[GHSA-m835-3cm9-rggg] Add joker 1.8.2 fix commit

[SebTardif]

Add the published joker 1.8.2 fix commit (and the first patched release tag) on the existing reviewed advisory GHSA-m835-3cm9-rggg.

Problem

The global record already has fixed: 1.8.2. Later releases, including current v1.10.0, are already covered by that range. This PR does not change the patched version.

What is missing is a primary-source link to the commit that stopped executing project-local .jokerd/linter.* files, and a link to the first patched tag.

Change

One file: advisories/github-reviewed/2026/09/GHSA-m835-3cm9-rggg/GHSA-m835-3cm9-rggg.json

• Add a WEB reference to f207521ef8ab (Only execute ~/.jokerd/linter.* files, not files from current directory up to root.).
• Add a WEB reference to the first patched release v1.8.2.
• Do not add the version-bump commit 75ac9a2eaa.
• Do not retarget the range at 1.10.0.

Validation

• python3 -m json.tool on the edited file succeeds.
• The commit message and test files (tests/linter/local-jokerd-ignored/) match the advisory text.
• Same reference shape as merged #9192 and #9193.

Related

• Repo advisory: GHSA-m835-3cm9-rggg
• CVE-2026-59172
• Recent sibling: #9376

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.