Security updates are applied only to the most recent release.

If you believe you have discovered a security issue, please report it privately. We take all security reports seriously. If we confirm the issue, we will patch it within a reasonable amount of time and publish a security bulletin that discusses the impact and credits the reporter. Do not disclose the issue publicly. Private reporting gives us time to develop a fix before public exposure and reduces the chance that the vulnerability will be exploited before a patch is released.

The easiest way to report a security issue is through a private security advisory. Please include a description of the flaw and related information, such as reproduction steps and affected versions.