that could still be considered negligent, if it has a CVE and you're using it, you gotta know about it