It is probably not very hard to add the check for CVE if the release has been published due to CVE.
LLM can scan a codebase and find bugs and we submit PRs automatically and PRs are reviewed automatically via LLM. And we can’t ask LLM to check whether there is no CVE fix on the release. One of the two is probably incorrect. 2026년 11월 9일 (월) 오전 1:46, Dongjoon Hyun via dev <[email protected]>님이 작성: > -1 for Jungtaek's additional suggestion because we voted to allow PMC to > upgrade security-related dependency changes under the same rule. > > https://lists.apache.org/thread/cqbxzvtyvpgfy8nqodjpo2ochfw01lzk > [VOTE] Set a buffer time before we upgrade to the latest version of > dependencies > > The following is the original vote content. > > > The proposal is: > > For the apache/spark repo only, we can only upgrade third-party > > dependencies (including Apache projects) to a version released at least > > seven days ago. This covers Java, Python and all other dependencies. > > Security upgrades are exempted and will be conducted by PMCs. > > AFAIK, the agent has been already helping us in the above context > and Jungtaek's additional suggestion is only to ban > the legit Apache Spark PMC security activities. > > Dongjoopn. > > --------------------------------------------------------------------- > To unsubscribe e-mail: [email protected] > >
