Glvd release note generator produces strange results for CVEs with multiple source packages #153
Description
Looking at the generated Release Notes for 1443.20, it contains some unexpected things:
The 'ruby3.1' package was not upgraded, but multiple CVEs are closed?
One explanation might be that those CVEs had been triaged, but this is not the case here.
Looking at the CVE details, we see that this CVE is matched to multiple source packages.
This does not seem to happen often and is not a case that is part of our tests yet.
This CVE also appears here, but for a different reason:
Similar issue (no version upgrade) with multiple source packages again:
