The latest minor release of 1.x. A fix is released there only.

Do not report a vulnerability in a public pull request. Report it privately through GitHub: Report a vulnerability.

If you have a fix, add it in the private fork of the advisory. There is no fixed response time.

The package runs in test suites (require-dev), not in production code.