The Charmed MLflow project releases with a cadence of ~6 months, supports two minor versions of MLflow, and keeps up to date with the latest upstream version. Whenever a new version of Charmed MLflow is released, the oldest version is dropped from support.
To report a security issue, file a Private Security Report with a description of the issue, the steps you took that led you to the issue, affected versions, and, if known, mitigations for the issue. The Ubuntu Security disclosure and embargo policy contains more information about what you can expect when you contact us and what we expect from you.