Out of an abundance of caution we don’t let the tracker close bugs or assign CVEs but tell it to defer to a real human for that. I’ll have to experiment with how we can do a better job of detecting duplicates because I’m sure a fair number of the issues are.

If the bugs were being found in code that is used heavily in production I’d agree. Spamming the tracker with 100’s of bugs in random unmaintained areas of the code base just wastes everyone’s time. Perhaps as a project we should be more aggressive in deprecating code but the threat profile for someone running firmware blobs from their camera is very different from people launching untrusted guests on their shared hosting infrastructure.

I do run a bot that can do the initial triage, it doesn’t solve the problem of bugs stacking up in unmaintained areas of the code. I have experimented with auto-fixing the bugs with an LLM but currently the project policy is no AI contributions at all. We are in the process of debating a new policy which might allow for simple fixes to be done with AI.