Fixing the code is only half of incident response. Without an advisory, affected-version range, and downstream notification, users cannot know whether they remain exposed.
Unfortunately, the Xray author publicly downplayed the severity of the vulnerability and used insulting language toward the vulnerability reporter.