This is a good effort, and I hope it gets attention from the right people. (Although if the dependents aren't monitoring for CVEs, I don't know what else will help.)