Security fixes, not release notes.

When a framework publishes a security advisory, this page tracks what teams need for patch triage: affected ranges, fixed versions, CVEs, severity, and the original advisory. Feature releases and routine changelog noise stay out.