With not enough time to develop an alternative and too many application ecosystems relying on this library, I think it's a matter of time before a large company

With not enough time to develop an alternative and too many application ecosystems relying on this library, I think it's a matter of time before a large company forks the library to fix security issues with it now that they have no choice but to do the work themselves. At least until IBM and Google figure out a way to move away from this library.