chg: add note about CVE-2021-38371 about not being a problem