Report a vulnerability privately through GitHub's security advisories on this repository, not in a public issue.

Most security fixes here are upstream: a CVE in mpv, FFmpeg, libass, libplacebo, dav1d or Mbed TLS is fixed by bumping the pin in buildscripts/include/depinfo.sh and cutting a release. Say which upstream advisory applies and the fix can be scheduled with it.