Please open a private security advisory rather than a public issue, and allow a reasonable window before disclosure.

The default branch is supported. Older tags are not patched unless the issue is severe and the fix is small.