If the commit was cherry picked to the emacs-28 branch, does that mean it’s just unreleased changes for Emacs 28? We are building from source, so that might be enough. I didn’t realize cutting a release was high effort.
On Feb 14, 2023 at 7:20 AM -0600, Eli Zaretskii <eliz@gnu.org>, wrote:
> > From: lux <lx@shellcodes.org>
> > Cc: emacs-devel@gnu.org
> > Date: Tue, 14 Feb 2023 13:07:44 +0800
> >
> > Hi, I can fix the CVE-2022-45939, this is a patch.
>
> We don't need a patch for that, we just need to cherry-pick the
> related commits from emacs-29.
>
> But that is not what the OP requested: he requested that we also
> produce an Emacs 28.3 release. And that is a much larger job, for
> which we currently don't have the time or resources.