Security fixes are released for the latest minor version of v1.

Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than in a public issue.

Include the affected package and version, a description of the impact, and a minimal reproduction if possible. Fixes are published as a new patch release with a GitHub security advisory.