Email primary maintainer about vulnerability and version. Expected reply and triage within 1 week depending on other conditions.