Fixes land on main and ship in the next release. Only the latest release gets them; install a newer tag to pick one up.

Please report it privately, not in a public issue. On the repository's Security tab, choose Report a vulnerability, or open the form directly at https://github.com/gmrdad82/pgpu/security/advisories/new. Say what you found, the version or commit, and how to reproduce it: the command line and what pgpu status --json showed help most.

The report stays private between you and the maintainer until a fix is released. You will hear back on the advisory, and the fix and its release are credited to you unless you would rather they were not.