@DavidSherret on Backlist

Handling the same security report: pnpm vs. Bun

The same package-manager security issue got fast advisory/backports from pnpm and silent fixes from Bun, illustrating how disclosure process matters as much as the patch