For Kosmorrolib, the library that actually makes the calculations, the last patch of the two last minor versions are supported. Therefore, once a new minor version of Kosmorrolib is released, you have some time to upgrade before it comes to End-of-Life.

Currently supported versions of Kosmorrolib are listed at kosmorro.space.

If you find any vulnerability, please don't open an issue directly, and send me an email to jerome+kosmorrolib@deuchnord.fr with the subject: "Vulnerability in Kosmorrolib" to describe the exact nature of the vulnerability. If the vulnerability can be reproduced on my side, then a patch will be made along with a security advisory. If I cannot reproduce the vulnerability, then I will send you an email to ask for more information.

Thank you!