TreeUI is pre-1.0 and fixes land on the latest release only. Supported versions are the most recent minor of each published package: @treeui/tokens, @treeui/utils, @treeui/icons, @treeui/vue, @treeui/react, and @treeui/mcp. Older minors receive no backports.

Report privately through GitHub Security Advisories: https://github.com/Viserion77/treeui/security/advisories/new

If that form is unavailable, email jeferson.a.oficial@gmail.com instead. Please do not open a public issue for a suspected vulnerability.

Include the affected package and version, a reproduction or proof of concept, and the impact you observed. You can expect an acknowledgement within a few days; the advisory is published together with the fix, and reporters are credited unless they ask otherwise.