@node-core/utils 6.4.0 → 7.0.0

package/lib/prepare_release.js

@@ -2,12 +2,9 @@ import path from 'node:path';
 import { promises as fs, existsSync, readFileSync } from 'node:fs';
 
 import semver from 'semver';
-import { replaceInFile } from 'replace-in-file';
 
 import { forceRunAsync, runAsync, runSync } from './run.js';
 import { writeJson, readJson } from './file.js';
-import Request from './request.js';
-import auth from './auth.js';
 import {
   getEOLDate,
   getStartLTSBlurb,
@@ -15,9 +12,73 @@ import {
 } from './release/utils.js';
 import CherryPick from './cherry_pick.js';
 import Session from './session.js';
+import {
+  getAffectedVersionLines,
+  getDependencyUpdates,
+  SEVERITY_RANKS
+} from './security-release/security-release.js';
 
 const isWindows = process.platform === 'win32';
 
+// Parse a GitHub Pull Request URL into its owner, repo and number.
+// Returns null when the URL does not look like a PR URL.
+export function parsePullRequestURL(url) {
+  const match = /github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/.exec(url || '');
+  if (!match) return null;
+  return { owner: match[1], repo: match[2], number: Number(match[3]) };
+}
+
+// Resolve the PR URL that fixes a given release line from a report or
+// dependency `affectedVersions` entry.
+// Supports the current schema, where `affectedVersions` maps a release line to
+// its PR URL (e.g. `{ '22.x': 'https://.../pull/1' }`), and the legacy schema,
+// where `affectedVersions` is an array of lines paired with a single `prURL`.
+export function getPullRequestURLForLine(affectedVersions, line, legacyPrURL) {
+  if (
+    affectedVersions &&
+    typeof affectedVersions === 'object' &&
+    !Array.isArray(affectedVersions)
+  ) {
+    return affectedVersions[line] || null;
+  }
+
+  if (Array.isArray(affectedVersions) && legacyPrURL) {
+    return getAffectedVersionLines(affectedVersions).includes(line)
+      ? legacyPrURL
+      : null;
+  }
+
+  return null;
+}
+
+// Format the notable changes of a security release, one entry per commit:
+// `* (CVE-ID) subsystem: title (Author) – Severity`, sorted from highest to
+// lowest severity, then by CVE-ID. Commits without a CVE-ID trailer
+// (e.g. dependency updates) are listed last.
+export function formatSecurityNotableChanges(commits, severityByCVE) {
+  const rank = rating => SEVERITY_RANKS.indexOf((rating || '').toUpperCase());
+  const entries = commits
+    .filter(({ subject }) => subject)
+    .map(({ subject, author, cveIds = [] }) => ({
+      subject,
+      author,
+      cveIds,
+      rating: cveIds.map(id => severityByCVE.get(id)).find(Boolean) || ''
+    }))
+    .sort((a, b) => (rank(b.rating) - rank(a.rating)) ||
+      (b.cveIds.length - a.cveIds.length) ||
+      (a.cveIds[0] || '').localeCompare(b.cveIds[0] || '', 'en', { numeric: true }));
+
+  const lines = entries.map(({ subject, author, cveIds, rating }) => {
+    const cve = cveIds.length ? `(${cveIds.join(', ')}) ` : '';
+    const severity = rating
+      ? ` – ${rating[0].toUpperCase()}${rating.slice(1).toLowerCase()}`
+      : '';
+    return `* ${cve}${subject} (${author})${severity}`;
+  });
+  return lines.length ? `${lines.join('\n')}\n` : '';
+}
+
 export default class ReleasePreparation extends Session {
   constructor(argv, cli, dir) {
     super(cli, dir);
@@ -32,101 +93,162 @@ export default class ReleasePreparation extends Session {
     this.defaultReleaseDate = argv.releaseDate ?? new Date().toISOString().slice(0, 10);
     this.ltsCodename = '';
     this.date = '';
-    this.filterLabels = argv.filterLabel && argv.filterLabel.split(',');
     this.newVersion = argv.newVersion;
   }
 
   get branch() {
-    return this.stagingBranch;
+    return this.isSecurityRelease ? this.releaseBranch : this.stagingBranch;
+  }
+
+  // Resolve the path to the security release vulnerabilities.json.
+  // `--security` may point either directly at a vulnerabilities.json file or at
+  // the root of the security-release repository, in which case the well-known
+  // sub-path is appended.
+  getVulnerabilitiesJSONPath() {
+    if (!this.securityReleaseRepo) return null;
+    if (this.securityReleaseRepo.endsWith('.json')) {
+      return this.securityReleaseRepo;
+    }
+    return path.join(
+      this.securityReleaseRepo,
+      'security-release',
+      'next-security-release',
+      'vulnerabilities.json'
+    );
   }
 
-  warnForNonMergeablePR(pr) {
+  loadVulnerabilitiesJSON() {
     const { cli } = this;
+    const vulnPath = this.getVulnerabilitiesJSONPath();
+
+    if (!vulnPath) {
+      cli.error('No vulnerabilities.json path provided. Pass the path to ' +
+        'vulnerabilities.json (or the security-release repository) via ' +
+        '`--security=<path>`.');
+      return null;
+    }
 
-    cli.warn(`PR#${pr.number} - ${pr.title} is not 'MERGEABLE'.
-      Status: ${pr.mergeable}`);
+    if (!existsSync(vulnPath)) {
+      cli.error(`vulnerabilities.json not found at ${vulnPath}.`);
+      return null;
+    }
+
+    try {
+      cli.startSpinner(`Reading vulnerabilities.json from ${vulnPath}..`);
+      const vulnData = JSON.parse(readFileSync(vulnPath, 'utf-8'));
+      cli.stopSpinner(`Done reading vulnerabilities.json from ${vulnPath}`);
+      return vulnData;
+    } catch (err) {
+      cli.error(`Failed to read vulnerabilities.json: ${err.message}`);
+      return null;
+    }
   }
 
-  async getOpenPRs(filterLabels) {
-    const credentials = await auth({ github: true });
-    const request = new Request(credentials);
-    const data = await request.gql('PRs', {
-      owner: this.owner,
-      repo: this.repo,
-      labels: filterLabels
-    });
-    return data.repository.pullRequests.nodes;
+  // Build the list of PRs to cherry-pick for a given release line from both the
+  // reports and the dependency updates, using their `affectedVersions` mapping.
+  getSecurityCherryPickTargets(vulnData, line) {
+    const targets = [];
+
+    for (const report of vulnData.reports ?? []) {
+      const url = getPullRequestURLForLine(
+        report.affectedVersions, line, report.prURL);
+      if (url) {
+        targets.push({
+          url,
+          cveIds: report.cveIds?.length ? report.cveIds : null,
+          label: report.title || report.id
+        });
+      }
+    }
+
+    for (const dep of getDependencyUpdates(vulnData.dependencies)) {
+      const url = getPullRequestURLForLine(
+        dep.affectedVersions, line, dep.prURL);
+      if (url) {
+        targets.push({
+          url,
+          cveIds: null,
+          label: `dependency: ${dep.name}`,
+          isDependency: true
+        });
+      }
+    }
+
+    return targets;
   }
 
-  async cherryPickSecurityPRs(filterLabels) {
+  upstreamForPR({ owner, repo }) {
+    if (owner === 'nodejs-private') {
+      return `https://${this.username}:${this.config.token}` +
+        `@github.com/${owner}/${repo}.git`;
+    }
+    return `https://github.com/${owner}/${repo}.git`;
+  }
+
+  async cherryPickSecurityPRs() {
     const { cli } = this;
+    const line = `${this.versionComponents.major}.x`;
 
-    const prs = await this.getOpenPRs(filterLabels);
-    if (prs.length === 0) {
-      cli.warn(`There are no PRs available in ${this.owner}/${this.repo}`);
+    const vulnData = this.loadVulnerabilitiesJSON();
+    if (!vulnData) {
+      cli.error('Cannot proceed with a security release without a valid ' +
+        'vulnerabilities.json.');
       return false;
     }
 
-    const vulnCveMap = new Map();
-    if (this.isSecurityRelease && this.securityReleaseRepo) {
-      const vulnPath = path.join(
-        this.securityReleaseRepo,
-        'security-release',
-        'next-security-release',
-        'vulnerabilities.json'
-      );
-
-      if (!existsSync(vulnPath)) {
-        cli.error(`vulnerabilities.json not found at ${vulnPath}. ` +
-          'Skipping CVE auto-population.');
-        cli.warn('PRs will require manual CVE-ID entry.');
-      } else {
-        try {
-          cli.startSpinner(`Reading vulnerabilities.json from ${vulnPath}..`);
-          const vulnData = JSON.parse(readFileSync(vulnPath, 'utf-8'));
-          cli.stopSpinner(`Done reading vulnerabilities.json from ${vulnPath}`);
-
-          if (vulnData.reports && Array.isArray(vulnData.reports)) {
-            vulnData.reports.forEach(report => {
-              if (report.prURL && report.cveIds && report.cveIds.length > 0) {
-                vulnCveMap.set(report.prURL, report.cveIds);
-              }
-            });
-          }
-          cli.ok(`Loaded ${vulnCveMap.size} CVE mappings from vulnerabilities.json`);
-        } catch (err) {
-          cli.error(`Failed to read vulnerabilities.json: ${err.message}`);
-          cli.warn('Continuing without CVE auto-population.');
-        }
-      }
+    const targets = this.getSecurityCherryPickTargets(vulnData, line);
+    if (targets.length === 0) {
+      cli.warn(`No PRs found in vulnerabilities.json for release line ${line}.`);
+      return false;
     }
 
-    for (const pr of prs) {
-      if (pr.mergeable !== 'MERGEABLE') {
-        this.warnForNonMergeablePR(pr);
+    cli.info(`Cherry-picking ${targets.length} PR(s) for ${line} from ` +
+      'vulnerabilities.json');
+
+    let amendAll = false;
+
+    for (const target of targets) {
+      const pr = parsePullRequestURL(target.url);
+      if (!pr) {
+        cli.warn(`Skipping invalid PR URL for ${target.label}: ${target.url}`);
+        continue;
       }
 
-      // Look up CVE-IDs from vulnerabilities.json
-      const prUrl = `https://github.com/${this.owner}/${this.repo}/pull/${pr.number}`;
-      const cveIds = vulnCveMap.get(prUrl);
+      if (!amendAll) {
+        const answer = await cli.promptSelect(
+          `Would you like to amend ${target.label} (${target.url}) to the proposal?`,
+          [
+            { name: 'Yes', value: 'yes' },
+            { name: 'No, skip this PR', value: 'no' },
+            {
+              name: 'Yes to all remaining PRs (no further prompts)',
+              value: 'all'
+            }
+          ]);
+
+        if (answer === 'no') continue;
+        amendAll = answer === 'all';
+      }
 
-      if (!cveIds || cveIds.length === 0) {
-        cli.warn(`No CVE-IDs found in vulnerabilities.json for ${prUrl}`);
+      if (!target.cveIds && !target.isDependency) {
+        cli.warn(`No CVE-IDs found in vulnerabilities.json for ${target.url}`);
       }
 
+      cli.info(`Cherry-picking ${target.label} (${target.url})`);
       const cp = new CherryPick(pr.number, this.dir, cli, {
-        owner: this.owner,
-        repo: this.repo,
+        owner: pr.owner,
+        repo: pr.repo,
         gpgSign: this.gpgSign,
-        upstream: this.isSecurityRelease ? `https://${this.username}:${this.config.token}@github.com/${this.owner}/${this.repo}.git` : this.upstream,
+        upstream: this.upstreamForPR(pr),
         lint: false,
-        includeCVE: true,
-        cveIds: cveIds || null,
-        vulnCveMap
+        includeCVE: !target.isDependency,
+        cveIds: target.cveIds,
+        promptAmend: false,
+        skipMessagePrompt: amendAll
       });
       const success = await cp.start();
       if (!success) {
-        cli.warn('The cherry-pick has failed. PR-ID: ' + pr.number);
+        cli.warn(`The cherry-pick has failed. PR: ${target.url}`);
         return false;
       }
     }
@@ -147,7 +269,7 @@ export default class ReleasePreparation extends Session {
       { defaultAnswer: this.runBranchDiff });
     if (runBranchDiff) {
       if (isSecurityRelease) {
-        const success = await this.cherryPickSecurityPRs(this.filterLabels);
+        const success = await this.cherryPickSecurityPRs();
         if (!success) {
           cli.error('Aborting security release preparation.');
           return;
@@ -395,11 +517,24 @@ export default class ReleasePreparation extends Session {
   async updateREPLACEMEs() {
     const { newVersion } = this;
 
-    await replaceInFile({
-      files: 'doc/api/*.md',
-      from: /REPLACEME/g,
-      to: `v${newVersion}`
-    });
+    const promises = [];
+    for await (const file of fs.glob('doc/api/*.md')) {
+      promises.push(fs.open(file, 'r+').then(async fd => {
+        try {
+          const fileContent = await fd.readFile('utf-8');
+          if (fileContent.includes('REPLACEME')) {
+            const { bytesWritten } =
+              await fd.write(fileContent.replaceAll('REPLACEME', `v${newVersion}`), 0, 'utf-8');
+            await fd.truncate(bytesWritten);
+          }
+        // eslint-disable-next-line promise/always-return
+        } finally {
+          // TODO: replace with `using` syntax when dropping support for Node.js 22
+          await fd.close();
+        }
+      }));
+    }
+    await Promise.all(promises);
   }
 
   async updateMainChangelog() {
@@ -436,7 +571,7 @@ export default class ReleasePreparation extends Session {
         arr.splice(idx, 1, `<b>${newRefLink}</b><br/>`, `${lastRefLink}<br/>`);
         break;
       }
-    };
+    }
 
     await fs.writeFile(mainChangelogPath, arr.join('\n'));
   }
@@ -464,10 +599,12 @@ export default class ReleasePreparation extends Session {
     const data = await fs.readFile(majorChangelogPath, 'utf8');
     const arr = data.split('\n');
     const allCommits = this.getChangelog();
-    const notableChanges = await this.getBranchDiff({
-      onlyNotableChanges: true,
-      format: isSecurityRelease ? 'messageonly' : 'markdown',
-    });
+    const notableChanges = isSecurityRelease
+      ? await this.getSecurityNotableChanges()
+      : await this.getBranchDiff({
+        onlyNotableChanges: true,
+        format: 'markdown',
+      });
     let releaseHeader = `## ${date}, Version ${newVersion}` +
                           ` ${releaseInfo}, @${username}\n`;
     if (isSecurityRelease) {
@@ -515,12 +652,12 @@ export default class ReleasePreparation extends Session {
         arr.splice(idx, 0, ...toAppend);
         break;
       }
-    };
+    }
 
     await fs.writeFile(majorChangelogPath, arr.join('\n'));
   }
 
-  async createProposalBranch(base = this.stagingBranch) {
+  async createProposalBranch(base = this.branch) {
     const { newVersion } = this;
     const proposalBranch = `v${newVersion}-proposal`;
 
@@ -603,10 +740,12 @@ export default class ReleasePreparation extends Session {
       messageBody.push('This is a security release.\n\n');
     }
 
-    const notableChanges = await this.getBranchDiff({
-      onlyNotableChanges: true,
-      format: isSecurityRelease ? 'messageonly' : 'plaintext'
-    });
+    const notableChanges = isSecurityRelease
+      ? await this.getSecurityNotableChanges()
+      : await this.getBranchDiff({
+        onlyNotableChanges: true,
+        format: 'plaintext'
+      });
     messageBody.push('Notable changes:\n\n');
     if (isLTSTransition) {
       messageBody.push(`${getStartLTSBlurb(this)}\n\n`);
@@ -629,6 +768,48 @@ export default class ReleasePreparation extends Session {
     return useMessage;
   }
 
+  // Build the notable changes of a security release from the commits
+  // cherry-picked onto the proposal branch and the severity ratings in
+  // vulnerabilities.json.
+  async getSecurityNotableChanges() {
+    const { upstream, versionComponents } = this;
+    const releaseBranch = `v${versionComponents.major}.x`;
+
+    await forceRunAsync('git', ['remote', 'set-branches', '--add', upstream, releaseBranch], {
+      ignoreFailures: false
+    });
+    await forceRunAsync('git', ['fetch', upstream, releaseBranch], { ignoreFailures: false });
+
+    const severityByCVE = new Map();
+    const vulnPath = this.getVulnerabilitiesJSONPath();
+    if (vulnPath && existsSync(vulnPath)) {
+      const { reports } = JSON.parse(readFileSync(vulnPath, 'utf-8'));
+      for (const report of reports ?? []) {
+        for (const cveId of report.cveIds ?? []) {
+          severityByCVE.set(cveId, report.severity?.rating);
+        }
+      }
+    }
+
+    const log = runSync('git', [
+      'log',
+      '--format=%s%x1f%an%x1f%(trailers:key=CVE-ID,valueonly,separator=%x2C)%x1e',
+      `${upstream}/${releaseBranch}..HEAD`
+    ]);
+    const commits = log.split('\x1e').map(record => {
+      const [subject, author, cveIds] = record.trim().split('\x1f');
+      return {
+        subject,
+        author,
+        // Ignore placeholder trailers such as CVE-2026-XXXXX.
+        cveIds: (cveIds || '').split(',')
+          .map(id => id.trim())
+          .filter(id => /^CVE-\d{4}-\d+$/.test(id))
+      };
+    });
+    return formatSecurityNotableChanges(commits, severityByCVE);
+  }
+
   async getBranchDiff(opts) {
     const {
       cli,
@@ -796,6 +977,10 @@ export default class ReleasePreparation extends Session {
       return;
     }
     this.stagingBranch = currentBranch;
+    // On security releases `branch` resolves to `releaseBranch`, which
+    // tryResetBranch() needs. Derive it from the branch that is checked out:
+    // the new version is only calculated below, and it may bump the major.
+    this.releaseBranch = `v${match[1]}.x`;
     await this.tryResetBranch();
     this.versionComponents = await this.calculateNewVersion(await this.getLastRelease(match[1]));
     const { major, minor, patch } = this.versionComponents;