I think it's been single-digit months since the last UTF-8 parsing vulnerability.