@mort @Foxboron You can keep saying no all you want; it doesn’t make it any more true. CVEs have basically never been an accurate representation of changes that have security impact. Actually trying to do this remains an open problem that requires significant resources.