[trevormcneal]

The first email looks like someone who had zero idea of what they were doing, just did some dependency scanning and got your name/email there, probably these emails were sent to everything that they could find.

Quite well handled, not arrogant, not bending over and doing whatever they say, but being honest.

If curl is impacted or not, may not really matters for them, usually these companies go after compliance and someone who they can blame when things go wrong.