Please report a security problem privately, through GitHub's private reporting, rather than in a public issue. You will get an answer, and credit if you want it, once it is fixed.

Fixes go into the next release; the latest release is the one supported.