NSGo has no release yet, so fixes land on main.

Report a vulnerability privately through GitHub's advisory form, never in a public issue. Include what it affects, the platforms, and how to reproduce it.