The current version is always the one being supported for security and bugfixes. Changes to older versions will not happen, due to time restrictions.
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.