Only latest major version will be supported with security fixes.

Please get in touch with one of the maintainers through e-mail. Do not open up a pull request to avoid publishing the vulnerability before it is patched.