I appreciate open source maintainers and understand that it's a lot of thankless work, and I know what I'm about to say comes off as (and probably is) ignorant but the hoops projects make me jump through to report hugs or security issues is often like working for corporate in terms of bureaucracy and a lot of times I just don't bother. I've reported a few dozen bugs so I'm not prolific here but also not speaking without any experience at all. And then you often have automation (eg. Debian) closing bugs because nobody looked at it and saying to reopen it if it's still a problem in the current release.

Like I said, I do understand and appreciate how annoying it must be. But there are two ways to look at this, one is that it's free software a bug report is like a support request - and of course nobody should expect free support. The other way to look at it is that by reporting bugs I'm volunteering as QA for the project and the report is beneficial.

I sometimes add a PR with the fix for a bug report I make, but the last few have been ignored in favor of the maintainer's own code. So I think I'll stop doing PRs and just point to code lines instead.