Here is an official statement: https://gpg4win.org/statement-efail.html

(I am not involved, since it's for GPG4Win.)

GnuPG does regular release, but no "security" release for this.

For GnuPG proper (for OpenPGP), here is the ticket: https://dev.gnupg.org/T3981