> If nobody responds in a week, it can safely be assumed that they don't take security seriously, and the responsible thing is to let the community know.

That's an if that did not happen:

> Eelco is working on it, there's a patch on the GitHub advisory, we plan to get it out on Monday, but no promises yet if everything will get done by then

https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKs...