Personally, I'd do an interim minor release 4.0.8, as it's fairly serious to be installing Pythons on users' machines with ACE vulns and swapping out the Python version should be pretty trivial.
Personally, I'd do an interim minor release 4.0.8, as it's fairly serious to be installing Pythons on users' machines with ACE vulns and swapping out the Python version should be pretty trivial.