The barebox project does not, at the moment, maintain any longer term support branches. Please update to new barebox releases as they become available. Compatibility with old kernels is maintained over barebox releases.
Please report security vulnerabilities to security@barebox.org. We will work with the reporter to create a fix and to coordinate the disclosure.
Refer to the Security Considerations chapter of the documentation for information on how to configure barebox securely.