Only the latest published version of each package (@metapraxis/jext, @metapraxis/jext-http, @metapraxis/jext-collection) receives security fixes.

Please do not open a public issue. Report it privately through GitHub private vulnerability reporting: describe the problem, the affected package and version, and how to reproduce it.

We answer within a week, agree on a fix and a release date with you, and credit you in the release notes unless you prefer otherwise.