Proofread CVE fix versions in vdr.xml
#7
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vy
reviewed
Jan 28, 2025
Member
vy
left a comment
vy
left a comment
There was a problem hiding this comment.
What is the purpose of latest.xml, easy diff'ing?
Contributor
Author
Exactly, the way we currently do it (new document at each update), you need to checkout the commit to see the differences. |
Member
|
@ppkarwasz, since version 2 was incorrectly bumped, can we override |
- Removed URL references related to the abandoned [BOM Exchange API proposal](https://github.com/CycloneDX/transparency-exchange-api/tree/bomexchangeapi), which was never accepted. - Our SBOMs have always only referenced `/cyclonedx/vdr.xml`, so these links were unused and unnecessary. This cleanup simplifies the website structure and ensures we can take fuller advantage of version control.
- Restores version 1 of the VDR as `vdr.xml`, reverting the complex structure introduced in commit 620e96c. - This commit can be tagged as `vdr-1` for reference.
- Restores version 2 of the VDR as `vdr.xml`, making it easier to compare changes against version 1. - This commit can be tagged as `vdr-2` for future reference.
- Updated `vdr.xml` to align with the proofread versioning details from PR #7. - Introduced a `<metadata>` element to record contact information for the Apache Logging Services PMC and Security Team, as well as the timestamp of the last modification. - Refreshed the `<updated>` timestamps in all modified `<vulnerability>` entries. - Added inline comment with instructions on how to properly update and maintain the VDR file.
ppkarwasz
force-pushed
the
doc/cyclonedx-vulnerability
branch
from
e0c49f7 to
5296e96
Compare
Contributor
Author
|
Hi @vy, I rebased this PR on top of the changes from #12, which simplified the VDR structure by removing the obsolete BOM Exchange API directory. That should make verification easier: you only need to review commit 5296e96. On versioning: I think we should release version |
vy
approved these changes
Aug 18, 2025
Update the contact information based on review feedback.
ppkarwasz
added a commit
that referenced
this pull request
Aug 22, 2025
* feat: proofread CVE fix versions in `vdr.xml` - Updated `vdr.xml` to align with the proofread versioning details from PR #7. - Introduced a `<metadata>` element to record contact information for the Apache Logging Services PMC and Security Team, as well as the timestamp of the last modification. - Refreshed the `<updated>` timestamps in all modified `<vulnerability>` entries. - Added inline comment with instructions on how to properly update and maintain the VDR file. * fix: restore original update date for CVE-2021-45105 * fix: update contact information Update the contact information based on review feedback.
ppkarwasz
added a commit
that referenced
this pull request
Aug 22, 2025
* feat: proofread CVE fix versions in `vdr.xml` - Updated `vdr.xml` to align with the proofread versioning details from PR #7. - Introduced a `<metadata>` element to record contact information for the Apache Logging Services PMC and Security Team, as well as the timestamp of the last modification. - Refreshed the `<updated>` timestamps in all modified `<vulnerability>` entries. - Added inline comment with instructions on how to properly update and maintain the VDR file. * fix: restore original update date for CVE-2021-45105 * fix: update contact information Update the contact information based on review feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is the
vdr.xmlequivalent of the changes introduced in #6. Therefore, it requires #6 to be merged first.