[GHSA-225v-733h-9gwv] Clash Verge Rev thru 2.2.3 forces the installation of...

[Dragon1573]

Updates

• Affected products
• Description
• Summary

Comments
The Clash Verge Rev Main GUI now communicates with its service and Mihomo Core process via Unix Socket (.sock file) or Windows Named Pipe (\\.\pipe\ URL) by default for security reason. This CVE/NVD/GHSA should be marked as fixed.

[yhidad31]

Hi @Dragon1573, thanks for the contribution. Unfortunately we can't accept this change because the rust package of the affected product, clash-verge-rev (which contains the affected code), is not in one of our supported ecosystems. If you can point to a package in a supported registry (for example https://crates.io/) we can reevaluate. Thank you for helping improve the database.

[Dragon1573]

... because the rust package of the affected product, clash-verge-rev (which contains the affected code), is not in one of our supported ecosystems.

Hi @yhidad31, 👋🏼

I'm one of the collaborators of repository clash-verge-rev/clash-verge-rev. By communicating with organization member(s), other collaborators externally (via Telegram), we confirmed that the reported GHSA / NVD / CVE ID has already been resolved and no more vulnerable in Clash Verge Rev v2.3.0 and later versions.

How can we claimed it as resolved? Can I just edit this pull request and remove this GHSA from the repository?