fixdossier / Docs / Sample records / Canop/dysk
Sample security record: Canop/dysk
| Repository | github.com/Canop/dysk |
|---|---|
| Generated | 2026-11-03T10:35:22.459Z |
| fixdossier | v0.1.2 (commit f5d6fc5), run locally with max_pages=10 |
| Files | SECURITY-RECORD.md · security-record.json |
Canop/dysk did not request, review or endorse this record, and no claim is made that the project uses fixdossier. It was generated from public GitHub data only (published security advisories, releases, tags, merged pull requests and commit messages).
Disclosure: the one fix in this record (dysk pull request #126) was contributed by Italo Armenti, who also maintains fixdossier. The dysk maintainer merged it as an ordinary contribution. That does not mean the project reviewed or endorsed this record.
Below is the generated SECURITY-RECORD.md, rendered as-is. Rows labelled date heuristic and all keyword commit rows are automatic guesses that the project’s maintainers would need to confirm. See what the record covers.
Security record — Canop/dysk
Generated 2026-11-03T10:35:22.459Z by fixdossier from GitHub data (releases, tags, security advisories, merged Dependabot/Renovate PRs, commit messages). Automatically compiled; review before relying on it. Not legal advice.
Summary
| Item | Count |
|---|---|
| Published GitHub security advisories | 0 |
| Commits that look like security fixes | 1 |
| Merged bot dependency updates (security-flagged) | 0 (0) |
| Releases | 52 |
| Fixes not yet in a release | 0 |
Security fixes (newest first)
| Date | Type | IDs | Fix | Shipped in | Release date | How mapped |
|---|---|---|---|---|---|---|
| 2026-11-02 | commit | — | fix terminal escape injection from mount metadata | v3.8.2 | 2026-11-02 | date heuristic (first release on/after commit) |
Dependency updates by bots (newest first)
| Merged | Bot | Update | Security? | Shipped in | How mapped |
|---|---|---|---|---|---|
| — | — | None found in the checked range |
Releases
| Release | Date | Pre-release |
|---|---|---|
| v3.8.2 | 2026-11-02 | |
| v3.8.1 | 2026-10-17 | |
| v3.8.0 | 2026-10-17 | |
| v3.7.1 | 2026-09-27 | |
| v3.7.0 | 2026-09-13 | |
| v3.6.1 | 2026-05-04 | |
| v3.6.0b | 2025-12-23 | |
| v3.5.0 | 2025-12-02 | |
| v3.4.0 | 2025-11-08 | |
| v3.3.0 | 2025-11-02 | |
| v3.2.0 | 2025-10-29 | |
| v3.1.0 | 2025-08-29 | |
| v3.0.0 | 2025-08-18 | |
| v2.10.1 | 2025-05-13 | |
| v2.10.0 | 2024-12-21 | |
| v2.9.1 | 2024-09-08 | |
| v2.9.0 | 2024-06-03 | |
| v2.8.2 | 2023-10-16 | |
| v2.8.1 | 2023-10-09 | |
| v2.8.0 | 2023-08-22 | |
| v2.7.2 | 2023-08-03 | |
| v2.7.1 | 2023-07-16 | |
| v2.7.0 | 2023-07-16 | |
| v2.6.1 | 2023-07-02 | |
| v2.6.0 | 2022-10-19 | |
| v2.5.0 | 2022-03-15 | |
| v2.4.0 | 2022-03-04 | |
| v2.3.1 | 2022-03-01 | |
| v2.3.0 | 2022-02-27 | |
| v2.2.0 | 2022-02-26 | |
| v2.1.1 | 2022-02-25 | |
| v2.1.0 | 2022-02-23 | |
| v2.0.2 | 2022-02-23 | |
| v2.0.1 | 2022-02-20 | |
| v2.0.0 | 2022-02-20 | |
| v1.4.0 | 2022-01-06 | |
| v1.3.1 | 2021-12-26 | |
| v1.3.0 | 2021-11-03 | |
| v1.2.1 | 2021-10-30 | |
| v1.2.0 | 2021-10-19 | |
| v1.1.0 | 2021-10-08 | |
| v1.0.0 | 2021-09-05 | |
| v0.7.6 | 2021-07-08 | |
| v0.7.5 | 2021-07-01 | |
| v0.7.4 | 2021-07-01 | |
| v0.7.3 | 2021-06-30 | |
| v0.7.2 | 2021-06-29 | |
| v0.7.1 | 2021-06-24 | |
| v0.7.0 | 2021-06-23 | |
| v0.6.0 | 2021-06-22 |
Mapping notes: advisory patched_versions means each advisory patched range was parsed and matched to the earliest fetched release tag that satisfies it; every matched release is listed. tag commit match means the commit SHA or bot PR merge SHA equals the commit a release tag points at (annotated tags use the peeled commit, not the tag object; a short SHA counts only when it is a unique prefix of one tag commit). date heuristic (first release on/after publish), date heuristic (first release on/after commit), and date heuristic (first release on/after merge) are the first stable release published on or after that date, used only when the methods above do not match. That heuristic can be wrong for backports and multi-branch repos. Commit detection uses message keywords (CVE-, GHSA-, security, vuln…) and will miss silent fixes and include some false positives. A docs conventional commit (any scope, with or without a colon) is not a fix candidate unless the message cites a CVE or GHSA.
Not legal advice. fixdossier is an engineering tool for evidence collection and review support. It is not legal advice and not a compliance certificate. It does not make a product compliant with the PLD, the CRA or anything else, and its output can be incomplete or wrong. Review it, and ask a lawyer about your situation.