Good news that it was found and fixed, but 140 days response time seems rather slow for such a critical vulnerability