> And, of course, there is no requirement on end-users to run software from projects which do not consider untrusted-input-validation bugs to be high priority.

> And, of course, there is no requirement on end-users to run software from projects which do not consider untrusted-input-validation bugs to be high priority. What's this even saying? Then they're free to fork it and never use the upstream again.