It still requires a substantial amount of time to review the fix. Depending on the circumstances it might require more time to review a piece of code than to write it.
A patch contains more than the changes: it contains the commit message. In open source projects, and in particular in CVE fixes, the commit message can indeed be quite descriptive. It needs to be!
You’re still right, though. But I like to think professionals are able to verify the changes with the high-quality commit message—possibly in less time than investigating the issue themselves.
It still requires a substantial amount of time to review the fix. Depending on the circumstances it might require more time to review a piece of code than to write it.
deleted by creator
A patch contains more than the changes: it contains the commit message. In open source projects, and in particular in CVE fixes, the commit message can indeed be quite descriptive. It needs to be!
You’re still right, though. But I like to think professionals are able to verify the changes with the high-quality commit message—possibly in less time than investigating the issue themselves.
How did they submit changes to only one file? Did they not write a test for it? Sounds like a dodgy patch if it doesn’t have a test
deleted by creator