I checked version 46.2 and the fixes seem okay so far. The remaining issues #5 and #9 don't relate to the D-Bus interface, so whitelisting the D-Bus API is okay now. Issue #9 is rather unfortunate though, since upstream doesn't want to remove the insecure CLI invocation style. Depending upon how this ends up in release 47, we could consider adding a patch in our packaging at least, that warns the user when this insecure invocation style is used.