Security fixes go into the latest release.
Please report vulnerabilities privately, not in a public issue. Open the repository's Security tab and choose "Report a vulnerability" to start a private advisory.
Include the affected version, a description of the problem, and steps to reproduce it if you have them. Once a fix is released, it is published together with a security advisory.