16168 2026-02-10 17:39:15 +0000 SPDX generation should include patch-fixed-CVE annotations 2026-05-14 14:54:39 +0000 1 1 7 Build System, Metadata & Runtime OE-Core deployment 5.3 x86 Multiple RESOLVED FIXED Medium enhancement 6.0 1 ross.burton JPEWhacker randy.macleod yoann.congal --- --- No (bug/feature does not impact docs) oldest_to_newest 104219 0 ross.burton 2026-02-10 17:39:15 +0000 The SPDXv3 output doesn't include useful metadata like "this CVE was fixed by these patches". This is included in the vex output: "issue": [ { "id": "CVE-2022-28391", "status": "Patched", "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-28391", "detail": "fix-file-included", "patch-file": [ "/home/rosbur01/Yocto/openembedded-core/meta/recipes-core/busybox/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch", "/home/rosbur01/Yocto/openembedded-core/meta/recipes-core/busybox/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch" ] }, It would be good to not need the vex class, and to have this information in the SPDX. Concrete use-case being sbom-cve-tool ideally wants both the SPDX and VEX for this data. 105434 1 JPEWhacker 2026-05-14 14:54:39 +0000 Fixed in 9e85daf516 ("spdx30: Include patch file information in VEX")