Is there any specific requirement to change packages in response to
CVEs, specifically if they appear to be bogus? I can't find anything
specifying that.
I ask because three CVEs have triggered automated bug reports against
libxsmm <
https://apps.fedoraproject.org/packages/libxsmm/bugs>. I don't
understand why the CVEs were issued, since a problem with unrealistic
input to a (rather rarely used) development tool doesn't strike me as a
security problem.
On that basis I didn't bother including the upstream patch with the
latest version, and I'm inclined to close the issues as wontfix. Would
that be appropriate?