Why we never say you are safe

There are three verdicts here: affects you, affects your product, and not in your stack. There is deliberately no "you are not affected".

The reason is asymmetry. A wrong "you are affected" costs you an afternoon checking something that turned out to be fine. A wrong "you are not affected" costs you the patch you did not apply, and you find out from whoever does your incident response.

The verdict is computed from what you enter. It does not inspect your estate — the forgotten appliance, the contractor’s box, the version that was rolled back and never rolled forward again — and a tool that has not inspected a network has no basis to clear it.

So when your version sits outside a vendor’s published affected range, the page says exactly that: outside the range the vendor published, with the range beside it. Vendors revise affected ranges after publication, and have.

This is enforced in software, not by editorial discretion. Any generated piece that tells a reader they are unaffected, safe, or need take no action is stopped before it publishes.