Merging the upstream creates a more complicated commit tree and still requires fixing merge conflicts. Manually making code changes in the forks "works," but that's duplicating effort.

A severe vulnerability has been patched in Git software source code to prevent remote code execution attacks being launched at users. The bug, which is industry-wide, was disclosed on Tuesday.