All of these, presumably. The question is how many issue reports the maintainers of those two projects had to wade through to find those relevant twelve. And whether that took more work than they would have had to expend to find those bugs themselves or not.