John here - thanks for the kind words on my piece. You can also find it here (without the substack subscription stuff): https://johncodes.com/posts/there-is-no-secure-software-supp...

There was some good discussion on the /r/programming subreddit: https://www.reddit.com/r/programming/comments/zyf9rb/there_i...

I would love to continue the conversation: I think it's a really important topic in the world of increasingly deep dependencies. I too hadn't heard of the Gorilla maintainers reaching out for new contributors or sun-setting the project until after the fact.