Running regression tests I assume; they can't just YOLO shit like most OSS projects for the exact reason you mention.
It could be that it is more YOLO not patching this ASAP. Maybe better to risk some regressions.
For a month?
It could be that it is more YOLO not patching this ASAP. Maybe better to risk some regressions.