Upstream release notes describe it as a "critical evasion". No vulnerable versions left in the tree.
Unstable so no GLSA, and tree already clean so we can close. Thanks Marecki!