2.17 was released in Aug 2022. Here's the changes file: https://httpd.apache.org/apreq/docs/libapreq2/apreq_changes....

Here's the bugtraq event about it: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1018191

Does any of this make sense to you? Nobody who looks in the changes file has any idea the last three releases involved CVE issues. Not only are they purposefully obscured, the release itself contains undocumented bogus parser changes that were papered over during candidate voting.