The only version of this library that receives regular patches, or updated dependencies is the latest semver major version (3.x). This is free open source software I build in my spare time, so no promises on, well, you know, anything.
To report a vulnerability, please email me: [email protected].