Comment by dgl

I'm not privy to the exact communications that happened, but per the Ubuntu changelog they prepared a patch a week ago[1] (which is about the normal timeline for notification per[2]). Homebrew is not on the distros list, so likely wouldn't have got an early notification. Arch is, but remember "The Arch Security Team is a group of volunteers"[3].

[1]: https://launchpad.net/ubuntu/+source/git/1:2.43.0-1ubuntu7.3

[2]: https://oss-security.openwall.org/wiki/mailing-lists/distros

[3]: https://wiki.archlinux.org/title/Arch_Security_Team