Only the last stable version at any given point.

Vulnerabilies can be disclosed in private using GitHub advisories: https://github.com/goreleaser/nfpm/security

Thanks!