Security fixes are made on each repository's main branch. For the templates, the fix ships in the next version on NuGet, which is released out of cycle when a fix can't wait for the monthly release.

Please don't report security vulnerabilities through public GitHub issues. Announcing the hole before it's patched helps nobody except the people looking for holes.

Report them privately instead: open the affected repository's Security tab and choose Report a vulnerability. Include as much detail as you can: what's affected, how to reproduce it, and the impact you expect.

You'll get a response within 7 days. Once the issue is confirmed, a fix will be released as soon as possible, and you'll be credited in the advisory unless you'd prefer not to be. Security is the one thing around here that doesn't wait for the 1st of the month.