Repository navigation
Document OpenJS CNA reservation and publication steps - #67084
Open
UlisesGascon wants to merge 1 commit into
Open
UlisesGascon wants to merge 1 commit into
UlisesGascon wants to merge 1 commit into
Conversation
Collaborator
|
Review requested:
|
This was referenced Oct 28, 2026
ljharb
approved these changes
Oct 28, 2026
When `cve_source` is set to `openjs-cna` in `.ncurc`,
`git node security --request-cve` reserves CVE ids through the OpenJS
Foundation CNA instead of HackerOne. Publication to MITRE is then
handled by the `Publish CVEs` workflow in the
nodejs-private/security-release repository, which runs when the
security release pull request is merged and holds until every patched
version is on nodejs.org/dist.
Update the security release runbook accordingly:
* Note the OpenJS CNA option under 'Requesting CVEs', including the
resume behaviour on supervised buckets.
* Mark 'Request publication of H1 CVE requests' in cleanup as a no-op
under the OpenJS CNA path.
* Add a Post-Release step describing the automatic publication, the
nodejs.org gate, the failure issue and the delay before cve.org.
* Scope the HackerOne form under 'Updating CVEs' to HackerOne-issued
ids and point OpenJS-issued ids at the CNA coordinators.
Refs: openjs-foundation/security-wg#337
Refs: nodejs/node-core-utils#1232
Refs: nodejs-private/security-release#87
Assisted-by: Claude
Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
UlisesGascon
force-pushed
the
doc/openjs-cna-publication
branch
from
November 6, 2026 11:43
47a5add to
53d168a
Compare
UlisesGascon
marked this pull request as ready for review
November 6, 2026 11:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
cve_sourceis set toopenjs-cnain.ncurc,git node security --request-cvereserves CVE ids through the OpenJS Foundation CNA instead of HackerOne. Publication to MITRE is then handled by thePublish CVEsworkflow in the nodejs-private/security-release repository, which runs when the security release pull request is merged and holds until every patched version is on nodejs.org/dist.Update the security release runbook accordingly:
Refs: openjs-foundation/security-wg#337
Refs: nodejs/node-core-utils#1232
Refs: https://github.com/nodejs-private/security-release/pull/87
Assisted-by: Claude