Curl summer of bliss (curl will not process security vulnerabilities in July)

Long term health of the project is more important, and the devs definitely deserve a vacation. If you can’t take the risk, stop using curl until August release patches the holes. Or the very least, offer them a lucrative support contract that makes it worth their while to pause that vacation.