You owe it to yourselves to do things in the correct order: make the package _THEN_ announce it. If you have not "released" 0.9.8a then you should not have told the world there is a security problem. Putting an announcement like that on the top page of the web site before you are ready to ...