release:notes: add --advisory to list GHSA fixes and credit their reporters

已关闭
  • 哪里不对？
#2,766 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@cliffhall 已经在做这个了。

开始于 2026年10月25日。

  • #2788 来自 @cliffhall —— 已合并

评估

难度
4/5
预计耗时
3-5 天
新手友好度
54/100
Issue 类型
功能
描述清晰度
描述清楚
活跃度
活跃
技术栈
github, node.js, typescript
领域
release

调研方向

Start with scripts/release-notes.mjs and its tests in scripts/release-notes.test.mjs; read the release skill’s step 3a for the documented workflow. Trace how the helper gathers release notes and contributor credits, then implement and test --advisory lookup, validation, draft warnings, security bullets, and reporter merging. Done when the acceptance cases pass and previewing version 2.12.0 reproduces its published security section and Thanks list.

由索引模型根据 Issue 内容生成。

描述

enhancement v2

Found while preparing the v2.12.0 release notes (#2764).

Problem

npm run release:notes (scripts/release-notes.mjs, #2550) has no way to put security advisories in a release's notes. This leaves two gaps, and v2.12.0 hits both:

  1. Advisory fixes never appear under What's Changed. A GHSA fix lands on v2/main as a Merge commit from fork from the advisory's private fork, not as a PR. releases/generate-notes lists only PRs, so the fix is missing from the generated list. In v2.12.0 that is three fixes: GHSA-q978-78c7-phqw, GHSA-vcc9-3xgm-p9v4 and GHSA-m5pj-3536-3xcp.
  2. Advisory reporters are never thanked. The Thanks section credits the community authors of issues that listed PRs close. An advisory reporter files no issue, so they are left out, and so is their place in the release's Contributors strip.

The workaround right now is a hand-spliced preview: save the helper's output, paste a ### Security fixes section and the reporters in, and create the Release with gh release create --notes-file. That bypasses the helper's version/target guards, which is exactly what #2550 was written to remove. The v1 line's 1.0.3 notes (release) were written by hand in the same shape, and they are the format to match.

Proposal

A repeatable --advisory "<GHSA-id>: <markdown>" option. The markdown is the maintainer's one-line description of the fix. The advisory's own summary describes the vulnerability, not what changed, so it isn't a substitute. For each advisory, the helper:

  • Renders a bullet under a ### Security fixes heading inside What's Changed, ending in the advisory link, matching 1.0.3: * **<desc>** ([GHSA-…](https://github.com/<repo>/security/advisories/GHSA-…)).
  • Credits its reporters from security-advisories/{ghsa_id} credits_detailed, in every credit state. A reporter whose credit is still pending is credited too, which is the maintainer's call for 2.12.0. Each person is merged into the existing Thanks list, one line per person, with the GHSA ids alongside any issue numbers: * @user (#123, GHSA-…). The section is no longer omitted when advisory reporters exist even though no issue reporters do.
  • Checks the advisory covers this release. Fail if no vulnerabilities[].patched_versions names the version being released, since a wrong id would link and credit an unrelated advisory.
  • Warns, but does not fail, while the advisory is a draft. Its link 404s until it is published. The intended order is to publish the Release and then the advisories, so this is a reminder rather than an error.

The same fail-fast rule applies: a failed advisory lookup aborts the run, and is never skipped and never read as "no reporters".

Optional, and fine to split off: a generic --section "<markdown>" for the hand-written "New configuration" block that 1.0.3 and 2.12.0 both carry.

Acceptance

  • --advisory renders the Security fixes bullets and links, and credits reporters in all credit states, merged with issue reporters
  • Fails when the advisory does not list the release version as patched; warns when it is a draft
  • An advisory lookup failure aborts the run
  • scripts/release-notes.test.mjs covers each branch; the release skill's step 3a documents the option
  • Previewing --version 2.12.0 with that release's three advisories reproduces its published security section and Thanks list
主要语言
TypeScript
星标
11.2k
派生
1.6k
平均合并
4 小时 49 分钟
30 天内合并 PR
139

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/inspector 的其他 Issue

查看 modelcontextprotocol/inspector 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。