Upstream GLib only supports the most recent stable release series, and the current development release series. Any older stable release series are no longer supported, although they may still receive backported security updates in long-term support distributions. Such support is up to the distributions, though.
Under GLib’s versioning scheme, stable release series have an even minor component (for example, 2.66.0, 2.66.1, 2.68.3), and development release series have an odd minor component (2.67.1, 2.69.0).
If you think you've identified a security issue in GLib, GObject or GIO, please do not report the issue publicly via a mailing list, IRC, a public issue on the GitLab issue tracker, a merge request, or any other public venue.
Instead, report a confidential issue in the GitLab issue tracker, with the “This issue is confidential” box checked. Please include as many details as possible, including a minimal reproducible example of the issue, and an idea of how exploitable/severe you think it is.
Do not provide a merge request to fix the issue, as there is currently no way to make confidential merge requests on gitlab.gnome.org. If you have patches which fix the security issue, please attach them to your confidential issue as patch files.
Confidential issues are only visible to the reporter and the GLib maintainers.
As per the GNOME security policy, the next steps are then:
Announcements for security issues with wide applicability or high impact may additionally be made via firstname.lastname@example.org.