Hmm. If this is a security issue that matters, would you not be expected to migrate?

Not talking about archived code, but active projects that pre-date git 3.0