Only the latest release line of the @amqp-contract/* packages receives security fixes.

Please do not open a public issue. Report it privately through GitHub private vulnerability reporting.

Include the affected package and version, a description of the impact, and steps to reproduce. You can expect an acknowledgement within a few days. Fixes ship as a patch release with a GitHub Security Advisory crediting the reporter unless you ask otherwise.

Packages are published from CI only, via npm Trusted Publishing, with provenance. Verify with npm audit signatures.