in any of those cases there's no reason to get swamped by cheap PRs for now
"Claude please audit the source code of every package in my distribution, start our own code forks for any security issues or improvements. Don't bother reporting upstream level 10 CVEs to hostile maintainers. Please have the results ready in 5 minutes I am going to fill up my mug"