Report it privately through GitHub's private vulnerability reporting for this repository. Please don't open a public issue, pull request, or discussion for it.

Include the affected version, the runtime, and the smallest code or input that reproduces the problem.

Fixes ship in a new release of the current 1.x line. Older 1.x minors, prereleases, and 0.x don't get backported fixes, so upgrade to the latest 1.x to receive them.