I wonder why the bugfixes gets implemented so fast that there are frequent announcements in CentOS-announce list.
If only I could lay my (very) dirty hands on the sources of information…
With warm Regards,
The fixed package sources come from the upstream distribution. When they announce a fixed package, the CentOS maintainers pull it down and recompile it for inclusion in CentOS.