fix: adjust changelog on security releases

Author: RafaelGSS

lib/landing_session.js

@@ -398,14 +398,14 @@ export default class LandingSession extends Session {
         if (!cveID) {
           cveID = await cli.prompt(
             'Git found no CVE-ID trailer in the original commit message. ' +
-            'Please, provide the CVE-ID or leave it empty',
-            { questionType: 'input', defaultAnswer: 'CVE-2026-XXXXX' }
+            'Please, provide the CVE-ID (e.g. CVE-2026-12345) or leave it empty',
+            { questionType: 'input', defaultAnswer: '' }
           );
         }
       }
       // Some commits might not address a vulnerability, but it is necessary
       // for the security release to happen.
-      if (cveID !== '') {
+      if (cveID) {
         amended.push('CVE-ID: ' + cveID);
       }
     }

lib/prepare_release.js

@@ -15,7 +15,8 @@ import CherryPick from './cherry_pick.js';
 import Session from './session.js';
 import {
   getAffectedVersionLines,
-  getDependencyUpdates
+  getDependencyUpdates,
+  SEVERITY_RANKS
 } from './security-release/security-release.js';
 
 const isWindows = process.platform === 'win32';
@@ -51,6 +52,34 @@ export function getPullRequestURLForLine(affectedVersions, line, legacyPrURL) {
   return null;
 }
 
+// Format the notable changes of a security release, one entry per commit:
+// `* (CVE-ID) subsystem: title (Author) – Severity`, sorted from highest to
+// lowest severity, then by CVE-ID. Commits without a CVE-ID trailer
+// (e.g. dependency updates) are listed last.
+export function formatSecurityNotableChanges(commits, severityByCVE) {
+  const rank = rating => SEVERITY_RANKS.indexOf((rating || '').toUpperCase());
+  const entries = commits
+    .filter(({ subject }) => subject)
+    .map(({ subject, author, cveIds = [] }) => ({
+      subject,
+      author,
+      cveIds,
+      rating: cveIds.map(id => severityByCVE.get(id)).find(Boolean) || ''
+    }))
+    .sort((a, b) => (rank(b.rating) - rank(a.rating)) ||
+      (b.cveIds.length - a.cveIds.length) ||
+      (a.cveIds[0] || '').localeCompare(b.cveIds[0] || '', 'en', { numeric: true }));
+
+  const lines = entries.map(({ subject, author, cveIds, rating }) => {
+    const cve = cveIds.length ? `(${cveIds.join(', ')}) ` : '';
+    const severity = rating
+      ? ` – ${rating[0].toUpperCase()}${rating.slice(1).toLowerCase()}`
+      : '';
+    return `* ${cve}${subject} (${author})${severity}`;
+  });
+  return lines.length ? `${lines.join('\n')}\n` : '';
+}
+
 export default class ReleasePreparation extends Session {
   constructor(argv, cli, dir) {
     super(cli, dir);
@@ -137,7 +166,12 @@ export default class ReleasePreparation extends Session {
       const url = getPullRequestURLForLine(
         dep.affectedVersions, line, dep.prURL);
       if (url) {
-        targets.push({ url, cveIds: null, label: `dependency: ${dep.name}` });
+        targets.push({
+          url,
+          cveIds: null,
+          label: `dependency: ${dep.name}`,
+          isDependency: true
+        });
       }
     }
 
@@ -197,7 +231,7 @@ export default class ReleasePreparation extends Session {
         amendAll = answer === 'all';
       }
 
-      if (!target.cveIds) {
+      if (!target.cveIds && !target.isDependency) {
         cli.warn(`No CVE-IDs found in vulnerabilities.json for ${target.url}`);
       }
 
@@ -208,7 +242,7 @@ export default class ReleasePreparation extends Session {
         gpgSign: this.gpgSign,
         upstream: this.upstreamForPR(pr),
         lint: false,
-        includeCVE: true,
+        includeCVE: !target.isDependency,
         cveIds: target.cveIds,
         promptAmend: false,
         skipMessagePrompt: amendAll
@@ -553,10 +587,12 @@ export default class ReleasePreparation extends Session {
     const data = await fs.readFile(majorChangelogPath, 'utf8');
     const arr = data.split('\n');
     const allCommits = this.getChangelog();
-    const notableChanges = await this.getBranchDiff({
-      onlyNotableChanges: true,
-      format: isSecurityRelease ? 'messageonly' : 'markdown',
-    });
+    const notableChanges = isSecurityRelease
+      ? await this.getSecurityNotableChanges()
+      : await this.getBranchDiff({
+        onlyNotableChanges: true,
+        format: 'markdown',
+      });
     let releaseHeader = `## ${date}, Version ${newVersion}` +
                           ` ${releaseInfo}, @${username}\n`;
     if (isSecurityRelease) {
@@ -692,10 +728,12 @@ export default class ReleasePreparation extends Session {
       messageBody.push('This is a security release.\n\n');
     }
 
-    const notableChanges = await this.getBranchDiff({
-      onlyNotableChanges: true,
-      format: isSecurityRelease ? 'messageonly' : 'plaintext'
-    });
+    const notableChanges = isSecurityRelease
+      ? await this.getSecurityNotableChanges()
+      : await this.getBranchDiff({
+        onlyNotableChanges: true,
+        format: 'plaintext'
+      });
     messageBody.push('Notable changes:\n\n');
     if (isLTSTransition) {
       messageBody.push(`${getStartLTSBlurb(this)}\n\n`);
@@ -718,6 +756,48 @@ export default class ReleasePreparation extends Session {
     return useMessage;
   }
 
+  // Build the notable changes of a security release from the commits
+  // cherry-picked onto the proposal branch and the severity ratings in
+  // vulnerabilities.json.
+  async getSecurityNotableChanges() {
+    const { upstream, versionComponents } = this;
+    const releaseBranch = `v${versionComponents.major}.x`;
+
+    await forceRunAsync('git', ['remote', 'set-branches', '--add', upstream, releaseBranch], {
+      ignoreFailures: false
+    });
+    await forceRunAsync('git', ['fetch', upstream, releaseBranch], { ignoreFailures: false });
+
+    const severityByCVE = new Map();
+    const vulnPath = this.getVulnerabilitiesJSONPath();
+    if (vulnPath && existsSync(vulnPath)) {
+      const { reports } = JSON.parse(readFileSync(vulnPath, 'utf-8'));
+      for (const report of reports ?? []) {
+        for (const cveId of report.cveIds ?? []) {
+          severityByCVE.set(cveId, report.severity?.rating);
+        }
+      }
+    }
+
+    const log = runSync('git', [
+      'log',
+      '--format=%s%x1f%an%x1f%(trailers:key=CVE-ID,valueonly,separator=%x2C)%x1e',
+      `${upstream}/${releaseBranch}..HEAD`
+    ]);
+    const commits = log.split('\x1e').map(record => {
+      const [subject, author, cveIds] = record.trim().split('\x1f');
+      return {
+        subject,
+        author,
+        // Ignore placeholder trailers such as CVE-2026-XXXXX.
+        cveIds: (cveIds || '').split(',')
+          .map(id => id.trim())
+          .filter(id => /^CVE-\d{4}-\d+$/.test(id))
+      };
+    });
+    return formatSecurityNotableChanges(commits, severityByCVE);
+  }
+
   async getBranchDiff(opts) {
     const {
       cli,

lib/security-release/security-release.js

@@ -11,7 +11,7 @@ export const NEXT_SECURITY_RELEASE_REPOSITORY = {
   repo: 'security-release'
 };
 
-const SEVERITY_RANKS = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+export const SEVERITY_RANKS = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
 const RELEASE_LINE_RE = /^v?(\d+)(?:\.x)?$/;
 const SEMVER_RE = /^v?(\d+)\.\d+\.\d+/;
 

test/unit/prepare_release.test.js

@@ -5,7 +5,8 @@ import { readFileSync } from 'node:fs';
 import * as utils from '../../lib/release/utils.js';
 import {
   parsePullRequestURL,
-  getPullRequestURLForLine
+  getPullRequestURLForLine,
+  formatSecurityNotableChanges
 } from '../../lib/prepare_release.js';
 
 describe('prepare_release: utils.getEOLDate', () => {
@@ -136,3 +137,70 @@ describe('prepare_release: getPullRequestURLForLine', () => {
     assert.strictEqual(getPullRequestURLForLine(null, '22.x'), null);
   });
 });
+
+describe('prepare_release: formatSecurityNotableChanges', () => {
+  it('sorts by severity then CVE-ID and formats each entry', () => {
+    const severityByCVE = new Map([
+      ['CVE-2026-48933', 'high'],
+      ['CVE-2026-48618', 'high'],
+      ['CVE-2026-48615', 'medium'],
+      ['CVE-2026-48617', 'low']
+    ]);
+    const commits = [
+      {
+        subject: 'permission: handle process.chdir on writereport',
+        author: 'RafaelGSS',
+        cveIds: ['CVE-2026-48617']
+      },
+      {
+        subject: 'lib,test: redact proxy credentials in tunnel errors',
+        author: 'Matteo Collina',
+        cveIds: ['CVE-2026-48615']
+      },
+      {
+        subject: 'crypto: guard WebCrypto cipher output length',
+        author: 'Filip Skokan',
+        cveIds: ['CVE-2026-48933']
+      },
+      {
+        subject: 'tls: normalize hostname for server identity checks',
+        author: 'Matteo Collina',
+        cveIds: ['CVE-2026-48618']
+      }
+    ];
+
+    assert.strictEqual(
+      formatSecurityNotableChanges(commits, severityByCVE),
+      '* (CVE-2026-48618) tls: normalize hostname for server identity ' +
+        'checks (Matteo Collina) – High\n' +
+      '* (CVE-2026-48933) crypto: guard WebCrypto cipher output length ' +
+        '(Filip Skokan) – High\n' +
+      '* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel ' +
+        'errors (Matteo Collina) – Medium\n' +
+      '* (CVE-2026-48617) permission: handle process.chdir on writereport ' +
+        '(RafaelGSS) – Low\n'
+    );
+  });
+
+  it('lists commits without a CVE or severity last, without annotations', () => {
+    const severityByCVE = new Map([['CVE-2026-48618', 'HIGH']]);
+    const commits = [
+      { subject: 'deps: update undici to 6.21.2', author: 'Node.js GitHub Bot', cveIds: [] },
+      { subject: 'tls: some fix', author: 'A Contributor', cveIds: ['CVE-2026-1'] },
+      {
+        subject: 'tls: normalize hostname for server identity checks',
+        author: 'Matteo Collina',
+        cveIds: ['CVE-2026-48618']
+      }
+    ];
+
+    assert.strictEqual(
+      formatSecurityNotableChanges(commits, severityByCVE),
+      '* (CVE-2026-48618) tls: normalize hostname for server identity ' +
+        'checks (Matteo Collina) – High\n' +
+      '* (CVE-2026-1) tls: some fix (A Contributor)\n' +
+      '* deps: update undici to 6.21.2 (Node.js GitHub Bot)\n'
+    );
+    assert.strictEqual(formatSecurityNotableChanges([], severityByCVE), '');
+  });
+});