fix(cve-alerts): allow a major bump when it is the only fix

Merged
CL
1d ago
+6-4

Requested by Nikolas Garza · Slack thread

Description

Before: When the only fix for an advisory was a new major version, the CVE Alerts workflow changed nothing. It left the issue open for a manual bump.

After: In that case the workflow bumps to the lowest fixed release of the lowest major that has one, and starts the note with "MAJOR bump". The reviewer then checks the PR for breaking changes.

This change lets the CVE Alerts workflow open a fix PR for a major version bump when no fix exists on the current major line.

How: The rule lived only in the triage prompt, .github/prompts/cve-fix.md, so only that file changes. The workflow and cve-check-manifests.ts do not check major versions. The PR body already includes Claude's note, so the "MAJOR bump" flag shows in the PR. The motivating case is pillow 12.3.0 for GHSA-8g5g-8vmr-9782. The only fix is 13.0.0, so the workflow changed nothing and left issue #16335 (see PR #16342).

How Has This Been Tested?

I checked that no other workflow or script code enforces the old rule. I did not run the workflow. The pre-commit hooks could not run in my environment because the shellcheck_py build failed.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Generated by Claude Code

Summary by cubic

Allows the CVE Alerts workflow to open a fix PR for a major version bump when no fix exists on the current major line.

Previously, when the only fix for an advisory was a new major version, the workflow changed nothing and left the issue open for a manual bump. Now it bumps to the lowest fixed release of the lowest major that has one and starts the note with "MAJOR bump" so the reviewer checks the PR for breaking changes. This change only touches the triage prompt in .github/prompts/cve-fix.md; no workflow or script code enforces the old rule. The motivating case is pillow 12.3.0 for GHSA-8g5g-8vmr-9782, whose only fix is 13.0.0.

Summary by CodeRabbit

  • Documentation
    • Updated vulnerability remediation guidance to prioritize fixed versions within the newest pinned major release.
    • Added guidance for selecting and documenting the lowest available fixed release when a major-version change is required.
    • Expanded unchanged-result reporting to cover cases where no fix is available or a major upgrade is necessary.