The latest v1.0.x release receives security fixes.

Use GitHub's private vulnerability reporting for this repository. Do not open a public issue. Include affected versions, reproduction steps, impact, and any suggested mitigation. The maintainers will acknowledge the report and coordinate disclosure through the private advisory.