As ReSpec is generally delivered via a script tag, we only support patching the latest version of ReSpec.

Generally, for low impact vulnerabilities, it's ok to simply file a bug.

For high-priority things, email marcos at marcosc.com.