@node-core/utils 5.3.0 → 5.3.1

package/components/git/security.js

@@ -79,7 +79,7 @@ export function builder(yargs) {
       'Request CVEs for a security release of Node.js based on' +
       ' the next-security-release/vulnerabilities.json'
     ).example(
-      'git node security --post-release' +
+      'git node security --post-release',
       'Create the post-release announcement on the Nodejs.org repo'
     );
 }

package/lib/prepare_release.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { promises as fs } from 'node:fs';
 
 import semver from 'semver';
-import replace from 'replace-in-file';
+import { replaceInFile } from 'replace-in-file';
 
 import { getMergedConfig } from './config.js';
 import { runAsync, runSync } from './run.js';
@@ -427,7 +427,7 @@ export default class ReleasePreparation {
   async updateREPLACEMEs() {
     const { newVersion } = this;
 
-    await replace({
+    await replaceInFile({
       files: 'doc/api/*.md',
       from: /REPLACEME/g,
       to: `v${newVersion}`

package/lib/security-announcement.js

@@ -53,7 +53,7 @@ export default class SecurityAnnouncement {
     };
 
     const { title, content } = this.createPreleaseAnnouncementIssue(releaseDate, 'build');
-    await this.createIssue(title, content, repository);
+    await createIssue(title, content, repository, { cli: this.cli, req: this.req });
   }
 
   createPreleaseAnnouncementIssue(releaseDate, team) {
@@ -71,6 +71,6 @@ export default class SecurityAnnouncement {
     };
 
     const { title, content } = this.createPreleaseAnnouncementIssue(releaseDate, 'docker');
-    await createIssue(title, content, repository, { cli: this.cli, repository: this.repository });
+    await createIssue(title, content, repository, { cli: this.cli, req: this.req });
   }
 }

package/lib/security_blog.js

@@ -8,7 +8,6 @@ import {
   checkoutOnSecurityReleaseBranch,
   NEXT_SECURITY_RELEASE_REPOSITORY,
   validateDate,
-  getSummary,
   commitAndPushVulnerabilitiesJSON,
   NEXT_SECURITY_RELEASE_FOLDER
 } from './security-release/security-release.js';
@@ -84,6 +83,7 @@ export default class SecurityBlog {
     const releaseDate = new Date(content.releaseDate);
     const template = this.getSecurityPostReleaseTemplate();
     const data = {
+      // TODO: read from pre-sec-release
       annoucementDate: await this.getAnnouncementDate(cli),
       releaseDate: this.formatReleaseDate(releaseDate),
       affectedVersions: this.getAffectedVersions(content),
@@ -205,46 +205,25 @@ export default class SecurityBlog {
     const reports = content.reports;
     let template = '';
     for (const report of reports) {
-      let cveId = report.cve_ids?.join(', ');
+      const cveId = report.cveIds?.join(', ');
       if (!cveId) {
-        // ask for the CVE ID
-        // it should have been created with the step `--request-cve`
-        cveId = await this.cli.prompt(`What is the CVE ID for vulnerability https://hackerone.com/reports/${report.id} ${report.title}?`, {
-          questionType: 'input',
-          defaultAnswer: 'TBD'
-        });
-        report.cve_ids = [cveId];
-        content[kChanged] = true;
+        this.cli.error(`CVE ID for vulnerability ${report.link} ${report.title} not found`);
+        process.exit(1);
       }
       template += `## ${report.title} (${cveId}) - (${report.severity.rating})\n\n`;
       if (!report.summary) {
-        const fetchIt = await this.cli.prompt(`Summary missing for vulnerability https://hackerone.com/reports/${report.id} ${report.title}.\
- Do you want to try fetch it from HackerOne??`, {
-          questionType: 'confirm',
-          defaultAnswer: true
-        });
-
-        if (fetchIt) {
-          report.summary = await getSummary(report.id, this.req);
-          content[kChanged] = true;
-        }
-
-        if (!report.summary) {
-          this.cli.error(`Summary missing for vulnerability https://hackerone.com/reports/${report.id} ${report.title}. Please create it before continuing.`);
-          process.exit(1);
-        }
+        this.cli.error(`Summary missing for vulnerability ${report.link} ` +
+        `${report.title}. Please create it before continuing.`);
+        process.exit(1);
       }
+
       template += `${report.summary}\n\n`;
       const releaseLines = report.affectedVersions.join(', ');
       template += `Impact:\n\n- This vulnerability affects all users\
  in active release lines: ${releaseLines}\n\n`;
       if (!report.patchAuthors) {
-        const author = await this.cli.prompt(`Who fixed vulnerability https://hackerone.com/reports/${report.id} ${report.title}? If multiple use & as separator`, {
-          questionType: 'input',
-          defaultAnswer: 'TBD'
-        });
-        report.patchAuthors = author.split('&').map((p) => p.trim());
-        content[kChanged] = true;
+        this.cli.error(`Missing patch author for vulnerability ${report.link} ${report.title}`);
+        process.exit(1);
       }
       template += `Thank you, to ${report.reporter} for reporting this vulnerability\
  and thank you ${report.patchAuthors.join(' and ')} for fixing it.\n\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node-core/utils",
-  "version": "5.3.0",
+  "version": "5.3.1",
   "description": "Utilities for Node.js core collaborators",
   "type": "module",
   "engines": {
@@ -34,8 +34,8 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@listr2/prompt-adapter-enquirer": "^2.0.8",
-    "@node-core/caritat": "^1.3.1",
+    "@listr2/prompt-adapter-enquirer": "^2.0.10",
+    "@node-core/caritat": "^1.6.0",
     "@pkgjs/nv": "^0.2.2",
     "branch-diff": "^3.0.4",
     "chalk": "^5.3.0",
@@ -44,26 +44,26 @@
     "clipboardy": "^4.0.0",
     "core-validate-commit": "^4.0.0",
     "figures": "^6.1.0",
-    "ghauth": "^6.0.4",
-    "inquirer": "^9.2.22",
+    "ghauth": "^6.0.5",
+    "inquirer": "^9.3.2",
     "js-yaml": "^4.1.0",
-    "listr2": "^8.2.1",
+    "listr2": "^8.2.3",
     "lodash": "^4.17.21",
     "log-symbols": "^6.0.0",
     "ora": "^8.0.1",
-    "replace-in-file": "^7.1.0",
-    "undici": "^6.18.0",
+    "replace-in-file": "^8.0.2",
+    "undici": "^6.19.2",
     "which": "^4.0.0",
     "yargs": "^17.7.2"
   },
   "devDependencies": {
     "@reporters/github": "^1.7.0",
-    "c8": "^9.1.0",
+    "c8": "^10.1.2",
     "eslint": "^8.57.0",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.29.1",
     "eslint-plugin-n": "^16.6.2",
-    "eslint-plugin-promise": "^6.1.1",
+    "eslint-plugin-promise": "^6.4.0",
     "sinon": "^18.0.0"
   }
 }