It seems kind of strange that they don't reference specific commits (and instead just point to master?) in the report. Isn't it standard to analyze like, a specific release?
They do, they mention it in the third paragraph of the introduction.
The only version mentioned in that paragraph is 'version 0.16 or newer' of rustls, which is only one of the packages they looked at, but it doesn't specify any specific releases or commits that were actually looked at.