You don't have to contact them, but you absolutely should make sure that vulnerabilities are being patched. It's your responsibility to your users.