The way I understand it the reencryption process now requires additional digest of reencryption metadata. This digest cannot be calculated without knowledge of

The way I understand it the reencryption process now requires additional digest of reencryption metadata. This digest cannot be calculated without knowledge of the passphrase. This means that the attacker can still modify the metadata but cryptsetup will scream loudly when you try to open the device because the digest will be incorrect/missing. So yes, updating the package should be all that's required.