Report a vulnerability privately through GitHub's form, not in a public issue. Only the latest release on crates.io gets fixes.