There's a thing I don't understand. I found a project on Github. Looking at the list of commits, you can see stuff like "fixed XSS in file whatever, etc". But that commit is part of a long list of commits that were made after the latest public release. So that vulnerability is basically public (everyone can look it up in Github), and the patch has not been released (it will be included in the next public release). To me, that in practice sounds like a zero-day vulnerability is available, even though in theory I guess "day zero" has already passed.
So how should you manage code in Github without leaking info about vulnerabilities that way? Is there a best practice, or a common accepted way to mitigate this problem?