CAMP-2026-0004
Defective publication record, withdrawn (not a security issue)
Componentquizaccess_campla
SeverityLOW
Affected versions=v5.2-r1
Fixed inv5.2-r2
Published2026-07-27T00:00:00Z
Revocationaffected versions are removed from installation channels; archived artifacts are preserved
Details
Not a vulnerability. The v5.2-r1 release record was published from a workflow run whose ref was the default branch rather than a tag, so the ledger recorded tag "main" at the then-current commit. The recorded artifact hash is intact and the archived ZIP matches it, but the record references a moveable ref and can never verify again, and the maintainer's real v5.2-r1 tag points at a different commit than what was published. The version is withdrawn from installation channels; v5.2-r2, built at an immutable tag, supersedes it. Sites that installed v5.2-r1 got code identical to the archived artifact and should simply upgrade to v5.2-r2. Tooling now refuses non-tag refs at publication (camp-tools#15).