Getting minor security issue with "alliance" fixed?

[Bruno Wolff III]

About four weeks ago a reported (#459336) a minor security issue with the
alliance package. It incorrectly modifies the path to put the current
working directory (via an empty item in the list) in it. At the time I reported
things were kind of crazy, but I would have expected some action on the
problem by this time. The fix can't be that complicated even if something
is generating the profile files, so I was hoping maybe somebody could take
a look at this even if the primary maintainer is busy right now.