We told them as soon as we found out, because we needed them to go looking for the same hole in all of our code bases :-)

As part of the audit, ^Lift audited a lot of the third-party modules we use, and notified the authors of those packages separately (I'm not aware of the details, but I don't think there was anything major).