Why don't CI services upgrade to Maven 3.0.5?

Do they just wait for someone to exploit the vulnerability?