It was in the uploaded tar.gz file to the releases page. The vulnerable code bypassed code review, at least for those distros that trusted the human made source snapshots more than git which was a poor choice.