Maintain all fixed versions on CVE record after upstream git branches are deleted

Open
  • Is something wrong?
#121 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@sethmlarson is already working on this.

Since May 7, 2026.

Assessment

This issue has not been assessed yet.

Description

CPython deletes branches for versions that are no longer in security fix mode. This leads our automatic CVE record updater to no longer traverse the git commits to discover the fix version for a particular fix commit.

Instead of updating the records automatically in this case we should probably just freeze the record in place so they are no longer updated automatically after some time to avoid this issue.

Dominant language
Python
Stars
49
Forks
14
Avg merge
4h 44m
Merged PRs (30d)
15

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from psf/advisory-database

All issues in psf/advisory-database

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.