Security fixes are released for the latest minor version published on PyPI.

Please do not open a public issue. Report it privately through GitHub's private vulnerability reporting with a description, the affected version and, if possible, steps to reproduce.

You will get an answer as soon as possible. Once a fix is ready it is released as a new version, and the advisory is published with credit to the reporter (unless you prefer to stay anonymous).