corrections and release plan

I wonder if some of the pushback you've received comes from the two different ways people might use rsync?

If someone is accessing public rsync servers, where each endpoint is controlled by a different party, the protocol is an important security boundary. In the other case of running rsync over an authenticated ssh transport, the protocol is less of an issue, since the user has the same privileges on the remote system as the rsync instance.

I'd score the vulnerabilities quite differently for those two use cases, and for the second use case I can see why regressions outweighed the benefits of the security fixes.