the public record of dependency advisories we acted on.
no maintainer-accepted fixes are listed yet.
[ no accepted entries ]
open or closed-unmerged pull requests are not listed.
dependency advisories we acted on upstream, not original discoveries. a fix is listed only after its maintainer accepts it.