Most of the maintenance I end up doing is security fixes in stb_image. These take a comically long time (often these stay open for more than 6 months).
I don't know what to say other than that stb_image has always had a note up top, which currently reads " Primarily of interest to game developers and other people who can avoid problematic images".
stb_image was _always_ meant for indie games and throwaway tools where you're in full control of the data.