Maintain all fixed versions on CVE record after upstream git branches are deleted
Open
@sethmlarson is already working on this.
Since May 7, 2026.
- Dominant language
- Python
- Stars
- 48
- Forks
- 14
- Avg merge
- 19h 45m
- Merged PRs (30d)
- 13
Description
CPython deletes branches for versions that are no longer in security fix mode. This leads our automatic CVE record updater to no longer traverse the git commits to discover the fix version for a particular fix commit.
Instead of updating the records automatically in this case we should probably just freeze the record in place so they are no longer updated automatically after some time to avoid this issue.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.