In reply to Trevor.

We will continue to release version 3.0 alongside the 2.9.x codebase. So far, this slow roll out has been invaluable in our development of 3.0. The security mistake has definitely helped us identify weaknesses in our processes and shown us where we can improve testing and auditing of the dual codebase.