We support the past two Go releases (for example, Go 1.11.x and Go 1.12.x).

See https://golang.org/wiki/Go-Release-Cycle and in particular the Release Maintenance part of that page.

See https://golang.org/security for how to report a vulnerability.