I think only internally is fine as long as the bug will be fixed and released right away and the problem noted in the Changes. Otherwise I'd do both as almut suggested so you don't waste some poor hacker's weekend tracking it down, confirming it, writing a patch, etc.

On a tangent: thank you (and GrandFather and everyone else) so much for working on stuff and encouraging your office to work on stuff which is released to the wild. Companies that do this look good to me and I would patronize them before another were all else roughly equal.