Is this an undisclosed vulnerability? Are you the discoverer? If so, then the pull request reference is appropriate because that represents the first public disclosure. Otherwise, an OSVDB or BID or CVE reference is more appropriate.

Dropping 0day on Metasploit's pull queue is unusual which is why @jvazquez-r7 was asking, I'm sure.