It would be nice if Github could be talked to about their preference for strong wording, especially since there is a known left goal post associated with the poluted version of debug...

Instead, their post reads:

Patched Versions: None
Affected versions: All?
Remediation steps, blanket rotate all creds in all things with dependencies on debug?

<sigh> come on folks...

https://github.com/advisories/GHSA-8mgj-vmr8-frr6