Recently discovered vulnerabilities in bash and APT are low risk for VyOS, since it doesn’t use CGI scripts written in bash and APT is not normally used for upgrades, but we will release an updated 1.0.x image nonetheless and include the fixes in upcoming 1.1.0 release as well.
1.0.x maintenance release will likely include some backwards-compatible fixes from 1.1.0 too.