Fixes land on main, which ships as the latest pre-release, and in the next tagged release. Update to the latest release to receive them.

Report it privately through GitHub: Report a vulnerability. A private report lets the fix ship before the details are public. A maintainer answers in the advisory, and the fix and the advisory are published together.

What a device trusts, what guards it, and how to secure an installation: Security.