Improve recipe advisory coverage and report non-CVE fixes

2026-11-02 19:40:46 +00:00
parent 508d6bb0de
commit bd7196bf9e
7 changed files with 238 additions and 42 deletions
@@ -52,6 +52,9 @@ keeps every weekly edition looking the same regardless of which model writes the
       A zero for an up-to-date recipe means there is no upgrade window to credit; it does not
       certify that the running images are free of vulnerabilities. If an upgrade exists but its
       advisory scan is absent, a source failed, or an image window was unmatched, use `?`.
+       If a confirmed security advisory is fixed but has no CVE ID, put `"YES"` in `cve` rather
+       than `0`; describe its advisory ID and severity in Notes. If CVE IDs are also fixed, show
+       the numeric CVE count and mention the additional non-CVE advisories in Notes.
     - **`?` means the count is not verified.** Use it when an upgrade has no scan, a source failed,
       an image window was unmatched, or the scan block says COUNT UNKNOWN. In that case publish
       `?` and say why in