The PR is originally from 2021 and has been merged back then, but there's more recent discussion on it about whether this introduces a vulnerability.