Repository navigation
Add OpenJS CNA credentials and Worker client to reserve CVEs - #1232
Merged
Merged
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1232 +/- ##
==========================================
+ Coverage 65.07% 66.52% +1.45%
==========================================
Files 66 69 +3
Lines 13205 14103 +898
==========================================
+ Hits 8593 9382 +789
- Misses 4612 4721 +109 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
UlisesGascon
added a commit
to UlisesGascon/node
that referenced
this pull request
Oct 28, 2026
When `cve_source` is set to `openjs-cna` in `.ncurc`, `git node security
--request-cve` reserves CVE ids through the OpenJS Foundation CNA instead
of HackerOne. Publication to MITRE is then handled by the `Publish CVEs`
workflow in the nodejs-private/security-release repository, which runs
when the security release pull request is merged and holds until every
patched version is on nodejs.org/dist.
Update the security release runbook accordingly:
* Note the OpenJS CNA option under 'Requesting CVEs', including the
resume behaviour on supervised buckets.
* Mark 'Request publication of H1 CVE requests' in cleanup as a no-op
under the OpenJS CNA path.
* Add a Post-Release step describing the automatic publication, the
nodejs.org gate, the failure issue and the delay before cve.org.
* Scope the HackerOne form under 'Updating CVEs' to HackerOne-issued
ids and point OpenJS-issued ids at the CNA coordinators.
Refs: openjs-foundation/security-wg#337
Refs: nodejs/node-core-utils#1232
Refs: nodejs-private/security-release#87
Assisted-by: Claude
Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
This was referenced Oct 28, 2026
UlisesGascon
marked this pull request as ready for review
November 5, 2026 10:23
UlisesGascon
force-pushed
the
feat/openjs-cna-reserve
branch
from
November 5, 2026 10:25
a0a06ce to
bdfd15d
Compare
Member
Author
|
I solved the commit linting issues @aduh95 👍 |
aduh95
approved these changes
Nov 5, 2026
aduh95
left a comment
aduh95
left a comment
Contributor
There was a problem hiding this comment.
A bit rubber-stampy, but LGTM
UlisesGascon
added a commit
to UlisesGascon/node
that referenced
this pull request
Nov 6, 2026
When `cve_source` is set to `openjs-cna` in `.ncurc`,
`git node security --request-cve` reserves CVE ids through the OpenJS
Foundation CNA instead of HackerOne. Publication to MITRE is then
handled by the `Publish CVEs` workflow in the
nodejs-private/security-release repository, which runs when the
security release pull request is merged and holds until every patched
version is on nodejs.org/dist.
Update the security release runbook accordingly:
* Note the OpenJS CNA option under 'Requesting CVEs', including the
resume behaviour on supervised buckets.
* Mark 'Request publication of H1 CVE requests' in cleanup as a no-op
under the OpenJS CNA path.
* Add a Post-Release step describing the automatic publication, the
nodejs.org gate, the failure issue and the delay before cve.org.
* Scope the HackerOne form under 'Updating CVEs' to HackerOne-issued
ids and point OpenJS-issued ids at the CNA coordinators.
Refs: openjs-foundation/security-wg#337
Refs: nodejs/node-core-utils#1232
Refs: nodejs-private/security-release#87
Assisted-by: Claude
Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ref: nodejs/security-wg#1576