Page History

...

If you have not done any analysis on whether the advisory for the dependency impacts the project, you can consult the projects' public channels to find out if anyone else has done any research into this advisory. Some projects (such as nifi and Solr) have a dedicated page for such information, otherwise you could look at their issue tracker or public mailinglists. If no existing analysis on the issue can be found, you may open a public issue or discussion on the mailinglist. Contributions upgrading the dependency to a version that is not affected by the problem are also generally welcomed.

...