The supported version is the latest release of the newest major line, v1 once v1.0.0 is tagged; until the first tag exists, the tip of the default branch. Fixes land on the default branch and ship as the next release; there are no maintenance branches for older releases. Version numbers of the upstream project, ulikunitz/xz (v0.5.x), say nothing about this repository.

You can privately report a vulnerability following this procedure. Alternatively you can create a Github issue at https://github.com/forkcloser/xz/issues.

In both cases expect a response within 7 days.

All security advisories for this project are published under github.com/forkcloser/xz/security/advisories.