Why are some apps still in the Main repo though they are tagged as “KnownVuln”, have been reported as discontinued, etc?