Conversation
|
Hi there @kyamagu! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The corrected range matches the advisory, fix release, and upstream package advisory.
Review effort: Balanced
Findings: None
What changed in this PR
Corrects the psd-tools advisory to include vulnerable version 1.9.3.
Changes:
- Changes the affected range to
<= 1.9.3. - Removes the CVSS v3 score while retaining CVSS v4.
- Synchronizes the modification timestamp.
| File | Description |
|---|---|
GHSA-22jr-vc7j-g762.json |
Updates vulnerability range and advisory metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updates
Comments
The vulnerable range should end at <= 1.9.3, not < 1.9.3.
The advisory text says "before 1.9.4" and "Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4". The repository advisory also has the range >=1.8.37,<=1.9.3: GHSA-22jr-vc7j-g762
The fix commit linked in the advisory, psd-tools/psd-tools@fd51f8b, is the commit of tag v1.9.4, and tag v1.9.3 does not contain it.
So version 1.9.3 is still vulnerable but is outside the current range.