This is one of those cases where security by obscurity isn’t doing anyone any favors. Removing shortcode functionality should have been communicated much better than a vague bullet point in the release post. Even without disclosing the actual issue, it wouldn’t have been much effort to add an extra paragraph to the main post content calling this out, and the fact nobody thought this change warranted some form of highlight or dev note or whatever is rather concerning to say the least.