fix(trust): correct the advisory count on the Trust page - #1712
Merged
Conversation
The Trust page said the 4.14.8, 4.18.3 and 4.21.0 releases "fixed and disclosed 32 vulnerabilities between them". Read strictly that is 34: CVE-2026-40047 shipped in 4.18.3, and CVE-2026-40859 in 4.14.8 and 4.18.3, but both had their main-line fix in an earlier minor so neither is counted in the 4.21.0 batch. 32 is exactly the number of advisories fixed in 4.21.0, so the sentence did not say what it computed. Anchor the figure to the single release it describes, and add the fact that the two LTS lines got the backports within four days (4.21.0 on 1 July, 4.18.3 on 3 July, 4.14.8 on 4 July), which is the stronger claim and was already true. The "26 of those 32 fixes were carried back to the 4.14.x LTS line" sentence further down is correct as written and is left alone. Also drops the em-dash from the sentence being edited. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Trust page currently says:
Read strictly, those three releases fixed 34. Two findings shipped in the named releases but had their main-line fix in an earlier minor, so neither is part of the 4.21.0 batch:
fixed:32 is exactly the number of advisories fixed in 4.21.0. The sentence under-counts rather than overstating, so nothing on the page was inflated, but it does not say what it computes.
The fix
Anchors the figure to the single release it actually describes, and adds the backport timing, which is the stronger claim and was already true:
The "26 of those 32 fixes were carried all the way back to the 4.14.x LTS line" sentence further down is correct as written and is untouched.
Verified against
content/security/: 32 advisories carry4.21.0infixed:, 26 of those also carry4.14.8, and release dates come from theRELEASE-*announcement posts.Related
Companion to #1711, which adds a blog post covering the same batch in detail. The two are independent and can merge in either order.
🤖 Generated with Claude Code