{
  "repository": "https://github.com/apache/airflow",
  "commit_source": "release_tag_resolution_plus_installed_pypi_wheel_metadata",
  "commit_sha": "1438ea3587031417cc85d74323235cf087a058fb",
  "submitted_target": {
    "target_kind": "release_tag",
    "version": "3.2.2",
    "ref": "refs/tags/3.2.2",
    "commit_sha": "cde4885818be51a6cdcfdf9275e100bf070025de",
    "display": "apache-airflow 3.2.2 / tag 3.2.2"
  },
  "variant_target": {
    "target_kind": "release_tag",
    "version": "3.3.0",
    "ref": "refs/tags/3.3.0",
    "commit_sha": "1438ea3587031417cc85d74323235cf087a058fb",
    "display": "apache-airflow 3.3.0 fixed/latest release / tag 3.3.0"
  },
  "installed_artifacts": {
    "vulnerable_airflow_file": "/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/__init__.py",
    "fixed_airflow_file": "/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/__init__.py",
    "fixed_source_file": "/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/serialization/serialized_objects.py"
  },
  "notes": "The runtime proof used installed PyPI packages apache-airflow==3.2.2 and apache-airflow==3.3.0. Git tag resolution is recorded in bundle/logs/vuln_variant/fixed_version.txt; PyPI reported 3.3.0 as latest."
}