Delta cves naming inconsistency

[enriqueesanchz]

There is a naming inconsistency in the filenames and links for the delta cves releases since 2026-01-29. This only happens for 0200Z and 0300Z delta releases.

• CVE 2026-01-29_0200Z
  • The delta release corresponds to 2026-01-29_0200Z so it is located in https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-01-29_0200Z but the filename is 2026-01-29_delta_CVEs_at_0300Z.zip.
  • Full link: https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-01-29_0200Z/2026-01-29_delta_CVEs_at_0300Z.zip

Same thing happens with:

• https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-01-29_0300Z/2026-01-29_delta_CVEs_at_0400Z.zip
• https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-01-30_0200Z/2026-01-30_delta_CVEs_at_0300Z.zip
• https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-01-30_0300Z/2026-01-30_delta_CVEs_at_0400Z.zip

[LaurentGH]

I confirm that this inconsistency is still present in March. It appears several times a week.

For example, the last inconsistency was:
https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-03-18_1800Z/2026-03-18_delta_CVEs_at_1900Z.zip

The folder is ..._1800Z, but the filename is ..._1900Z.zip.

It appears when the generation of the ZIP file is long, and ends the next hour. It mostly happens for 0200Z and 0300Z, but as you can see, it also happens at other times.

Thank you in advance.

[LaurentGH]

The code generating the filename is located at DeltaCommand.run()#L45300. The hour is set from a local variable named timestamp at line 45294, which is initialized at the beginning of the function, instead of the beginning of the release process.

The workflow release.yml#L29 contains the job generate-name which generates the name +%Y-%m-%d_%H00Z at the start of the release process. This name, which contains the correct hour, should be used in the job create_release at release.yml#L73. This is where the DeltaCommand.run() code is called via the delta parameter. So, injecting the correct name as a parameter of DeltaCommand.run(), allows this function to use the good value instead of its local timestamp variable.

Hope it helps.

[enriqueesanchz]

Makes sense, I hope a contributor can have a look on this @hkong-mitre @rbrittonMitre @jdaigneau5