{
  "repository": "https://github.com/apache/kafka",
  "commit_source": "release_tag_resolution_and_binary_distribution",
  "commit_sha": "c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c",
  "submitted_target": {
    "target_kind": "release_tag",
    "version": "4.1.0",
    "commit_sha": "13f70256db3c994c590e5d262a7cc50b9e973204",
    "ref": "4.1.0",
    "display": "Apache Kafka 4.1.0 release tag and binary distribution"
  },
  "variant_target": {
    "target_kind": "release_tag",
    "version": "4.1.2",
    "commit_sha": "c82fd9b934b4c1e6fa799e3f1dcc8f08d997740c",
    "ref": "4.1.2",
    "display": "Apache Kafka 4.1.2 release tag and binary distribution"
  },
  "notes": "Runtime-backed variant matrix tested Kafka 4.1.0 and 4.1.2 binary releases. 4.1.2 is the fixed target; invalid issuer/audience/signature inputs were rejected there, so this is not a bypass."
}