retroactively add bug closure and CVE ids