I believe the timeline is: Nov 24 - Wednesday - Report of issue Nov 25 - Thursday - Thanksgiving Nov 29 - Monday - Work done Nov 30 - Tuesd

I believe the timeline is: Nov 24 - Wednesday - Report of issue Nov 25 - Thursday - Thanksgiving Nov 29 - Monday - Work done Nov 30 - Tuesday - PR submitted (review as if nothing special) Dec 9 - Thursday - "Is it a security vulnerability?" Dec 10 - Friday - All hell breaks loose (Log4j 2.15.0 released) Dec 13 - Monday - Java devs updating libraries furiously (Log4j 2.16.0 released) Dec 18 - Saturday - Wait? there's more (Log4j 2.17.0 released) ... Dec 27 - Monday - Enough already (Log4j 2.17.1 released)