Given that this is a security feature and we hence want it in quickly, I'd consider that patch enough to xfail/disable the remaining issues in pandas, but discussions with upstream are ongoing. (It also won't do anything about the pytables breakage, known upstream as #1044.)