Only the latest release on PyPI gets fixes.

Report vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue. Bugs in libsamplerate or pybind11 themselves belong upstream; tell us too so we can update the vendored copy.