Both the bug list and the reaction to it are deeply concerning, if you are depending on this project - but I don't know how much real world use this code gets.

Shows that reviewing dependencies is not optional. Hundreds of stars on GitHub is not a helpful data point, even if my own monkey brain says otherwise.