[The Alchemist]

I agree. You could release the vulnerability alone or release the vulnerability along with the patch unofficially. Its meaningless to wait for them.

[craig1985]

My honest opinion is that you should release it as long as the patch is there too. It is different on say bug bounties that pay you for finding bugs as the whole "disclosure policy" comes in but with something open source I see no problem in releasing it at all

Just my 2 cents