The security fixes from SA-CONTRIB-2025-047 → were not applied to 2.x, meaning it's still vulnerable. The branch is in use and is the main target for new issues, so it should either be marked unsupported, or be patched.
Active
2.0
Code
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.
See the comparison between 1.x and 2.x:
https://git.drupalcode.org/project/restrict_route_by_ip/-/compare/2.0.x....
Never mind. I was wrong and missed that the CSRF fixes were applied, but none of the other commits were applied. The issue is fixed in 2.x