[checklists] Allowed choosing the first affected release per branch in CVE records.

[nessita]

The CVE record listed every branch as affected from its feature version, as in "6.0 before 6.0.10". For regressions, such as one introduced by an earlier security fix within the series, that would overstate the affected range and include releases that never had the flaw.

SecurityIssueReleasesThrough now has an optional introduced_in release, validated to be an older, final release of the same series. Both the CVE JSON and the CVE description start the affected range from it, and the JSON marks the earlier releases of the series as explicitly unaffected rather than leaving them to the product's defaultStatus. Blank keeps the previous behavior, so existing records are unchanged.

The description and the JSON now share a single query, which also orders the branches newest first. Ordering follows the version components, since a version string sort would put "6.2.7" ahead of "2029.1".

Also changed on_delete to PROTECT for SecurityIssue.release and SecurityIssueReleasesThrough.release, since deleting a security release checklist or a release silently removed CVE records.

AI Assistance Disclosure (REQUIRED)

• No AI tools were used in preparing this PR.
• If AI tools were used, I have disclosed which ones and fully reviewed and verified their output.

Claude code was used to brainstorm the solution.

[nessita]

In the admin:

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 98.65772% with 2 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@d82bc81). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
checklists/models.py	94.11%	1 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2907   +/-   ##
=======================================
  Coverage        ?   88.33%           
=======================================
  Files           ?      201           
  Lines           ?     7749           
  Branches        ?      422           
=======================================
  Hits            ?     6845           
  Misses          ?      816           
  Partials        ?       88           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jacobtylerwalls]

thanks!

[nessita]

thanks!

@jacobtylerwalls Thanks for the review! I applied both comments, and a few other things changed along the way. Specifically:

• when introduced_in is set, the CVE metadata gets an unaffected entry for the releases of the series before it, so this does not depend on the defaultStatus alone.
• I renamed the migration to 0013_securityissuereleasesthrough_introduced_in.

Other changes since you looked derived from review iterations with the 🤖:

• The CVE description now uses introduced_in too, so it says "Django 6.0.4 before 6.0.10" instead of "6.0 before 6.0.10". Otherwise the text and the JSON disagreed with each other. We will be able to do the live-QA for this on the nxt security release.
• The description and the JSON share one query, so they cannot drift apart again.
• The query orders the branches newest first by version components. Sorting version strings instead would put "6.2.7" before "2029.1", which matters once 2028.x and 2029.x share security releases with 6.2 LTS.
• introduced_in has to be a final release otherwise it makes no sense for the CVE metadata.