I just ran #govulncheck on all of #pkgsrc, and there are a lot more vulnerable packages than I thought :(