sync GLSA from upstream