Release review of the announced-fixes piece, its short form and figure, and the record behind them

Findings

This is the release gate for articles/fixes-that-said-so.md, its figure, its short form and the record studies/LH009/. The reviewer read AGENTS.md and R-0008, then the record, its brief and sources and the tables in data/, then the piece, the short form and the figure's text sentence by sentence against the record. It went to the primary sources as the dispatch asked: seven fixed releases' changelog entries were re-read at their tags from fresh clones (pyjwt 2.13.0, gitpython 3.1.47, urllib3 2.7.0, mako 1.3.11, starlette 1.1.0, python-multipart 0.0.27, cryptography 48.0.1), with the tag's type, the tag's commit time and the annotation, and gitpython's 3.1.48, 3.1.49 and 3.1.50 entries beside them for the judgement calls; 14 releases' first upload times and descriptions were read from PyPI and 18 advisory records from OSV; twelve moves in eleven dependents' repositories were re-read with a detector the reviewer wrote without reading collect.py's; every rate in data/hazard_by_class.csv, every share and count in summary_by_class.csv and by_authorship.csv, the leave-one-out rates, the event gap medians and the distinct-repository counts were recomputed from lags.csv, fix_classes.csv, fix_texts.csv and screen.csv with the reviewer's own short Python; and the figure was regenerated from its script and compared byte for byte.

The verdict is that the piece, the short form and the figure can be released after the changes below, which the reviewer made. Every source reading that was repeated reproduced: the seven entries' words and their absence of security words where the table says none, the tag commit times to the second, the 14 upload times to the microsecond, the 18 advisory publication times, severities, NVD dates and ranges, and all twelve moves (snapshot commit, first moving commit, committer and author time, authorship, merge, message). Every rate and count in the tables reproduced. What had to change was two counts in the record's prose that its own table contradicted (18 announced and 19 silent, where the table and the piece have 19 and 18; "164 packages in 155 repositories", where 155 is pairs and the repositories are 136), one loose phrase in the piece ("only days earlier" for a gap of a week), and the colophons' review lines. None changes the Answer's shape: the same share of moves before the advisory in both classes, about 1.7 times the pace from release to advisory for announced fixes, the difference sitting in days two to seven and in people's changes, on 13 moves against 5, in a design where class and library cannot be separated.

The record against the primary sources

The piece, sentence by sentence, against the record

The short form's every figure (37, 19, 18, eleven, 257, fourteen, seven, 28 against 25, 1.7, 13 against 5, 9 of the 13, 46, one) is in the table above. The figure's text carries the same twelve rates and counts and the same footer counts.

The writer's points, and what else was found

1. Must fix, fixed. The class counts in the record's prose. The Answer and Findings said 18 announced and 19 silent, 15 by a security word with 14 in the changelog at the tag, and "eleven of the 18"; brief.md amendments 1 and 2 said the same. data/fix_classes.csv has 19 and 18 (16 by a security word, all in the changelog at the tag; 3 by the flaw named), the Findings' own by-library sentence adds to 19, and the seven entries re-read at their tags agree with the table row by row. The piece and the short form already said 19 and 18. The record's two sentences and the brief's two amendments now carry the table's counts, the brief's with a bracketed dated note, and the record's Corrections entry says what changed.

2. Must fix, fixed. "164 packages in 155 repositories were kept." screen.csv's 164 kept packages sit in 136 distinct repositories; 155 is the number of repository and event pairs after a repository is counted once per frame (lags.csv's 155 LH009 rows, 136 distinct repositories). With LH008's 102 pairs from 88 repositories that gives the 257 pairs from 204 repositories the record and piece state, which reproduce. The sentence now says packages, pairs and distinct repositories separately.

3. Should fix, fixed. "Only days earlier." The piece said msgpack's and langchain's releases before the fix "had come out only days earlier"; langchain's came 1.8 days before, msgpack's 7.5. It now says "a week or less earlier". The record's "days before the fix" for aiohttp (2.25 days) stands.

4. Note. Kept. The judgement calls. mako 1.3.11's entry names the flaw in the terms amendment 1 sets (a bypass of the directory traversal check, arbitrary file reads) with no security word, so "announced (flaw named)" is as the rule says, and the strict class without it is tabulated and reproduces. starlette 1.1.0, python-multipart 0.0.27 and cryptography 48.0.1 name a change and no harm, so "silent, near" is as the rule says, and the record's and piece's "a reader who knew where to look could have guessed" is a fair reading of what the reviewer saw in the files. soupsieve 2.8.4's entry was not re-read from a clone; its quoted words are in fix_texts.csv. gitpython 3.1.48's "untrusted input" is the nearest call among the non-events and is not an event.

5. Note. Kept. The measure. The at-risk rule as the record states it in one sentence reproduces every one of the 60 rate rows exactly, so the scripts do what the record says. The share before the advisory (29 of 105 against 17 of 68) and the day-two-to-seven rates (13 on 403.5 days against 5 on 344.8) are as stated; the "three of the 13 in one organisation within 46 minutes" is codeforlife-package-python, codeforlife-portal and rapid-router, two of them re-read from fresh clones.

6. Note. Kept. The piece states the finding no more strongly than the record. The title and opening say the pace was faster and the share was not, and the opening's last sentence gives the confound; "class is library" has its own section with the leave-one-out figures; "13 against 5" and "no test of significance" are in the piece; "silent in what we could read" and the 403s are stated where the classes are introduced and again in the short form; "a move is a request" and "nothing here says that any project was exposed" are in the limits section; the interpretation is marked "we think" and given its dull alternative. No project is named as exposed in any of the files; the dependents are named only in the record's tables and in this note where a reader would need to check a row.

7. Note. Kept. House style. No em or en dash in the piece, short form, figure, record, brief, study sources or the scripts (checked by code point; the only non-ASCII character in the reader files is the middle dot of the bylines and the figure's labels). British spellings; "program" for a bot's software is kept, as in R-0008. No study number, note number, issue or role in the piece's or short form's prose; the colophons name the models and link the records as the earlier pieces do. Every relative link resolves. No invented figure was found: every number in the piece, the short form and the figure traces to a table.

8. Note. Kept. The header and sources. sources.md's 844 rows, the read windows, the 72 refused release pages, the 195 dependents cloned and 27 refused, and the 16 library clones agree with read_log.csv and read_summary.csv. The record's header cited "brief.md (with one amendment)" where there are two; it now says two amendments and the correction.

What the review could not check

• The other 30 fixed releases' entries, tags and descriptions: the study's tables, taken as published; the seven re-read agreed in every field, and the counts over all 37 were recomputed from the tables.
• The other 161 moves and non-moves, and the LH008 rows other than hermes-agent's: the tables as published, the LH008 rows as reviewed in R-0008; the twelve re-read agreed in every field.
• The 332 screening reads and Open Source Insights' lists: not repeated; the counts were recomputed from frame_counts.csv and screen.csv.
• Whether the brief was written before any note was read: read_log.csv's first request is at 08:43:31 and the brief says "about 08:45"; consistent, not provable.
• pillow 12.2.0's headings gaining CVE numbers after the release, and litellm's release-notes page for three weeks: stated from fix_classes.csv and fix_texts.csv, not re-read.
• GitHub's release pages, pull requests and advisory pages: refused to the study and not asked for by the review.
• The scripts' code beyond draw_piece_figure.py, which was run: not read line by line; the reviewer's independent recomputation matched every table it produces, which is the check that matters.
• The figure was regenerated and its text read, not rendered.
• The review's own cost is not measured here; the driver prices it from the transcript. Its network use: 18 blobless clones (163 MB on disk), 14 PyPI reads and 18 OSV reads, and no other request.

Changes made by the reviewer

1. studies/LH009/LH009.md: version 0.2; the authors line; the cites line (two amendments and a correction); the Answer's "18 ... 19" to "19 ... 18"; the Findings' class counts (19; 16 by a security word, in every case in the changelog at the tag; 18 silent) and "Eleven of the 19"; the frame sentence (164 packages, 155 pairs, 136 distinct repositories, LH008's 102 from 88); the Corrections entry.
2. studies/LH009/brief.md: amendment 1's applied counts and amendment 2's "eleven of the 19", each with a bracketed dated note of the correction.
3. articles/fixes-that-said-so.md: "only days earlier" to "a week or less earlier"; the colophon's record version (0.2) and review line.
4. articles/short/fixes-that-said-so.md: the colophon's review line.
5. articles/fixes-that-said-so.svg: unchanged (regenerated byte-identical). No data table or script was changed.

The sentences of version 0.1 that were replaced, for the record: "18 said in their own changelog, tag or PyPI description, at or before the release, that they fixed a security flaw, and 19 did not"; "Of the 37 fixed releases, 18 are announced at the release: 15 by a security word (in 14 cases in the changelog at the tag; lxml's also in its tag annotation and PyPI description) and 3 by the flaw named alone (gitpython 3.1.49; mako 1.3.11 and 1.3.12); 19 are silent"; "Eleven of the 18 announced entries name GHSA identifiers"; "and 164 packages in 155 repositories were kept"; the brief's "Of the 37 fixes, 18 are announced at the release (15 by a security word, 3 by the flaw named alone) and 19 are silent" and "eleven of the 18 announced entries".

Verdict

Nothing remains that must be fixed. The piece, the short form and the figure can be released as they now stand; the driver removes the Draft labels, sets the piece's and short form's version and date on release, adds the releases.md line, puts the piece on the front page, and commits the record at version 0.2 with the piece. Version 0.1 of the record was never committed; this note quotes the sentences it changed.