From dff23c19a24ed1ec7fdbc2c93466af3ca84e8b29 Mon Sep 17 00:00:00 2001 From: Tieg Zaharia Date: Thu, 7 Nov 2024 09:44:10 -0700 Subject: [PATCH 1/2] Clarify sentence about last_affected and fixed in docs. Signed-off-by: Tieg Zaharia --- docs/schema.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/schema.md b/docs/schema.md index 705a59e3..0274cb37 100644 --- a/docs/schema.md +++ b/docs/schema.md @@ -830,8 +830,8 @@ Only **a single type** (either `introduced`, `fixed`, `last_affected`, `limit`) is allowed in each event object. For instance, `{"introduced": "1.0.0", "fixed": "1.0.2"}` is **invalid**. -Entries in the `events` array can contain either `last_affected` or `fixed` -events, but not both. It's **strongly recommended** to use `fixed` instead of +An events array can have entries containing either "last_affected" or "fixed" events, +but not both. It's **strongly recommended** to use `fixed` instead of `last_affected` where possible, as it precisely identifies the version which contains the fix. `last_affected` should be thought of as the hard ceiling of the vulnerability _at the time of publication_ in the absence of a fixed version. From e585216e61efe9825dee3c7bbe15eed5c2667b24 Mon Sep 17 00:00:00 2001 From: Tieg Zaharia Date: Mon, 12 May 2025 01:29:09 -0700 Subject: [PATCH 2/2] Update docs/schema.md Co-authored-by: Andrew Pollock Signed-off-by: Tieg Zaharia --- docs/schema.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/schema.md b/docs/schema.md index 0274cb37..9fac3a08 100644 --- a/docs/schema.md +++ b/docs/schema.md @@ -830,7 +830,7 @@ Only **a single type** (either `introduced`, `fixed`, `last_affected`, `limit`) is allowed in each event object. For instance, `{"introduced": "1.0.0", "fixed": "1.0.2"}` is **invalid**. -An events array can have entries containing either "last_affected" or "fixed" events, +Entries in the `events` array may be "last_affected" or "fixed" events, but not both. It's **strongly recommended** to use `fixed` instead of `last_affected` where possible, as it precisely identifies the version which contains the fix. `last_affected` should be thought of as the hard ceiling