Conversation
|
Hi there @patriksimek! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The updated range accurately includes 3.10.5 while identifying 3.11.0 as fixed.
Review effort: Balanced
Findings: None
What changed in this PR
Corrects the vm2 advisory so vulnerable version 3.10.5 is included in the affected range.
Changes:
- Removes the stale
<= 3.10.4affected-version limit. - Retains
3.11.0as the first fixed release. - Updates the modification timestamp.
| File | Description |
|---|---|
advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json |
Corrects affected-version metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updates
Comments
The range should end at < 3.11.0, not <= 3.10.4. Version 3.10.5 came out after 3.10.4 and does not have the fix.
The fix for this advisory is in 3.11.0, see patriksimek/vm2@119fd0a. Tag v3.11.0 contains it and tag v3.10.5 does not.
So version 3.10.5 is still vulnerable but is outside the current range.