Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

release:notes: add --advisory to list GHSA fixes and credit their reporters

Đang mở
  • Có gì không ổn?
#2,766 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
54/100
Loại issue
Tính năng
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github, node.js, typescript
Lĩnh vực
release

Hướng nghiên cứu

Start with scripts/release-notes.mjs and its tests in scripts/release-notes.test.mjs; read the release skill’s step 3a for the documented workflow. Trace how the helper gathers release notes and contributor credits, then implement and test --advisory lookup, validation, draft warnings, security bullets, and reporter merging. Done when the acceptance cases pass and previewing version 2.12.0 reproduces its published security section and Thanks list.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

enhancement v2

Found while preparing the v2.12.0 release notes (#2764).

Problem

npm run release:notes (scripts/release-notes.mjs, #2550) has no way to put security advisories in a release's notes. This leaves two gaps, and v2.12.0 hits both:

  1. Advisory fixes never appear under What's Changed. A GHSA fix lands on v2/main as a Merge commit from fork from the advisory's private fork, not as a PR. releases/generate-notes lists only PRs, so the fix is missing from the generated list. In v2.12.0 that is three fixes: GHSA-q978-78c7-phqw, GHSA-vcc9-3xgm-p9v4 and GHSA-m5pj-3536-3xcp.
  2. Advisory reporters are never thanked. The Thanks section credits the community authors of issues that listed PRs close. An advisory reporter files no issue, so they are left out, and so is their place in the release's Contributors strip.

The workaround right now is a hand-spliced preview: save the helper's output, paste a ### Security fixes section and the reporters in, and create the Release with gh release create --notes-file. That bypasses the helper's version/target guards, which is exactly what #2550 was written to remove. The v1 line's 1.0.3 notes (release) were written by hand in the same shape, and they are the format to match.

Proposal

A repeatable --advisory "<GHSA-id>: <markdown>" option. The markdown is the maintainer's one-line description of the fix. The advisory's own summary describes the vulnerability, not what changed, so it isn't a substitute. For each advisory, the helper:

  • Renders a bullet under a ### Security fixes heading inside What's Changed, ending in the advisory link, matching 1.0.3: * **<desc>** ([GHSA-…](https://github.com/<repo>/security/advisories/GHSA-…)).
  • Credits its reporters from security-advisories/{ghsa_id} credits_detailed, in every credit state. A reporter whose credit is still pending is credited too, which is the maintainer's call for 2.12.0. Each person is merged into the existing Thanks list, one line per person, with the GHSA ids alongside any issue numbers: * @user (#123, GHSA-…). The section is no longer omitted when advisory reporters exist even though no issue reporters do.
  • Checks the advisory covers this release. Fail if no vulnerabilities[].patched_versions names the version being released, since a wrong id would link and credit an unrelated advisory.
  • Warns, but does not fail, while the advisory is a draft. Its link 404s until it is published. The intended order is to publish the Release and then the advisories, so this is a reminder rather than an error.

The same fail-fast rule applies: a failed advisory lookup aborts the run, and is never skipped and never read as "no reporters".

Optional, and fine to split off: a generic --section "<markdown>" for the hand-written "New configuration" block that 1.0.3 and 2.12.0 both carry.

Acceptance

  • --advisory renders the Security fixes bullets and links, and credits reporters in all credit states, merged with issue reporters
  • Fails when the advisory does not list the release version as patched; warns when it is a draft
  • An advisory lookup failure aborts the run
  • scripts/release-notes.test.mjs covers each branch; the release skill's step 3a documents the option
  • Previewing --version 2.12.0 with that release's three advisories reproduces its published security section and Thanks list
Ngôn ngữ chính
TypeScript
Star
11.1k
Fork
1.6k
Merge trung bình
5 giờ 29 phút
Pull request đã merge (30 ngày)
158

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của modelcontextprotocol/inspector

Tất cả issue của modelcontextprotocol/inspector

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.