The project is not backwards compatible, and as such only the latest version is supported with security updates.

Do not disclose a vulnerability, credentials or private operational data in a public issue or pull request. Follow the affected repository's own security policy when it has one.

For repositories using this default policy, open the affected repository's Security tab and choose Report a vulnerability to submit a private report to its maintainers. Private reporting is enabled for this shared automation repository at Report a vulnerability. Use the affected repository's report form, not this repository's form for an unrelated product.

If that option is unavailable, request a private reporting channel without posting sensitive details. Wait for a private channel before sending reproduction steps or impact information.