Currently, we update all projects for the current school year. Old, unmaintained projects will not be updated.

Send vulnerability reports via the Advisories tab on the Security page. Generally, Dependabot or CodeQL will have already warned us, but it never hurts.