Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

release:notes: add --advisory to list GHSA fixes and credit their reporters

Abierto
  • ¿Algo no está bien?
#2,766 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
54/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github, node.js, typescript
Área
release

Línea de trabajo

Start with scripts/release-notes.mjs and its tests in scripts/release-notes.test.mjs; read the release skill’s step 3a for the documented workflow. Trace how the helper gathers release notes and contributor credits, then implement and test --advisory lookup, validation, draft warnings, security bullets, and reporter merging. Done when the acceptance cases pass and previewing version 2.12.0 reproduces its published security section and Thanks list.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement v2

Found while preparing the v2.12.0 release notes (#2764).

Problem

npm run release:notes (scripts/release-notes.mjs, #2550) has no way to put security advisories in a release's notes. This leaves two gaps, and v2.12.0 hits both:

  1. Advisory fixes never appear under What's Changed. A GHSA fix lands on v2/main as a Merge commit from fork from the advisory's private fork, not as a PR. releases/generate-notes lists only PRs, so the fix is missing from the generated list. In v2.12.0 that is three fixes: GHSA-q978-78c7-phqw, GHSA-vcc9-3xgm-p9v4 and GHSA-m5pj-3536-3xcp.
  2. Advisory reporters are never thanked. The Thanks section credits the community authors of issues that listed PRs close. An advisory reporter files no issue, so they are left out, and so is their place in the release's Contributors strip.

The workaround right now is a hand-spliced preview: save the helper's output, paste a ### Security fixes section and the reporters in, and create the Release with gh release create --notes-file. That bypasses the helper's version/target guards, which is exactly what #2550 was written to remove. The v1 line's 1.0.3 notes (release) were written by hand in the same shape, and they are the format to match.

Proposal

A repeatable --advisory "<GHSA-id>: <markdown>" option. The markdown is the maintainer's one-line description of the fix. The advisory's own summary describes the vulnerability, not what changed, so it isn't a substitute. For each advisory, the helper:

  • Renders a bullet under a ### Security fixes heading inside What's Changed, ending in the advisory link, matching 1.0.3: * **<desc>** ([GHSA-…](https://github.com/<repo>/security/advisories/GHSA-…)).
  • Credits its reporters from security-advisories/{ghsa_id} credits_detailed, in every credit state. A reporter whose credit is still pending is credited too, which is the maintainer's call for 2.12.0. Each person is merged into the existing Thanks list, one line per person, with the GHSA ids alongside any issue numbers: * @user (#123, GHSA-…). The section is no longer omitted when advisory reporters exist even though no issue reporters do.
  • Checks the advisory covers this release. Fail if no vulnerabilities[].patched_versions names the version being released, since a wrong id would link and credit an unrelated advisory.
  • Warns, but does not fail, while the advisory is a draft. Its link 404s until it is published. The intended order is to publish the Release and then the advisories, so this is a reminder rather than an error.

The same fail-fast rule applies: a failed advisory lookup aborts the run, and is never skipped and never read as "no reporters".

Optional, and fine to split off: a generic --section "<markdown>" for the hand-written "New configuration" block that 1.0.3 and 2.12.0 both carry.

Acceptance

  • --advisory renders the Security fixes bullets and links, and credits reporters in all credit states, merged with issue reporters
  • Fails when the advisory does not list the release version as patched; warns when it is a draft
  • An advisory lookup failure aborts the run
  • scripts/release-notes.test.mjs covers each branch; the release skill's step 3a documents the option
  • Previewing --version 2.12.0 with that release's three advisories reproduces its published security section and Thanks list
Lenguaje dominante
TypeScript
Estrellas
11.1k
Forks
1.6k
Merge medio
5 h 32 min
PR fusionados (30 d)
153

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/inspector

Todos los issues de modelcontextprotocol/inspector

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.