security_watch: a GitHub Actions advisory is not listed; an empty fix with a closed range reads 'after X' (R-1310 part; test W9, red first)

scripts/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 2026-10-27 — the security watch reads two notice shapes right (R-1310, part)
+
+- **`security_watch.py` `ghsa_affects`:** a GitHub Actions advisory (ecosystem `actions`, the project's own CI) is no
+  longer listed against an image (Home Assistant's GHSA-jff5); an empty fixed version with a range that ENDS at a version
+  now reads „a version after X (the notice names none)" instead of „no fixed version named yet" (Vikunja's six, fixed in
+  2.7.0). Test W9 in `test_security_watch.py`, seen failing first (2 of 4 red, both controls green). The other shapes
+  R-1310 lists stay open.
+
 ## 2026-10-26 (night) — the nightly security watch (R-1303)
 
 - **`security_watch.py`** (new): every night (CI `.gitea/workflows/security-watch.yml`, 03:40 UTC) it reads GitHub's