Jens-G commented on PR #3220: URL: https://github.com/apache/thrift/pull/3220#issuecomment-4375557368
The commits are not marked primarily for the technical reason that it would break git history. Also, binding a CVE to single commit ids is not always possible. Finally, there are opinions on both end of the spectrum why this is a great or a bad idea (pick your side) at all. The CVE you mentioned is fixed in 0.23.0 and master. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
