Tags listed in build.yaml in each image directory are supported and receive upstream security updates.

You can report a vulnerability privately via private vulnerability reporting on GitHub. See GitHub Docs for more information.