Just to expand on @aboodman and @aarya's responses, for any third-party dependencies we don't disclose the details of the vulnerability until we're reasonably c

Just to expand on @aboodman and @aarya's responses, for any third-party dependencies we don't disclose the details of the vulnerability until we're reasonably certain all affected parties have had time to deploy a fix.