Release review of the library-by-library piece, its short form and figure, and the record behind them

Findings

This is the release gate for articles/the-lead-was-a-few-libraries.md, its figure, its short form, the front page and the record studies/LH010/, with the LH010 lines in AGENTS.md and programme.md. The reviewer read AGENTS.md and R-0009, then the record, its brief and sources and the tables in data/, then the piece, the short form, the front page and the figure's text sentence by sentence against the record, and went to the primary sources as the dispatch asked. Every pooled rate in data/hazard_by_class.csv, every library rate, median, permutation p and leave-one-library-out range in library_rates.csv and library_unit.csv, the shares before the advisory and nltk's weight were recomputed from data/lags.csv with the reviewer's own short Python, and analyse.py was run on a scratch copy of the study and its outputs compared byte for byte. Nine fixed releases' notes were re-read at their tags from fresh clones (mako 1.3.11, uv 0.11.6, authlib 1.7.1, mistune 3.2.1, idna 3.15, aiohttp 3.13.4, tornado 6.5.5, python-dotenv 1.2.2, fastmcp 3.2.0), with the tag's type, its commit time and its annotation, and fastmcp's changelog history was walked by hand; nine releases' upload times and descriptions were read from PyPI; eleven libraries' events were re-derived from OSV and PyPI by LH008's rules 2 to 4; fifteen moves in fourteen dependents' repositories were re-read with a detector the reviewer wrote without reading collect.py's; and the figure was rendered with cairosvg (its CSS variables substituted, since cairosvg does not resolve them) and looked at.

The verdict is that the piece, the short form, the figure and the front page can be released after the changes below, which the reviewer made, and that the record is now version 0.2. Everything the record tabulates reproduced: every rate, median, range and count, the nine entries' words and classes, the eleven events, the fifteen moves to the second. What had to change was of two kinds. First, the record's rule for the advisory has a gap that the record did not see: an earlier GitHub-reviewed advisory naming the same fix, published before the window or before the fix, is not the event's advisory, and for three libraries with pairs (nltk, tornado, pip) such an advisory existed, so that nltk's 691 repository-days "before the advisory" and four of tornado's five moves came after a public advisory for the same release. The piece's opening said GitHub published tornado's advisory 23 days after the fix, when it had published two others for the release within two days. The reviewer computed the sensitivity with the earliest public advisory as the advisory time and put it in the record, the piece, the short form, the front page, AGENTS.md and programme.md. Second, the record's Answer said the lead "mostly goes away" and the piece's title that "the earlier lead came from a few libraries", when the pooled lead of about 1.5 times survives leaving out any one library and, without the three quickest announced libraries, is still 1.65 against 1.57; those claims were replaced by what the tables show. Smaller things: a count in the record's prose that its own table contradicts (221 reused packages, where reused_screen.csv has 201), a misquotation of python-dotenv's notes in the piece ("in some cases" for "in some situations"), the process timings, and the nltk and pip security-worded moves, whose messages and OSV say more than the record did.

The record against the primary sources

Reading	Record	Reviewer	Notes
mako 1.3.11, doc/build/changelog.rst at `rel_1_3_11` (lightweight, commit 217822b, 20:18:18Z)	announced by the flaw named; strict silent	identical to R-0009's reading: "could bypass the directory traversal check ... allowing reads of arbitrary files", no security word
uv 0.11.6, CHANGELOG.md at `0.11.6` (lightweight, commit 6595080, 11:21:12Z)	announced by the flaw named, borderline: "Do not remove files outside the venv on uninstall"	identical; the entry's three bug fixes carry no security word	Within amendment 1's rule as the record applies it; the strict class without it is tabulated
authlib 1.7.1, docs/upgrades/changelog.rst at annotated `v1.7.1` (commit 485016a, 08:01:42Z; tagger 08:10:21Z)	announced by the flaw named: "Fix redirecting to unvalidated `redirect_uri`"	identical; the annotation repeats the entry; no security word; PyPI's description has "security" in its README text but no part for the version
mistune 3.2.1, docs/changes.rst at `v3.2.1` (lightweight, commit 067f908, 14:30:25Z)	announced by the flaw named: "Fix `LINK_TITLE_RE` to prevent DoS"	identical; nine bullets, no security word
idna 3.15, HISTORY.md at annotated `v3.15` (commit af30a09, 22:40:29Z; tagger 22:41:13Z)	announced by a security word; the only heading naming 3.15 is "3.15rc0"; the words concern 3.14	identical: the file's headings are "3.15rc0 (2026-05-12)" then "3.14 (2026-05-10)"; the entry's last bullet is "Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier"; the annotation carries the same list. The rule's version line matches "3.15rc0" for 3.15 because its token allows letters after the version and nothing else names 3.15	The entry's first bullet names the change (a DNS-length cap enforced early), not a harm; the incidental sensitivity is fair
aiohttp 3.13.4, CHANGES.rst at annotated `v3.13.4` (commit 9f7c7ab, 16:08:45Z)	announced by a security word; the words concern 3.13.3	identical: within the 3.13.4 entry the only security words are "in 3.13.3 as part of the decompression bomb security fix" and "to maintain security protections"; the entry has no word for trailers, memory or exhaustion, the subject of GHSA-w2fm-2cpv-w7v5
tornado 6.5.5, docs/releases/v6.5.5.rst at annotated `v6.5.5` (commit 7d64650, 20:12:29Z; tagger 21:14:20Z)	announced; "Security fixes"	identical; three flaws named (multipart part limit against denial of service, cookie attribute injection, carriage returns in multipart headers)
python-dotenv 1.2.2, CHANGELOG.md at annotated `v1.2.2` (commit 36004e0, 15:56:49Z)	silent, near: "used to follow symlinks in some cases" (flaw_judgements note)	silent: no security word in the entry, the description or the annotation ("Bump version: 1.2.1 → 1.2.2"); the words are "used to follow symlinks in some situations", in a "Breaking Changes" section, beside "Improved `set_key` and `unset_key` behavior when interacting with symlinks"	The piece's quotation was corrected; the judgement note's paraphrase in data/flaw_judgements.csv and fix_classes.csv is left as the agent wrote it
fastmcp 3.2.0, docs/changelog.mdx at `v3.2.0` (lightweight, commit 665514e, 19:55:23Z)	no entry at the tag; the head's entry has security words, first written at dae11bbc40fd, 3 June 02:15:02Z, 64 days after the release; silent	identical: the file at the tag and at bbccc52b (6 April, the first later first-parent commit touching it) names 3.2.0 nowhere; dae11bbc ("Backfill changelog and updates through v3.4.0") is the first commit on any line to name it, and its entry opens "[v3.2.0: Show Don't Tool]" and holds "security hardening pass across SSRF/path-traversal"	date_head_entries.py walks first-parent commits since the upload, stops at the first whose entry has a security word, and dates it by committer time; its logic and result are as the record says
PyPI first upload times, nine releases	fix_classes.csv `uploaded`	identical to the microsecond; only python-dotenv's and uv's descriptions name their version
Events for cryptography, starlette, aiohttp, python-multipart, pyjwt, tornado, nltk, python-dotenv, idna, fastmcp, mako, from OSV's current records and PyPI's release lists by rules 2 to 4	events.csv	identical in every field: advisory id, severity, published time, fixed release, its first upload, the release before the fix; in each the fix's UTC date precedes the advisory's	cryptography's, starlette's, aiohttp's and python-multipart's events are the lower-severity records the record names, and pyjwt's is GHSA-fhv5-28vv-h8m8, low, 2 hours before LH008's
Fifteen moves from fresh clones: an-website and esphome (tornado, before the advisory); aider-chat, hermes-agent and docassemble (python-dotenv); open-webui and docassemble (nltk); package-version-check-mcp (fastmcp); c2cciutils (pip, Renovate's "[SECURITY]" move); tendenci (httplib2); esphome (cryptography); pgsync (sqlparse); mmrelay (bleach); otterwiki (mistune); email-to-calendar (pydantic-ai-slim)	moves.csv	identical in every field read: the snapshot (the last first-parent commit at or before the pair's release time), the first first-parent commit after it whose moved file names the moved-to version, its committer time to the second, its parent count, author and first line	The reviewer's detector reads first-parent history and matches the library name near the moved-to version, independently of collect.py
Every pooled rate (three groupings, ten windows), every library rate, the medians, the counts of libraries with no move, the leave-one-out ranges	hazard_by_class.csv, library_rates.csv, library_unit.csv	identical to the second decimal from lags.csv with the record's one-sentence at-risk rule	The permutation p values reproduce to within Monte Carlo noise with an independent shuffle (0.8865 for 0.8916, 0.6727 for 0.6776, 0.2753 for 0.2826, 0.7766 for 0.7756); analyse.py rerun on a copy reproduces every table byte for byte
Shares before the advisory; nltk's weight	35 of 96, 20 of 46; 691 of 1,522.4 repository-days, advisory 150.52 days after the fix	35 of 96, 20 of 46; nltk 4 moves over 690.9 days (0.58 per 100); without nltk the announced pooled rate is 3.73
The list and the frames	1,644 records; 227 in window with a fix; 215 qualifying against 43 libraries (6, 99, 86, 24 by severity); 106 fixes, 59 announced (49 by a word, 10 by the flaw), 47 silent; 22 and 21 events, 18 by a word, four by the flaw; strict 18 and 25; medians 4.0 and 6.0 days; 21 in the top 200; 19 high or critical; 12 reused; 13 events without pairs, 12 within 16 days, 7 within 5; 445 screened, 101, 45, 25, 56, 218 kept; 209 pairs from 150 repositories, 16 in both classes, 2 backport pairs; 142 moves, 9 with an AI trailer (7 Claude, 2 Copilot Autofix), 1 of 16 in the second frames (Cursor); 5 second fixes 6 May to 23 July; events uploaded 14 January to 13 August, advisories 27 March to 17 August	all identical from the tables, except "221 of them in the twelve reused frames": reused_screen.csv has 201 rows in eleven frames (ten of 20 and msgpack's 1; langchain's lists none)	Finding 3, fixed. The 43-row events table in amendment 1 matches events.csv and fix_classes.csv in every cell
The record's events-with-pairs table (30 rows) and the within-library table	summary_by_event.csv, within_library.csv	identical
The study's own reads	1,335 rows; 1,114 requests; 221 clones, 196 ok; 186 dependents, 161 cloned; 35 library clones	identical from read_log.csv and read_summary.csv
The figure	the-lead-was-a-few-libraries.svg	well-formed; renders as described: two rows of dots on a log scale with a no-move column, nltk the largest dot, the median and pooled lines where the alt text puts them; its labels and footer match library_rates.csv and library_unit.csv; the 30 rates in the alt text match the table	The SVG uses CSS variables for its colours, as LH009's does; browsers resolve them, cairosvg does not

Process integrity

The brief says amendment 1 was written "about 10:05 UTC, after the fixes were classified and before any dependent was read", and the record's header that sources were read to "about 10:19". The evidence is data/read_log.csv and the working tree's file modification times, as the reviewer found them (they can be set by hand; nothing suggests they were). data/fix_classes.csv and data/frame_defs.csv were last written at 10:02:16 and data/flaw_judgements.csv at 10:01:57; the first Open Source Insights request is at 10:03:13 and the first dependent's clone at 10:03:24; neither table was written again. So the classes, the events and the second frames were fixed in data before any dependent was read, and the amendment's applied section reports those tables. But the amendment's text cannot have been finished at "about 10:05" and before any dependent was read, since dependents were being listed from 10:03:13; brief.md was last written at 10:20:43, after amendment 2. The heading now says what the files show. The log's last row is at 10:04:41, not 10:19: collect.py's screening ran the 300 Open Source Insights requests and 186 clones in eight threads between 10:03:13 and 10:04:41 (about 3 seconds a clone a thread, which the reviewer's own blobless clones of small repositories match), wrote screen.csv at 10:04:42, and then read pin and lock files from the local blobless clones, which fetch blobs on demand without a log row, until moves.csv was written at 10:18:25; analyse.py, which carries the incidental-words grouping, was last written at 10:05:01, between the two. The header, Method, brief and sources now say this and no more.

The piece, sentence by sentence, against the record

Piece passage	Checked against	As the record has it?
Opening: tornado 6.5.5 on 10 March, "Security fixes", the advisory 23 days later, five of six moved before it; python-dotenv 1.2.2 nine days before, the quoted words, seven weeks, two of eight	Live clone; OSV; summary_by_event.csv (tornado 6 kept, 5 moved, 5 before; python-dotenv 8, 5, 2; gaps 23.38 and 50.94 days)	The counts, yes. "The advisory for the flaw 23 days later" no: GHSA-78cv-mqj4-43f7 (11 March) and GHSA-qjxf-f2mg-c6mc (12 March) name 6.5.5 as their fix, for two of the three flaws in the notes; only esphome's move (11 March 19:28) precedes both. "In some cases" no: the notes say "in some situations". Both changed (findings 1 and 4)
Line 5: fourteen libraries, 1.7 times, two libraries; "many more libraries, each once"; "about the same pace"	LH009 as reviewed in R-0009; library_unit.csv	Yes
Line 11: every reviewed advisory of any severity, 27 March to 27 August, 500 projects, fix a day before; 215 against 43; one fix each, the first advisory; rule fixed before any note; 22 and 21	brief.md; qualifying_advisories.csv; fix_classes.csv	Yes
Line 13: up to 20 a frame, hash order, kept rule, read to 27 September; thirteen gave nothing, twelve within 16 days; 30, 18 and 12, 209 pairs, 142 moved	frame_counts.csv, events.csv, lags.csv	Yes
Line 21: medians 3.2 and 2.7; 89 in 100	library_unit.csv	Yes
Line 23: days three to seven, median announced none, nine of 16; silent about 1.5 of 8	library_unit.csv (0.00, 9 of 16; 1.46, 8)	Yes
Line 25 and 27: the alt text's 30 rates, sizes, lines and footer; the caption	library_rates.csv, the rendered figure	Yes
Line 31: 35 over 1,522 days, 2.3; 20 over 1,273, 1.6; about one and a half times against 1.7	hazard_by_class.csv (2.30 / 1.57 = 1.46; LH009 1.74)	Yes
Line 33: nltk five months, almost half the waiting days; the fast small libraries; "at the mercy of which libraries"	library_rates.csv (691 of 1,522; tornado 49, gitpython 32, poetry 4.5, pypdf 2.8 days; pip 3.0, awscli 3.6, pydantic-ai-slim 0.5, fastmcp 9.9)	Yes, but the paragraph implied a few libraries carry the lead; the leave-one-out and leave-three-out figures were added (finding 2)
Line 35: 3.3 on 11 against 2.3 on 5; three of the 11 aiohttp's; 2.6 against 3.3 without	hazard_by_class.csv, moves_by_library; the incidental grouping	Yes
Line 37: 35 of 96 (36 per cent), 20 of 46 (43 per cent)	summary_by_class.csv	Yes
Line 41: thirty libraries, few moves; 89 in 100 does not show absence	Limits	Yes
Line 43: strict 3.7 against 0.8, 28 in 100, the three flaw-named among the thirty (mako, authlib, mistune; uv has no pairs); incidental 4.2 against 3.2	library_unit.csv; fix_classes.csv	Yes
Line 45: four libraries, three faster (cryptography, aiohttp, gitpython), pip slower, none to four moves	within_library.csv	Yes
Line 47: eight silent fixes with no notes; release pages not asked for; a move is a request	fix_classes.csv (litellm, mcp, langchain, transformers, langchain-core, pydantic-ai-slim, langsmith, nbconvert); read_log.csv	Yes
Line 51 and the title: "the lead we reported came from the particular libraries we happened to have"; "the earlier lead came from a few libraries"	library_unit.csv leave-one-out (announced 2.04 to 3.73 against silent 1.41 to 1.95); the reviewer's leave-three-out (1.65 against 1.57)	No: no single library's removal erases the pooled lead. Changed (finding 2)
Colophon: 500 projects at 09:53; 1,644 records, 215 qualified; the two GHSA ids and dates; 43 releases 14 January to 13 August; 35 libraries' repositories; 150 repositories; 09:53 to 10:05; 07:24 to 07:26 and 08:49 to 08:51; version 0.1; nine of 142 commits, seven Claude; 196 of 221 clones, 1,114 requests	read_log.csv, read_summary.csv, events.csv, lags.csv, fix_reads.csv	Yes; the record version, review line and the local reading to 10:18 were filled in

The short form's every figure (five of six, two of eight, fourteen, 1.7, 27 March to 27 August, 500, 209, 30, 18, 12, 3.2, 2.7, 89, one and a half, three moves) and the front page's are in the tables above; both now carry the earlier-advisory sentence. The figure's text carries the same rates and counts.

The writer's points, and what else was found

Must fix, fixed. Advisories the window rule does not see. For every one of the 43 events the reviewer looked in data/osv_advisories.csv for a GitHub-reviewed, unwithdrawn GHSA record naming the event's fixed release and published before the event's advisory. Four have one: nltk 3.9.3 (GHSA-7p94-766c-hgjp, critical, 18 February, six days before the release; GHSA-h8wq-7xc4-p3qx, high, 9 March), tornado 6.5.5 (GHSA-78cv-mqj4-43f7, moderate, 11 March 22:17; GHSA-qjxf-f2mg-c6mc, high, 12 March 14:19), pip 26.1 (GHSA-58qw-9mgm-455v, moderate, 20 April, six days before the release) and dulwich 1.2.5 (two, two minutes after its upload; no pairs). The rule (LH008's 2 to 4, fixed in the brief before any advisory was read) takes the first advisory published in the window whose fix came a calendar day earlier, so these are not the events' advisories, and the record is right to keep the rule; but it did not know of them, and the piece opened on tornado as if no advisory existed for 23 days. The reviewer recomputed the two library-unit windows with the earliest public advisory naming the fix as the advisory time, by the record's rules: nltk and pip then have no time before it; medians 3.26 (17 announced) against 1.30 (11 silent), p = 0.47; pooled 3.42 (27 moves over 788.5 repository-days) against 1.42 (18 over 1,270.4), 3.04 to 4.02 and 1.25 to 1.74 leaving one out; days two to seven, medians 0.00 against 1.46 (14 and 8; p = 0.67), pooled 3.28 (9) against 2.29 (5); 27 of 96 and 18 of 46 moves before that advisory. The record's Answer, Findings and Limits, the piece's opening and limits, the short form, the front page, AGENTS.md and programme.md now carry this. The conclusion that the classes cannot be told apart library by library stands; the pooled lead is larger under this reading, not smaller.
Must fix, fixed. "Mostly goes away" and "came from a few libraries". The writer flagged both. The pooled lead from the release to the advisory is 2.30 against 1.57 and stays between 2.04 and 3.73 against at most 1.95 whichever single library is left out; without tornado, gitpython and aiohttp together, the three highest-rate announced libraries with three or more moves, it is 1.65 against 1.57 (added to the Findings). What LH010 shows is that the typical library does not show the lead and that a pooled rate follows the libraries with the most repository-days, not that a few libraries made LH009's lead. The record's Answer, the piece's title and closing section, the short form's and front page's titles, and the AGENTS.md and programme.md sentences were rewritten to say that. The piece's file name is unchanged.
Must fix, fixed. "221 of them in the twelve reused frames." data/reused_screen.csv has 201 rows: 20 for each of ten frames, one for msgpack's, none for langchain's, whose release before the fix lists no dependent. 244 fresh event-frame rows and 201 reused make the 445 the record states, and the reason counts (101, 45, 25, 56, 218) reproduce.
Should fix, fixed. python-dotenv's words. The piece quoted the notes as "used to follow symlinks in some cases"; the CHANGELOG.md at the tag, at the head and in PyPI's description says "in some situations". The record's judgement note paraphrases the same way in data/flaw_judgements.csv and fix_classes.csv; it is the agent's note, not a quotation, and was left.
Should fix, fixed. The process timings (above). The brief's amendment 1 heading, the record's header and Method, and sources.md now say what the read log and file times show.
Note, added to the record. The nltk and pip security-worded moves. The record said the nltk move's message is "Update nltk and pillow package versions" and that which advisory Renovate knew of was not read. The commit's body (suffolklitlab/docassemble 92d5626, read from a fresh clone) says the bump to 3.9.4 "fixes Zip slip vulnerability (Critical)", the flaw of GHSA-7p94-766c-hgjp, public since 18 February, 78 days before the event's advisory; and Renovate's pip move came six days after GHSA-58qw-9mgm-455v had named 26.1 as its fix. All three security-worded moves before an event's advisory came after some public advisory.
Note. Kept. The judgement calls. uv's and authlib's entries name the effect (files removed outside the environment; a redirect to an unvalidated address) and mistune's names denial of service; all three are announced on the flaw named under amendment 1's rule as the record applies it, the record calls two borderline, and the strict class without them is tabulated. idna's and aiohttp's security words are about earlier releases, as the record says, and neither entry names its own flaw in terms of harm, so the incidental sensitivity is a fair reading. fastmcp's silence is the rule's result and the history bears it out.
Note. Kept. House style. No em or en dash in the piece, short form, front page, record, brief, sources or note (checked by code point; the middle dot of the bylines and the arrow in a quoted tag message are the only non-ASCII characters in the reader files). No study number, note number, issue or role in the piece's or short form's prose. Every relative link resolves. Every number in the piece, the short form, the front page and the figure traces to a table or to this note's derived figures, which are now in the record.

What the review could not check

The other 85 fixes' entries, tags and descriptions, and the other 32 events: the tables as published; the nine and eleven re-read agreed in every field.
The other 127 moves and the non-moves, and the reused LH008 and LH009 rows: the tables as published, the reused rows as reviewed in R-0008 and R-0009; the fifteen re-read agreed in every field.
The 300 Open Source Insights reads and their lists: not repeated; the counts were recomputed from frame_counts.csv, screen.csv and reused_screen.csv.
When the amendments' text was written: file times bound it (after 10:03:13, before 10:20:43), no more. That the tables were not written again after 10:02:16 rests on their file times.
The 0.8 GB peak on disk, and the 629 MB of clones: stated from read_log.csv's sizes, not repeated.
The earliest-advisory sensitivity is the reviewer's computation with the record's rules, checked against the rule's own figures (which it reproduces when the event advisory is used), not a table analyse.py writes; a later edition could add the grouping to the script.
Whether any other event's dependents held a version that a different advisory, with a different fix, also affected (nltk's 3.9.4 advisories of 18 and 19 March, for instance): the design accepts this, as LH008's did, and it was not measured.
The review's own cost is not measured here; the driver prices it from the transcript. Its network use: 23 blobless clones (about 310 MB on disk), 20 PyPI reads and 11 OSV reads, and no other request.

Changes made by the reviewer

studies/LH010/LH010.md: version 0.2; the authors and cites lines; the header's read times (requests and clones to 10:04:41, local reading to 10:18:25, clones 10:03 to 10:04); the Answer's first sentence; the earliest-advisory sensitivity in the Answer and a closing sentence of the interpretation; the earlier advisories in Findings ("The list"); "221 ... twelve" to "201 ... eleven"; the leave-three-out rate; the nltk and pip moves; the Method's account of amendment 1 and of analyse.py's time; a Limits bullet; the Corrections entry.
studies/LH010/brief.md: amendment 1's heading and a bracketed note under it; a bracketed note in the opening; "fixed now" to the file and time for the within-library pairs.
studies/LH010/sources.md: "about 10:19" to 10:18 in two places.
articles/the-lead-was-a-few-libraries.md: the title; the opening paragraph (tornado's three advisories, "in some situations") and the first words of the second; "by our rule" and the leave-one-out and leave-three-out sentence in "Where the old lead came from"; a new paragraph in "Where the reading runs thin"; the closing section's second paragraph; the colophon's record version, read times and review line. Draft label, version 0.1 and date left for the driver.
articles/short/the-lead-was-a-few-libraries.md: the title; the opening; the earlier-advisory sentence; the colophon's title reference and review line.
README.md: the title; tornado's sentence; the earlier-advisory sentence.
AGENTS.md and programme.md: the LH010 sentences on the lead and the earlier advisories.
articles/the-lead-was-a-few-libraries.svg: unchanged. No data table or script was changed.

The sentences of version 0.1 that were replaced, for the record: "Across many more libraries, the announced fix's lead before the advisory mostly goes away when each library counts once."; "445 packages were screened (at most 20 a frame; 221 of them in the twelve reused frames)"; "a person's nltk move whose message is "Update nltk and pillow package versions", and Renovate's move to pip 26.1, "Update dependency pip to v26.1 [SECURITY]", 48 minutes after the release and about 18 hours before pip's advisory; which advisory Renovate knew of was not read."; "amendment 1, before any dependent was read;"; "a third grouping (incidental security words counted silent) was added in amendment 1, before any dependent was read;"; the header's "LH010's at 10:03 to 10:05 UTC). LH010's sources were read on 27 September 2026 between 09:53:19 and about 10:19 UTC; data/read_log.csv holds each HTTP request and clone with its time"; the brief's "## Amendment 1, 2026-09-27 about 10:05 UTC, after the fixes were classified and before any dependent was read" and "(fixed now, before any dependent is read)". The piece's: its title's second clause "the earlier lead came from a few libraries"; "GitHub published the advisory for the flaw 23 days later, and by then five of the six projects we followed that pinned tornado had moved to the fix."; "Its notes said only that two of its functions "used to follow symlinks in some cases""; "and the lead we reported came from the particular libraries we happened to have. The pooled count still leans the announced way, and a test this small could miss a modest effect, so we do not say the notes make no difference. We say we cannot find one."

Verdict

Nothing remains that must be fixed. The piece, the short form, the figure and the front page can be released as they now stand; the driver removes the Draft labels, sets the piece's and short form's version and date on release, adds the releases.md line and commits the record at version 0.2 with the piece. Version 0.1 of the record was never committed; this note quotes the sentences it changed. One thing for the programme rather than this release: the next study of this question should fix the advisory time as the earliest public advisory naming the fix, whatever its publication date.