release:notes: add --advisory to list GHSA fixes and credit their reporters
メンテナーはふだん 1 日以内に返信
評価
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 初心者へのやさしさ
- 54/100
- issue の種類
- 機能追加
- 明瞭さ
- 明確に書かれている
- 活発さ
- 活発
- 技術スタック
- github, node.js, typescript
- 領域
- release
調査の方向性
Start with scripts/release-notes.mjs and its tests in scripts/release-notes.test.mjs; read the release skill’s step 3a for the documented workflow. Trace how the helper gathers release notes and contributor credits, then implement and test --advisory lookup, validation, draft warnings, security bullets, and reporter merging. Done when the acceptance cases pass and previewing version 2.12.0 reproduces its published security section and Thanks list.
索引モデルが issue の本文から書いたものです。
説明
Found while preparing the v2.12.0 release notes (#2764).
Problem
npm run release:notes (scripts/release-notes.mjs, #2550) has no way to put security advisories in a release's notes. This leaves two gaps, and v2.12.0 hits both:
- Advisory fixes never appear under What's Changed. A GHSA fix lands on
v2/mainas a Merge commit from fork from the advisory's private fork, not as a PR.releases/generate-noteslists only PRs, so the fix is missing from the generated list. In v2.12.0 that is three fixes: GHSA-q978-78c7-phqw, GHSA-vcc9-3xgm-p9v4 and GHSA-m5pj-3536-3xcp. - Advisory reporters are never thanked. The Thanks section credits the community authors of issues that listed PRs close. An advisory reporter files no issue, so they are left out, and so is their place in the release's Contributors strip.
The workaround right now is a hand-spliced preview: save the helper's output, paste a ### Security fixes section and the reporters in, and create the Release with gh release create --notes-file. That bypasses the helper's version/target guards, which is exactly what #2550 was written to remove. The v1 line's 1.0.3 notes (release) were written by hand in the same shape, and they are the format to match.
Proposal
A repeatable --advisory "<GHSA-id>: <markdown>" option. The markdown is the maintainer's one-line description of the fix. The advisory's own summary describes the vulnerability, not what changed, so it isn't a substitute. For each advisory, the helper:
- Renders a bullet under a
### Security fixesheading inside What's Changed, ending in the advisory link, matching 1.0.3:* **<desc>** ([GHSA-…](https://github.com/<repo>/security/advisories/GHSA-…)). - Credits its reporters from
security-advisories/{ghsa_id}credits_detailed, in every credit state. A reporter whose credit is stillpendingis credited too, which is the maintainer's call for 2.12.0. Each person is merged into the existing Thanks list, one line per person, with the GHSA ids alongside any issue numbers:* @user (#123, GHSA-…). The section is no longer omitted when advisory reporters exist even though no issue reporters do. - Checks the advisory covers this release. Fail if no
vulnerabilities[].patched_versionsnames the version being released, since a wrong id would link and credit an unrelated advisory. - Warns, but does not fail, while the advisory is a
draft. Its link 404s until it is published. The intended order is to publish the Release and then the advisories, so this is a reminder rather than an error.
The same fail-fast rule applies: a failed advisory lookup aborts the run, and is never skipped and never read as "no reporters".
Optional, and fine to split off: a generic --section "<markdown>" for the hand-written "New configuration" block that 1.0.3 and 2.12.0 both carry.
Acceptance
-
--advisoryrenders the Security fixes bullets and links, and credits reporters in all credit states, merged with issue reporters - Fails when the advisory does not list the release version as patched; warns when it is a draft
- An advisory lookup failure aborts the run
-
scripts/release-notes.test.mjscovers each branch; thereleaseskill's step 3a documents the option - Previewing
--version 2.12.0with that release's three advisories reproduces its published security section and Thanks list
- 主要言語
- TypeScript
- スター
- 11.1k
- フォーク
- 1.6k
- 平均マージ
- 4時間 56分
- マージ済み PR（30日）
- 155
環境構築
- Dockerfile または Docker Compose ファイルあり
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
modelcontextprotocol/inspector のほかの issue
-
難易度 1/5 1時間未満 初心者へのやさしさ 90/100
modelcontextprotocol/inspector#2810 ·
メンテナーはふだん 1 日以内に返信
-
local:gate cannot pass on Windows — pre-existing failures in test:scripts, coverage:web and coverage:mcpdo対応中かも @olaservo が今日担当しました。 オープンbug v2
難易度 4/5 3〜5日 初心者へのやさしさ 45/100
modelcontextprotocol/inspector#2748 · 担当者 1 名 ·
メンテナーはふだん 1 日以内に返信
-
blocked chore v2
難易度 4/5 3〜5日 初心者へのやさしさ 48/100
modelcontextprotocol/inspector#2548 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信
-
blocked chore v2
難易度 4/5 3〜5日 初心者へのやさしさ 52/100
modelcontextprotocol/inspector#2547 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信
-
Create the GitHub App for board writes and security-alert reads, and store its credentials as org secrets対応中かも @cliffhall が 5 日前に担当しました。 オープンchore v2
難易度 4/5 3〜5日 初心者へのやさしさ 35/100
modelcontextprotocol/inspector#2544 · コメント 1 件 · 担当者 1 名 ·
メンテナーはふだん 1 日以内に返信
modelcontextprotocol/inspector の issue をすべて見る
似ている issue
-
[Bug]: Device screenshot fails with 500 on iPhone Duo (Xcode 27.2): serve-sim calls simctl without --display対応中かも このイシューにリンクされたプルリクエストがオープン中、またはマージ済みです。 オープン
難易度 2/5 1〜3時間 初心者へのやさしさ 66/100
pingdotgg/t3code#24900 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
inu-appcenter/UNIDorm-web#411 ·
メンテナーはふだん 1 日以内に返信
-
🐛 bug
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
メンテナーはふだん 2 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 75/100
ranxianglei/billion-context#4720 ·
メンテナーはふだん 1 日以内に返信
-
area:arcade game p3-medium ready-for-agent type:bug
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
fderuiter/deruiter.dev#2840 ·
メンテナーはふだん 1 日以内に返信