This repository lives on the current, released version.
If you look at a more long term perspective, the recent versions regularly become part of Apache httpd and are supported via that release line.
Security relevant reports are best made to security@httpd.apache.org