Please do not open a public issue for a security vulnerability. Report it privately through GitHub instead: Report a vulnerability (the repository's Security > Advisories > Report a vulnerability). This opens a private advisory visible only to you and the maintainers; you will get an acknowledgement, and we will coordinate a fix and disclosure with you.

Security fixes target the latest 3.0.x release. Please reproduce on the current version before reporting, in case the issue is already fixed.