it using any of the following methods:
- Open a private security advisory on GitHub
- Use the Tidelift security contact form
- Email Colin O'Dell at colinodell@gmail.com
All security vulnerabilities will be promptly addressed. Please do not disclose security-related issues publicly until a fix has been announced.