Kei Kebreau <kkebreau@posteo.net> writes:

> Marius Bakke <mbakke@fastmail.com> writes:
>
>> On the NEWS side, here is what springs to mind:
>>
> [...]
>> * Packages can specify that some CVEs don't apply to them
>
> Around when (or what commit) was this feature introduced?

It was added in commit f4007b25476dfd97885f358d2dabbd463f6f6017, but
there has been little fuzz or discussions around it.

I've been meaning to fix false positives from `guix lint -c cve` for a
while, but did not get around to it yet.