Marius Bakke <mbakke@fastmail.com> writes:

> On the NEWS side, here is what springs to mind:
>
[...]
> * Packages can specify that some CVEs don't apply to them

Around when (or what commit) was this feature introduced?