Fixes land in the next release only — there are no backported patches for older versions. Please always update to the latest stable release (or try the prerelease) before reporting a security issue.

Please do not open a public issue for security problems.

Report vulnerabilities privately via GitHub's Private Vulnerability Reporting: open the repository's Security tab and click "Report a vulnerability" to start a private advisory that only the maintainer can see.

RouteConverter is maintained by a single maintainer as a spare-time project. Reports are handled on a best-effort basis — typically within a week — but there's no guaranteed response time.