Each supported major version is only serviced for security issues at its tip. For example 2.5 will receive updates but 2.4 will not. 3.0 will receive updates until 3.1 is stable, at which point 3.0 will no longer received security updates.

Please use the Security tab to responsibly report security vulnerabilities.

Alternatively, email the project's main contributors with any vulnerability you become aware of.

Yoshifumi Kawai <ils@neue.cc>; Andrew Arnott <andrewarnott@live.com>