{
  "repository": "Vtiger CRM",
  "commit_source": "release_tag_resolution",
  "commit_sha": "360f394f5f7ffabc89eaca05b18523f9",
  "submitted_target": {
    "target_kind": "release",
    "version": "8.4.0",
    "ref": "vtigercrm8.4.0.tar.gz",
    "display": "Vtiger CRM 8.4.0 SourceForge release tarball (GHSA-jf2j-jhvf-rc56)"
  },
  "variant_target": {
    "target_kind": "release",
    "version": "8.4.0",
    "ref": "vtigercrm8.4.0.tar.gz",
    "display": "Vtiger CRM 8.4.0 SourceForge release tarball used for variant validation",
    "commit_sha": "360f394f5f7ffabc89eaca05b18523f9"
  },
  "notes": "Vtiger CRM is distributed as a SourceForge release tarball, not as a git repository. The commit_sha field records the MD5 hash of the tested tarball (vtigercrm8.4.0.tar.gz) as the exact tested source identity. The installed instance reports $vtiger_current_version = '8.4.0' and $patch_version = '202507009' in vtigerversion.php."
}