Please stabilize.
Actually, this version is vulnerable. We may stabilize a fixed version if somebody actually bumps it (or rather, merges the bump PR).
Ye stupid bot.