This would be fantastically useful in my work. We have a third party system that automatically monitors CVEs, and when one appears for SQLite I need to respond/explain as its internal maintainer. Usually I can figure it out from posts on the mailing list/forum and/or release notes, but an explicit list like you propose would greatly simplify that effort. (I will acknowledge that overall this is not a significant waste of time since the number of CVEs coming through are quite low.) Donald Shepherd