Really commendable work fixing up the upstream python project. I don't think there's anything to be embarrassed about in the timeline.

I would prefer to do a super proper disclosure with coordinated release dates and everything. My first submitting to SourceHut security ML ended up making the vuln existence somewhat public before upstream ever knew.