`SECURITY.md` / README inventory the vendored msgpack-c pin (`c-7.0.2`). That is not a severity-based patch SLA for msgpack-c or compile-in NAN. Document a risk-based bump window (e.g. critical native advisories within N days).
SECURITY.md/ README inventory the vendored msgpack-c pin (c-7.0.2). That is not a severity-based patch SLA for msgpack-c or compile-in NAN.Document a risk-based bump window (e.g. critical native advisories within N days).