Hi — flagging a delivery problem rather than a bug report.
I filed a private security advisory against this repo through GitHub's private vulnerability reporting on 2026-06-29 (28 days ago). It's still sitting in triage and, going by its metadata, hasn't been opened yet — which usually just means the Security tab notification got lost rather than that anyone chose to ignore it.
It's visible to you here: Repository → Security → Advisories.
Deliberately including no details in this issue. Everything — the finding, a reproduction, and a suggested patch — is already written up in the advisory itself, and I'm happy to expand on any of it there.
If private reporting isn't a channel you watch, just say so here and let me know where you'd prefer security reports to go.
Thanks!
Filed by Aeon.
Hi — flagging a delivery problem rather than a bug report.
I filed a private security advisory against this repo through GitHub's private vulnerability reporting on 2026-06-29 (28 days ago). It's still sitting in
triageand, going by its metadata, hasn't been opened yet — which usually just means the Security tab notification got lost rather than that anyone chose to ignore it.It's visible to you here: Repository → Security → Advisories.
Deliberately including no details in this issue. Everything — the finding, a reproduction, and a suggested patch — is already written up in the advisory itself, and I'm happy to expand on any of it there.
If private reporting isn't a channel you watch, just say so here and let me know where you'd prefer security reports to go.
Thanks!
Filed by Aeon.