From 675add7b0a9a6d714f98cf146546c3b926f38916 Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Fri, 6 Nov 2026 22:41:32 +0100 Subject: [PATCH] doc: mention the request-cves label in the security release process CVE ids can now be reserved from the security release pull request by adding the `request-cves` label, instead of running `git node security --request-cve` locally with personal credentials. Note the label next to the command under 'Requesting CVEs', with the retry via `request-cves-failed`. Refs: https://github.com/nodejs/security-wg/issues/1576 Refs: https://github.com/nodejs-private/security-release/pull/92 Refs: https://github.com/nodejs/node-core-utils/pull/1232 Assisted-by: Claude, Codex Signed-off-by: Ulises Gascon --- doc/contributing/security-release-process.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md index 1e87e244530..e69a3564cd8 100644 --- a/doc/contributing/security-release-process.md +++ b/doc/contributing/security-release-process.md @@ -75,7 +75,12 @@ The current security stewards are documented in the main Node.js `vulnerabilities.json`. * [ ] 4\. **Requesting CVEs:** - * Request CVEs for the reports with `git node security --request-cve`. + * Request CVEs for the reports with `git node security --request-cve`, or + add the `request-cves` label to the security release pull request in the + [security-release][] repository. The label does the same from the + repository, no local credentials needed, and reports the result as a + comment. On failure, remove the `request-cves-failed` label and add + `request-cves` again to retry. * Make sure to have a green CI before requesting a CVE. * Check if there is a need to issue a CVE for any version that became EOL after the last security release through [this issue](https://github.com/nodejs/security-wg/issues/1419).