After seeing the new BIND vulnerabilities, I curious to know if
there is a reason our in-tree version is 8 and hasn't been upgraded
to 9.

Are we still waiting for all the bugs to be shook out of the new
BIND codebase?  Is there some other upgrade problem or difficulty?
Or is it just lack of volunteer time/effort?

Jon