> In the case of SMF, the same vulnerabilities were present in the production versions.

I'm just curious which production version you are talking about now since 2.1.X has 0 of those?

It doesn't really impact me one way or the other, so feel free to ignore me if you prefer. Its just odd.

The vulnerability is also present in the v2.0.x branch.

The development 2.1.x branch (which is what was on Github) had the vulnerability, and that's where I reported it, but it's not only in the new code.

I think maybe you're confused somewhere?