> So what if ffmpeg has open CVEs? Part of the issue is that FFmpeg is almost a meta-project. It contains so many possible optional dependencies. Which is grea

> So what if ffmpeg has open CVEs? Part of the issue is that FFmpeg is almost a meta-project. It contains so many possible optional dependencies. Which is great for features, nit so great if you quickly want to know if you're exposed to the latest CVE.