Does YunoHost re-build packages when there is CVEs in packaged dependencies

[williamdes]

I have an important question: Does Yunohost re-build packages when there is CVEs in packaged dependencies ?

I know that phpMyAdmin ships packages that happen to have CVEs, do you wait for a new release of phpMyAdmin to fix them ?
Or do you do some re-building or patching like Debian does ?

[ericgaspar]

The app is fully replaced with the new version from upstream. We only keep the configuration file.

[williamdes]

Okay, but in case of a CVE you confirm that here is no updates to sub components that are shipped with the released version of phpMyAdmin?

[williamdes]

For example phpMyAdmin does ship this library and it had a CVE GHSA-q2qj-628g-vhfw

YunoHost installations are still vulnerable then?

[ericgaspar]

We will have to wait for upstream to implement the CVE fix.

[williamdes]

We will have to wait for upstream to implement the CVE fix.

Okay, and for this example that upstream does a new release that contains the CVE fix for one of it's dependencies.
Do you recall one time where it was needed to patch upstream zip files ?