There has been a new upstream maintainer since the deprecation notice was added. It will take some time for said new maintainer to get up to speed with the codebase and test any incoming patches. The software is still generally considered vulnerable as of this commit. PR: 289213