Sync Collecting Fix Commits: Mon May 18 08:59:44 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,18 @@
 {
   "vcs_url": "https://github.com/github/advisory-database",
   "vulnerabilities": {
+    "GHSA-4CVJ-XF75-4WV6": {
+      "c00ed9760e99ca7d9ed6ce80f0e2480d9c889e5d": "Publish Advisories\n\nGHSA-4cvj-xf75-4wv6\nGHSA-6v92-ph9p-hrpc\nGHSA-jhq7-r7p6-3g3j\nGHSA-qv27-xjwp-hw6f"
+    },
+    "GHSA-6V92-PH9P-HRPC": {
+      "c00ed9760e99ca7d9ed6ce80f0e2480d9c889e5d": "Publish Advisories\n\nGHSA-4cvj-xf75-4wv6\nGHSA-6v92-ph9p-hrpc\nGHSA-jhq7-r7p6-3g3j\nGHSA-qv27-xjwp-hw6f"
+    },
+    "GHSA-JHQ7-R7P6-3G3J": {
+      "c00ed9760e99ca7d9ed6ce80f0e2480d9c889e5d": "Publish Advisories\n\nGHSA-4cvj-xf75-4wv6\nGHSA-6v92-ph9p-hrpc\nGHSA-jhq7-r7p6-3g3j\nGHSA-qv27-xjwp-hw6f"
+    },
+    "GHSA-QV27-XJWP-HW6F": {
+      "c00ed9760e99ca7d9ed6ce80f0e2480d9c889e5d": "Publish Advisories\n\nGHSA-4cvj-xf75-4wv6\nGHSA-6v92-ph9p-hrpc\nGHSA-jhq7-r7p6-3g3j\nGHSA-qv27-xjwp-hw6f"
+    },
     "GHSA-3X4G-259H-5P7C": {
       "4487c4749737815432e7a65877f4144dab81c9cc": "Publish Advisories\n\nGHSA-3x4g-259h-5p7c\nGHSA-4qf2-p32m-7hmf\nGHSA-6h8r-h22r-jj64\nGHSA-72qw-jfp3-cf43\nGHSA-8vqm-j289-7f3g\nGHSA-cc9m-6hq9-85vh\nGHSA-fxvj-wqv2-xgcq\nGHSA-gggg-9f43-93h7\nGHSA-q6qj-wmmg-cc85"
     },

data/fix-commits/gitea-a07cdc31.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/lxml/lxml",
   "vulnerabilities": {
+    "GHSA-4JHM-JV67-739F": {
+      "5927a6d5e851845140975d99b65461e255caaab0": "Add missing \"xlink:href\" to the known HTML link attributes.\nCloses https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f"
+    },
     "CVE-2023-52425": {
       "373ac417fd44b6ef629ef426dc3a3211bd8d10b4": "Fix test_elementtree with Expat 2.6.0 (GH-407)\n\nFeeding the parser by too small chunks defers parsing to prevent\r\nCVE-2023-52425. Future versions of Expat may be more reactive.\r\n\r\nHeavily inspired by https://github.com/python/cpython/commit/4a08e7b3431cd32a0daf22a33421cd3035343dc4\r\n\r\nWe cannot use a @fails_with_expat_2_6_0 decorator\r\nbecause the test passes in ETreePullTestCase.\r\n\r\nSee https://github.com/python/cpython/issues/115133\r\nSee https://github.com/advisories/GHSA-gh68-jm46-84rf\r\nCo-authored-by: Serhiy Storchaka <storchaka@gmail.com>",
       "3ccc7d583e325ceb0ebdf8fc295bbb7fc8cd404d": "Fix test_elementtree with Expat 2.6.0 (GH-407)\n\nFeeding the parser by too small chunks defers parsing to prevent\r\nCVE-2023-52425. Future versions of Expat may be more reactive.\r\n\r\nHeavily inspired by https://github.com/python/cpython/commit/4a08e7b3431cd32a0daf22a33421cd3035343dc4\r\n\r\nWe cannot use a @fails_with_expat_2_6_0 decorator\r\nbecause the test passes in ETreePullTestCase.\r\n\r\nSee https://github.com/python/cpython/issues/115133\r\nSee https://github.com/advisories/GHSA-gh68-jm46-84rf\r\nCo-authored-by: Serhiy Storchaka <storchaka@gmail.com>"

data/fix-commits/lxml-fcbea3fe.json

@@ -1,6 +1,12 @@
 {
   "vcs_url": "https://github.com/apache/superset",
   "vulnerabilities": {
+    "CVE-2026-33036": {
+      "dd523c1a7bb2ac445e29c6bcbf338f026d824124": "fix(deps): patch fast-xml-parser CVE-2026-33036 and CVE-2026-33349 (#40118)"
+    },
+    "CVE-2026-33349": {
+      "dd523c1a7bb2ac445e29c6bcbf338f026d824124": "fix(deps): patch fast-xml-parser CVE-2026-33036 and CVE-2026-33349 (#40118)"
+    },
     "GHSA-36JR-MH4H-2G58": {
       "af3e08823314199a783e3f53899b80cdb47cf321": "build(deps): resolve GHSA-36jr-mh4h-2g58 by upgrading d3-color to 3.1.0 (#37981)\n\nSigned-off-by: hainenber <dotronghai96@gmail.com>"
     },