DarrenMcCartney The vulnerabilities patched by upstream project releases are provided by those projects. We don't duplicate the lists of patched vulnerabilities from the upstream projects. There's a misconception that it's available in our release notes instead of looking at the Android Security Bulletins and Chrome release posts. Our OS release notes have a list of security preview patches included in our security preview releases because that's not available through any upstream post.