Please report a vulnerability privately through GitHub's vulnerability reporting, not in a public issue. We'll reply there.

Only the latest release gets fixes. The commands run locally on your repo, call gh for GitHub data and, in a mixed-language repo, run the other package through uvx or npx; reports about any of these paths are in scope.