CGA-r7p5-p42g-h7rf

The vulnerable code comes from an indirect dependency and is not in the code execution path. This is raised by upstream, who concluded they are unaffected here, and was confirmed independently.