[sickill]

Releasing takes time or at least effort. It’s not like it happens on it own. It’s work.

[bugglebeetle]

Indeed, the maintainer has commented on this very post that more work than simply tagging a release is involved with fixing, as well as that the CVE impact on their repo is bogus because they’re not actually affected by it.