4 ms·
In addition to the other answers to your comment pointing out that the way you wrote (b) is very unfair; I'd like to point out that (a) assumes that the develop
by progval 6y ago
In addition to the other answers to your comment pointing out that the way you wrote (b) is very unfair; I'd like to point out that (a) assumes that the developer of the application is aware of the security update of their dependency and pushes a fix quickly.