Commit f54febc5 for xz

commit f54febc540607b3bdee0a0e6793355df2a7e9f61
Author: Lasse Collin <lasse.collin@tukaani.org>
Date:   Sun Nov 8 20:13:57 2026 +0200

    NEWS of 5.8.4: A CVE was never assigned for GHSA-5qpq-xqfv-j9pg

diff --git a/NEWS b/NEWS
index 812124e9..bb2bc0ae 100644
--- a/NEWS
+++ b/NEWS
@@ -17,7 +17,8 @@ XZ Utils Release Notes
           invalid memory access after memory allocation has failed and
           the application reinitializes the existing decoder to decode
           a different file. This bug could at least result in a crash.
-          This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
+          This is tracked as GHSA-5qpq-xqfv-j9pg; a CVE number was
+          requested via GitHub on 2026-08-21 but was never assigned.
           (Also in v5.2, v5.4, and v5.6.)

         - lzma_stream_buffer_decode(): Fix wrong error code and,