Only the latest published release on Hex.pm receives security fixes. Older versions are not patched — upgrade to the latest release to pick up a fix.
Please do not open a public GitHub issue for security vulnerabilities.
Report privately via GitHub Security Advisories. This opens a private discussion with the maintainer and lets a coordinated fix ship (with credit, if you'd like) before any public disclosure.
Expect an initial response within a few days. If the report is confirmed, a fix will be prepared and released as a new patch version, with the advisory published alongside it.