One minor line is supported at a time per package, per the versioning and deprecation policy. Package versions are not numerically aligned. Version 1.0 has not been released; a 0.x minor may break with a migration note. Report a vulnerability against the version you are running and upgrade to that package's supported line.

Use GitHub's private vulnerability reporting for ThreeNativeHQ/threenative. If that is unavailable, contact joaopaulofurtado@live.com and include enough detail to reproduce the issue without exposing it publicly.

This is a one-maintainer project. Reports are reviewed and handled on a best-effort basis; no fixed response-time guarantee is offered.