Hacker News Reader

Posting the CVE and then the patch is the reverse of this.

By "patch" I am talking about the public commit. Updated binaries were made available when the CVE was published.

That's not what the blog post implies given they only told people how to update aftwards.