Close call, nevertheless, it's silly to keep that commit on the release page.
It definitely doesn't inspire confidence in the project taking security seriously.
(Also the "write-up" is almost surely a "Claude-up", though it appears generated by someone external to the project).