GHSA expected to allow NIL