We are following Calendar Versioning with generous backwards-compatibility guarantees. Therefore we only support the latest version.
Put simply, you shouldn't ever be afraid to upgrade as long as you're only using our public APIs.
Whenever there is a need to break compatibility, it is announced in the changelog, and raises a DeprecationWarning for a year (if possible) before it's finally really broken.
You can't rely on the default settings and the structlog.dev module, though.
They may be adjusted in the future to provide a better experience when starting to use structlog.
So please make sure to always properly configure your applications.
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.