This seems like it is the second time we have had to learn about the importance of maintain large open source infrastructure projects like this. log4j and openSSL before it, show that these projects aren't just the responsibility of the maintainers, but all of their users as well. We really need more money being paid by larger users like Google directly to the maintainers.