Eeesh. 6 months for a vulnerability patch seems crazy. Is there a reason Google are waiting so long?