[samantohermes]

> Actually, I did check after posting, and they appear to do the bare minimum--port the posted CVEs, which won't even account for all the security bugs

If you actually read the release notes, you wouldn't say this.