The following version(s) are supported:

In order to report a vulnerability, use GH's private vulnerability report feature, which is enabled on this repository. Expect a response within one week.

Pull requests with fixes are also appreciated, although this package needs a good suite of regression tests before changes can be introduced, as its related npm package is downloaded several hundred thousand times per year. I'm currently working on a test suite (2026-10).