Cherry pick detection seems to occassionally add unrelated commits

[oliverchang]

Context: google/oss-fuzz-vulns#34 (comment)

The offending commit (e8a86ab6c84f6618fae6f961c34c25ef42e91332) does not actually exist in the qtsvg repo.

[rlohning]

The mentioned commit is from a parent repository. That repository contains a submodule (qtsvg) which received the actual fix. Still, having e8a86ab in the database isn't helpful because the submodules are checked out to later revisions than were committed to the parent repo.
If e8a86ab was the first revision of the parent that was tested after the submodule got the fix, then that's just a coincidence.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks