I also saw that recently. I’d like to highlight this bit from the news:

This update contains behavior changes, all of which stems from the CVE fixes themselves, not exclusive to the version bump.

So it looks like the package is still mostly kept stable despite the exception made.