> i believe that upstream would do good if they would change their mind about having or not a well defined vulnerability identification and notification system

> i believe that upstream would do good if they would change their mind about having or not a well defined vulnerability identification and notification system. No. Unless an issue is tested against HEAD, reporting it is just noise. Reporting a fixed issue is a faux pas one has to pay for: Listening to snarky comments from friends and co-workers, or in this case, because they should know better, a few kegs of beer for the next FOSS event...