I'm afraid there's little to be done here. Upstream doesn't want to fix it, so we'll just wait for a volunteer. Or delete the package if deemed too dangerous.