Unfortunately we have a security regression in 1.5.0 - public in
https://github.com/linux-pam/linux-pam/pull/298
and
https://github.com/linux-pam/linux-pam/pull/300
Should we obtain CVE id for that and release 1.5.1 asap? The severity is low/medium as the issue affects only systems where the root account already has blank password but the root login can be blocked by other means in theory so I do not think we can dismiss it as a security issue fully.