Security fixes go into the latest 0.x release of streaming-community only. There are no maintenance branches for older releases; if you are on an older release, upgrade to the latest one.

Do not open a public issue for a security problem. Report it privately through GitHub's private vulnerability reporting on this repository: https://github.com/secondwindoss/streaming-community/security/advisories/new. Include the version you tested, what the problem is and, if you can, how to reproduce it.

You will hear back within a week. A confirmed problem is fixed in the next release, and the advisory is published once the fix is out. If you do not get a reply in that time, open an issue that says only that you have sent a report, without details.

Dependency advisories are tracked through Dependabot alerts on this repository, and Dependabot opens weekly update pull requests for the Python dependencies and GitHub Actions used here.