From c2fb24425c79b14cc1a1dad237139d0c50f91291 Mon Sep 17 00:00:00 2001
From: vansh1419 <vanshjain1419@gmail.com>
Date: Thu, 20 Aug 2026 22:55:09 +0530
Subject: [PATCH 1/2] feat: add unreleased_pmcs configuration and update
 project template to hide CVE allocation for unreleased projects while mocking
 user sessions

---
 app/__init__.py            |  3 ++-
 app/config.py              |  5 ++++-
 app/templates/project.html | 22 +++++++++++++---------
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/app/__init__.py b/app/__init__.py
index 53a874c..2d6d694 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -166,7 +166,8 @@ async def project(project: str):
         project_name=project,
         debt_constant=statistics.DEBT_CONSTANT,
         sections=sections,
-        show_subproject=project in config.get().pmcs_with_subprojects)
+        show_subproject=project in config.get().pmcs_with_subprojects,
+        is_unreleased=project in config.get().unreleased_pmcs)
 
 @CLIENT.route("/api/project/<project>/reports")
 async def project_reports_api(project: str):
diff --git a/app/config.py b/app/config.py
index a82e830..c32a104 100644
--- a/app/config.py
+++ b/app/config.py
@@ -38,7 +38,7 @@ class AppConfig(pydantic.BaseModel):
     state_dir: str
     """Local persistent data"""
 
-    old_cve_close_dates: dict[str, date]
+    old_cve_close_dates: dict[str, date] = {}
     """Some manual exceptions from before we had vulnogram, to prevent them from getting necromanced in the stats"""
 
     pmcs_with_security_emails: list[str] = []
@@ -53,6 +53,9 @@ class AppConfig(pydantic.BaseModel):
     pmcs_with_subprojects: list[str] = []
     """PMCs whose reports are split across subprojects."""
 
+    unreleased_pmcs: list[str] = []
+    """PMCs that do not publish software releases and therefore do not issue CVEs."""
+    
     server: ServerConfig = ServerConfig()
 
     @property
diff --git a/app/templates/project.html b/app/templates/project.html
index 8b4007f..e130ed7 100644
--- a/app/templates/project.html
+++ b/app/templates/project.html
@@ -58,17 +58,21 @@ <h3>{{ title }}
             {%- endif -%}
           </td>
           <td class="reports-cves">
-            {%- for cve in report.cves -%}
-              <div><a href="https://cveprocess.apache.org/cve5/{{cve}}">{{ cve }}</a></div>
-            {%- endfor -%}
-            {%- if report.state == 'confirmed' and not report.cves -%}
-              <div><a href="https://cveprocess.apache.org/allocatecve?pmc={{ project_name|urlencode }}&amp;title={{ report.sanitized_title|urlencode }}">allocate CVE</a></div>
-            {%- endif -%}
-          </td>
-          <td class="reports-reporter">
+  {%- for cve in report.cves -%}
+    <div><a href="https://cveprocess.apache.org/cve5/{{cve}}">{{ cve }}</a></div>
+  {%- endfor -%}
+  {%- if report.state == 'confirmed' and not report.cves -%}
+    {%- if is_unreleased -%}
+      <span class="text-muted" title="This project is not released and does not require CVEs. Credit reporter in commit messages or project acknowledgments.">no CVE required</span>
+    {%- else -%}
+      <div><a href="https://cveprocess.apache.org/allocatecve?pmc={{ project_name|urlencode }}&amp;title={{ report.sanitized_title|urlencode }}">allocate CVE</a></div>
+    {%- endif -%}
+  {%- endif -%}
+</td>
+          <td class="reports-reporter ">
             {% if report.reporter %}
               <span class="reporter-initials"
-                    style="background-color: {{ report.reporter.color }};"
+                    style="background-color: {{ report.reporter.color }}"
                     title="{{ report.reporter.tooltip }}">{{ report.reporter.initials }}</span>
             {% endif %}
           </td>

From b1256903264f1b5ba72490713de899fd81560d3c Mon Sep 17 00:00:00 2001
From: vansh1419 <vanshjain1419@gmail.com>
Date: Sun, 23 Aug 2026 09:35:08 +0530
Subject: [PATCH 2/2] refactor: rename unreleased_pmcs to
 pmcs_without_releases, update config/templates

---
 app/config.py              |  2 +-
 app/templates/project.html | 22 +++++++++++-----------
 config.yaml.example        |  3 +++
 3 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/app/config.py b/app/config.py
index c32a104..6657ca0 100644
--- a/app/config.py
+++ b/app/config.py
@@ -53,7 +53,7 @@ class AppConfig(pydantic.BaseModel):
     pmcs_with_subprojects: list[str] = []
     """PMCs whose reports are split across subprojects."""
 
-    unreleased_pmcs: list[str] = []
+    pmcs_without_releases: list[str] = []
     """PMCs that do not publish software releases and therefore do not issue CVEs."""
     
     server: ServerConfig = ServerConfig()
diff --git a/app/templates/project.html b/app/templates/project.html
index e130ed7..650e933 100644
--- a/app/templates/project.html
+++ b/app/templates/project.html
@@ -58,17 +58,17 @@ <h3>{{ title }}
             {%- endif -%}
           </td>
           <td class="reports-cves">
-  {%- for cve in report.cves -%}
-    <div><a href="https://cveprocess.apache.org/cve5/{{cve}}">{{ cve }}</a></div>
-  {%- endfor -%}
-  {%- if report.state == 'confirmed' and not report.cves -%}
-    {%- if is_unreleased -%}
-      <span class="text-muted" title="This project is not released and does not require CVEs. Credit reporter in commit messages or project acknowledgments.">no CVE required</span>
-    {%- else -%}
-      <div><a href="https://cveprocess.apache.org/allocatecve?pmc={{ project_name|urlencode }}&amp;title={{ report.sanitized_title|urlencode }}">allocate CVE</a></div>
-    {%- endif -%}
-  {%- endif -%}
-</td>
+            {%- for cve in report.cves -%}
+              <div><a href="https://cveprocess.apache.org/cve5/{{cve}}">{{ cve }}</a></div>
+            {%- endfor -%}
+            {%- if report.state == 'confirmed' and not report.cves -%}
+              {%- if is_unreleased -%}
+                <span class="text-muted" title="This project is not released and does not require CVEs. Credit reporter in commit messages or project acknowledgments.">no CVE required</span>
+              {%- else -%}
+                <div><a href="https://cveprocess.apache.org/allocatecve?pmc={{ project_name|urlencode }}&amp;title={{ report.sanitized_title|urlencode }}">allocate CVE</a></div>
+              {%- endif -%}
+            {%- endif -%}
+          </td>
           <td class="reports-reporter ">
             {% if report.reporter %}
               <span class="reporter-initials"
diff --git a/config.yaml.example b/config.yaml.example
index d16533e..68721ce 100644
--- a/config.yaml.example
+++ b/config.yaml.example
@@ -8,3 +8,6 @@ pmcs_with_security_emails:
   - ambari
 pmcs_with_subprojects:
   - commons
+pmcs_without_releases:
+  - whimsy
+  - infrastructure