From d5c4bfb2345bd8f5df1adf7e9424ae0cf770999b Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Tue, 10 Nov 2026 18:18:00 +0000 Subject: [PATCH] :sparkles: Add security fixes section to the changelog flow The :lock: section is generated from advisories instead of being written by hand: an advisory becomes an entry when its patched_versions include the release version, so unpublished (triage/draft) advisories are valid. - gh.py advisories --patched-version filters on the exact token of vulnerabilities[*].patched_versions; the list output keeps the summary schema. - changelog.py security renders the entries sorted by GHSA id, links the merged milestone PRs labelled "pr pt" that reference the GHSA id and warns when a reference has no matching patched version. The subsection follows :rocket: (or :boom:, or the version header) and is removed when the version has no advisories. - Tests cover the filter, the entry rendering, PR discovery and the subsection placement. - Memories and the update-changelog skill document the contract. - CHANGES.md: add 2.19.1 with its security fixes and the remaining bug fix. AI-assisted-by: deepseek-v4.1-flash --- .agents/skills/update-changelog/SKILL.md | 17 +- .serena/memories/scripts/changelog.md | 3 +- .serena/memories/scripts/gh.md | 5 + .../memories/workflow/updating-changelog.md | 54 ++-- CHANGES.md | 16 + scripts/changelog.py | 200 ++++++++++++- scripts/gh.py | 31 ++ scripts/test_changelog.py | 278 ++++++++++++++++++ scripts/test_gh.py | 64 ++++ 9 files changed, 639 insertions(+), 29 deletions(-) diff --git a/.agents/skills/update-changelog/SKILL.md b/.agents/skills/update-changelog/SKILL.md index b6803bce46..c83ab8d1f7 100644 --- a/.agents/skills/update-changelog/SKILL.md +++ b/.agents/skills/update-changelog/SKILL.md @@ -6,7 +6,7 @@ description: Update the project CHANGES.md with issues from a given GitHub miles # Skill: update-changelog Entry point for all changelog work. All rules — sections, exclusions, entry -format, the `:boom:` and `:rocket:` label contracts, pre-flight, and the +format, the `:boom:`, `:rocket:` and `:lock:` contracts, pre-flight, and the anomaly report — live in `mem:workflow/updating-changelog` (file: `.serena/memories/workflow/updating-changelog.md`). This skill routes to that memory; it does not repeat it. @@ -28,18 +28,22 @@ memory; it does not repeat it. ## What to Read 1. `mem:workflow/updating-changelog` — the canonical flow: sources of truth, - layout, entry rules, the `## Breaking change note` comment contract, - pre-flight checks, anomaly types, and pitfalls. -2. `mem:scripts/changelog` — `boom`, `check-merged`, `cross-ref`, `report`. -3. `mem:scripts/gh` — `issues`, `issue`, `comments`, `prs`. + layout, entry rules, the `## Breaking change note` comment contract, the + advisory (`:lock:`) contract, pre-flight checks, anomaly types, and pitfalls. +2. `mem:scripts/changelog` — `boom`, `security`, `check-merged`, `cross-ref`, + `report`. +3. `mem:scripts/gh` — `issues`, `issue`, `comments`, `prs`, `advisories`. ## Commands ```bash python3 scripts/gh.py issues "" --exclude "release blocker,no changelog" +python3 scripts/gh.py advisories --patched-version "" python3 scripts/changelog.py check-merged python3 scripts/changelog.py boom "" # print the :boom: section python3 scripts/changelog.py boom "" --write # replace it in CHANGES.md +python3 scripts/changelog.py security "" # print the :lock: section +python3 scripts/changelog.py security "" --write # replace it in CHANGES.md python3 scripts/changelog.py cross-ref "" python3 scripts/changelog.py report "" ``` @@ -48,5 +52,6 @@ python3 scripts/changelog.py report "" - `CHANGES.md` is edited only on explicit request or during the release process. - Only closed, non-excluded milestone issues are included; the issue is the changelog unit and the PR is inline. -- `:boom:` and `:rocket:` are label-generated: never hand-edit them; edit the label or the `## Breaking change note` comment and re-run the command. +- `:boom:` and `:rocket:` are label-generated and `:lock:` is advisory-generated: never hand-edit them; edit the label, the `## Breaking change note` comment or the advisory and re-run the command. - Verify PR merge status before writing; only merged PRs are referenced. +- Fill `patched_versions` in the advisories before running `security`; unpublished advisories are valid. diff --git a/.serena/memories/scripts/changelog.md b/.serena/memories/scripts/changelog.md index e04036ea9a..7134377fa5 100644 --- a/.serena/memories/scripts/changelog.md +++ b/.serena/memories/scripts/changelog.md @@ -6,7 +6,8 @@ - `check-merged ` (`--file`, `--stdin` accepted) — warn on any non-merged PR, exit 1 when found; run before writing changelog entries. - `boom [--changes CHANGES.md --write]` — generate `### :boom: Breaking changes & Deprecations` from the closed, non-excluded milestone issues labelled `breaking change`, sorted by issue number. Each issue becomes a `#### ` block: content = body of the issue's last `## Breaking change note` comment (whole markdown, headings demoted to `#####` outside code fences; fallback = heading plus refs with a stderr warning), refs = issue link plus merged closing PRs on their own line, with `(by @author)` for `community contribution`. `--write` replaces only that subsection of the version (inserts it after the version header when missing, keeps the heading when there are no entries; idempotent). Print-only by default. Uses `gh.py comments`. -- `cross-ref [--changes CHANGES.md]` — fetch milestone PRs with `--state all` once, report merged PRs missing from the version section plus CLOSED (unmerged) warnings; GHSA entries never appear here by design. +- `security [--changes CHANGES.md --write]` — generate `### :lock: Security fixes` from the advisories whose `patched_versions` include the version (via `gh.py advisories --patched-version`), sorted by GHSA id. Entry: `- Fix () (PR: [#N](...))`; description = `Fix` + advisory summary, first word decapitalized unless it starts with an acronym; PRs = merged milestone PRs labelled `pr pt` whose body contains the GHSA id, comma-separated, and no PR is legal. Warns on stderr when a `pr pt` PR references an advisory with no matching `patched_versions`. `--write` replaces only that subsection, placed after `:rocket:` (or `:boom:`, or the version header when neither exists); empty entries remove the subsection; idempotent. Print-only by default. +- `cross-ref [--changes CHANGES.md]` — fetch milestone PRs with `--state all` once, report merged PRs missing from the version section plus CLOSED (unmerged) warnings. PR links inside `:lock:` entries count as referenced; advisory URLs never appear here by design. - `report [--changes CHANGES.md --output CHANGES-ISSUES.md]` — overwrite the anomaly report: A/B milestone mismatches, E `:boom:` entry without the label, F `:rocket:` sync, G `:boom:` sync, plus the C/D `:rocket:` gaps (warnings). `:boom:`/`:rocket:` rule violations are fixed by regenerating or relabelling, not by editing entries in place. ## Conventions diff --git a/.serena/memories/scripts/gh.md b/.serena/memories/scripts/gh.md index 0acbe3635c..c2a10d8f6b 100644 --- a/.serena/memories/scripts/gh.md +++ b/.serena/memories/scripts/gh.md @@ -118,6 +118,9 @@ python3 scripts/gh.py advisories --severity critical # Filter by state python3 scripts/gh.py advisories --state triage +# Filter by patched version declared in the advisory +python3 scripts/gh.py advisories --patched-version 2.19.1 + # Get full detail for a single advisory python3 scripts/gh.py advisories GHSA-xvj6-fh9w-gjw7 ``` @@ -126,6 +129,8 @@ python3 scripts/gh.py advisories GHSA-xvj6-fh9w-gjw7 **Detail output** (single advisory) adds: description, vulnerabilities (package, version ranges), credits, timestamps. +`--patched-version` filters the raw advisories before formatting: the match is an exact token of `vulnerabilities[*].patched_versions` (split on `,`/`;`), so `2.19.1` never matches `2.19.10`. Every state is included (`triage`, `draft`, `published`, `closed`, `withdrawn`). The raw `vulnerabilities` stay internal to the filter: the list output keeps the summary schema. + **Output**: JSON to stdout; progress to stderr. ## Key principles diff --git a/.serena/memories/workflow/updating-changelog.md b/.serena/memories/workflow/updating-changelog.md index 26ac7624af..66d1220fa7 100644 --- a/.serena/memories/workflow/updating-changelog.md +++ b/.serena/memories/workflow/updating-changelog.md @@ -2,7 +2,7 @@ > Note about this memory: unlike other Serena memories (dense notes written for LLM agents, see `mem:memory-maintenance`), this document is also written for human release managers who need full context. That is why it uses plain language and examples. It is the canonical home of the changelog flow; the `update-changelog` skill is only an entry point that routes here. -`CHANGES.md` (repository root) is the release notes file. Every entry comes from GitHub: a milestone issue, its merged PR, or a security advisory. It is never written from scratch by hand; the only manual parts are the security advisory entries and the wording of a description when the title is not enough. +`CHANGES.md` (repository root) is the release notes file. Every entry comes from GitHub: a milestone issue, its merged PR, or a security advisory whose `patched_versions` include the version. It is never written from scratch by hand; the only manual parts are the wording of a description when the title is not enough and the advisory summaries (polished on GitHub, the source of the generated security entries). The commands live in `scripts/gh.py` (GitHub queries) and `scripts/changelog.py` (changelog checks). Their flags and internals are documented in `mem:scripts/gh` and `mem:scripts/changelog`. @@ -19,11 +19,13 @@ Editing `CHANGES.md` happens only on explicit request or as part of the release | Question | Source | |---|---| | Which issues belong to the version? | GitHub milestone | +| Which security fixes? | Advisories whose `patched_versions` include the version | | Which section? | Issue Type | | Is it a breaking change? | `breaking change` label | | Is it a highlight? | `release highlight` label | - **Issue Type decides the section**: `Bug` → `:bug:`, `Feature`/`Enhancement` → `:sparkles:`, `Task` is excluded (internal chores). Labels `bug`/`enhancement` and title emoji prefixes are often wrong or missing; do not use them. +- **Security fixes come from advisories**: an advisory whose `patched_versions` include the version becomes a `:lock:` entry (section 7). `triage`, `draft` and `published` are all valid states; the advisory may still be unpublished when the changelog is written. A security fix may also carry a regular bug issue; both entries are legal and independent (the issue lives in `:bug:` as any other bug). - **Two labels override the Issue Type**: `breaking change` → an entry only under `:boom:`, never in its regular section; `release highlight` → an extra entry under `:rocket:` on top of its regular entry. - **Only closed issues**. An open issue in the milestone is not generated, even if someone added a provisional entry by hand before the merge. - **Excluded issues**: `no changelog`, `release blocker`, `Task` issue type, `Rejected` project status. @@ -51,6 +53,10 @@ The newest version goes at the top, right after the `# CHANGELOG` header. Inside - Add configurable keyboard shortcuts [#9924](https://github.com/penpot/penpot/issues/9924) (PR: [#10237](https://github.com/penpot/penpot/pull/10237)) +### :lock: Security fixes + +- Fix () (PR: [#PR](https://github.com/penpot/penpot/pull/PR)) + ### :bug: Bugs fixed - Fix [#ISSUE](https://github.com/penpot/penpot/issues/ISSUE) (PR: [#PR](https://github.com/penpot/penpot/pull/PR)) @@ -60,8 +66,8 @@ The newest version goes at the top, right after the `# CHANGELOG` header. Inside - Add [#ISSUE](https://github.com/penpot/penpot/issues/ISSUE) (PR: [#PR](https://github.com/penpot/penpot/pull/PR)) ``` -- `:boom:` first, then `:rocket:`, `:bug:`, `:sparkles:`. Other headings exist in old versions (`:heart:` community contributions); do not add them to new versions. -- Include a section only when it has entries. Historical versions may have an empty `:boom:` or `:rocket:` heading; `boom --write` keeps the `:boom:` heading even when there are no entries. +- `:boom:` first, then `:rocket:`, `:lock:`, `:bug:`, `:sparkles:`. Other headings exist in old versions (`:heart:` community contributions); do not add them to new versions. +- Include a section only when it has entries. Historical versions may have an empty `:boom:` or `:rocket:` heading; `boom --write` keeps the `:boom:` heading even when there are no entries. `:lock:` is omitted (and removed on `--write`) when the version has no security advisories. - One blank line between the last entry of a section and the next heading. - No manual line wrapping: one line per bullet or paragraph, however long. @@ -120,7 +126,7 @@ Rules for the note: - **No note**: the generator warns on stderr and emits only the heading and references; fix the issue, not `CHANGES.md`. - **`####`, not `###`**: `###` is the level of the changelog sections. An entry at `###` would render as a sibling section and the scripts that read and rewrite `:boom:` would cut the section there. The note author never writes the `####`: the generator adds it. - **Only merged closing PRs** are referenced; unmerged or superseded PRs are skipped. -- **Never hand-edit the section**. Generate it with `boom` (section 7). The note lives on GitHub; edit it there. +- **Never hand-edit the section**. Generate it with `boom` (section 8). The note lives on GitHub; edit it there. ## 6. `:rocket:`: epics and highlights @@ -129,21 +135,34 @@ Rules for the note: - If no issue is labelled, leave the section out; do not pick highlights yourself. - Never edit `:rocket:` by hand: add or remove the label and regenerate. -## 7. Flow +## 7. `:lock:`: security fixes + +Generated from the advisories that declare the version in `patched_versions`; never written by hand. + +- **Source and filter**: `python3 scripts/gh.py advisories --patched-version ` keeps the advisories whose `vulnerabilities[*].patched_versions` contain the version as an exact token (so `2.19.1` never matches `2.19.10`). Any state is valid — `triage`, `draft`, `published` — because the advisory may still be unpublished when the changelog is written. +- **Fill the advisories first**: `patched_versions` must be filled before generating the changelog. The release process publishes the advisories with (or after) the release; the changelog does not wait for publication. +- **PR reference**: a merged PR in the milestone labelled `pr pt` whose body contains the GHSA id contributes its number inline; several PRs go comma-separated. An advisory with no PR is legal: the entry links only the advisory. +- **Missing `patched_versions`**: when a `pr pt` PR references an advisory that declares no matching `patched_versions`, `security` prints a warning on stderr and leaves it out. Fix the advisory, not `CHANGES.md`. +- **Entry format**: `- Fix () (PR: [#PR](...))`. The description is `Fix` plus the advisory summary, with the first word decapitalized unless it starts with an acronym (`SVG`, `CVE-...`). +- **Wording**: the flow may polish the description. Re-running `security --write` rewrites it from the summary, so the durable place for wording is the advisory summary on GitHub; keep it a problem statement, because the generator adds `Fix`. +- **Empty version**: no matching advisories → the subsection is not inserted (and is removed by `--write`). +- **Never hand-edit the section**: generate it with `security` (section 8). + +## 8. Flow 1. **Confirm the version** (a semver string such as `2.19.0`) with the user when it is not obvious. 2. **Fetch the milestone issues**: `python3 scripts/gh.py issues "" --exclude "release blocker,no changelog"` (closed by default; add `--state all` only to inspect open issues). `gh.py` already drops `Task` and `Rejected`; pass `--include-tasks` / `--include-rejected` only to inspect them. To find what is missing from an existing section, add `--compare CHANGES.md`. 3. **Fetch PR details when needed**: `python3 scripts/gh.py prs ` (also `--milestone`). Use it for the PR author, labels and merge state. 4. **Categorize** by Issue Type and the two labels (section 2), and **build the descriptions** (section 4). 5. **Verify PR merge status** before writing: `python3 scripts/changelog.py check-merged `. Only merged PRs go in the changelog; if a closing PR was closed unmerged, look for the PR that superseded it. -6. **Reconcile the existing text** (section 8). +6. **Reconcile the existing text** (section 9). 7. **Generate `:boom:`**: `python3 scripts/changelog.py boom ""` prints the section; add `--write` to replace it in `CHANGES.md`. The write replaces only that subsection, inserts it after the version header when missing, keeps the heading when there are no entries, and is idempotent. 8. **Generate `:rocket:`** from the `release highlight` label (section 6). -9. **Cross-check PRs**: `python3 scripts/changelog.py cross-ref ""`. It lists merged milestone PRs missing from the section and warns about closed (unmerged) PRs. GHSA entries never appear; that absence is expected. -10. **Generate the anomaly report**: `python3 scripts/changelog.py report ""`. It overwrites `CHANGES-ISSUES.md` with the current state (section 9). -11. **Security advisories (GHSA)**: add them by hand under `:bug:` as `- Fix ()`, with no issue or PR link. Do not fetch or verify the URL: it may be draft and return 404. Write the description in imperative mood from the advisory title. These entries are invisible to the automation; apply only the duplicate/backport check to them. +9. **Generate `:lock:`**: `python3 scripts/changelog.py security ""` prints the section; add `--write` to replace it in `CHANGES.md`. The contract lives in section 7. +10. **Cross-check PRs**: `python3 scripts/changelog.py cross-ref ""`. It lists merged milestone PRs missing from the section and warns about closed (unmerged) PRs. PRs linked from `:lock:` count as referenced; an advisory with no PR is invisible here by design. +11. **Generate the anomaly report**: `python3 scripts/changelog.py report ""`. It overwrites `CHANGES-ISSUES.md` with the current state (section 10). -## 8. Pre-flight: reconcile before writing +## 9. Pre-flight: reconcile before writing Re-fetch the milestone (do not trust cached data) and fix these in `CHANGES.md` before adding the new section: @@ -151,13 +170,13 @@ Re-fetch the milestone (do not trust cached data) and fix these in `CHANGES.md` 2. **Stale milestone assignment** (the issue moved out of this milestone) → remove the entry. 3. **Newly applied exclusion labels** (`no changelog`, `release blocker`) → remove the entry. 4. **Issue no longer closed, deleted, or now `Rejected`** → remove the entry. -5. **Unmerged or moved PR reference** → fix the reference or remove the entry. A PR merged in a different milestone is an anomaly (section 9); do not remove it silently. +5. **Unmerged or moved PR reference** → fix the reference or remove the entry. A PR merged in a different milestone is an anomaly (section 10); do not remove it silently. 6. **Issue Type changed to `Task`** → remove the entry. 7. **Breaking change out of sync** (a `breaking change` issue outside `:boom:`, or a `:boom:` entry without the label) → regenerate the section; a labelled issue has no regular entry. 8. **Highlight out of sync** (`:rocket:` entry without the label, or a labelled issue missing) → remove it or add it. 9. **Missing valid issues** (closed, non-excluded, referenced nowhere) → add them to their section. -## 9. Anomaly report +## 10. Anomaly report `report` classifies problems it cannot decide alone. The total counts A, B, E, F and G; C and D are warnings. @@ -171,17 +190,18 @@ Re-fetch the milestone (do not trust cached data) and fix these in `CHANGES.md` Anything else is a rule violation, not a report item: fix it in the pre-flight and re-run. -## 10. Pitfalls +## 11. Pitfalls - **Open issues with provisional entries**: a PR author may add the entry before the merge. `boom` will not generate it until the issue closes; keep the hand-written block identical to what the generator would produce. - **Labels, not emoji**: title prefixes are cosmetic and often missing; the section comes from Issue Type and the two labels. - **Taiga references**: old entries link to Taiga. Resolve them to the GitHub issue via the description text or the PRs that mention the Taiga URL, then link issue and PR. - **Long-lived links only**: runbooks and docs referenced from a note must point to `staging` or `main`, never to a feature branch that will be deleted. -- **Generated sections**: `:boom:` and `:rocket:` are the only label-generated parts. Never patch them by hand; edit the label or the note comment and re-run. +- **Generated sections**: `:boom:`, `:rocket:` and `:lock:` are generated. Never patch them by hand; edit the label, the note comment or the advisory and re-run. +- **Deleted or transferred issues**: an issue referenced in the changelog that returns 410/404 (deleted or moved out of the repo) must lose its entry in the pre-flight. Its security fixes, if any, stay in `:lock:` through the advisory. -## 11. Where the code is +## 12. Where the code is -- `scripts/gh.py`: `issues`, `issue`, `comments`, `prs`, `link-issue`, `advisories`. Details: `mem:scripts/gh`. -- `scripts/changelog.py`: `check-merged`, `boom`, `cross-ref`, `report`. Details: `mem:scripts/changelog`. +- `scripts/gh.py`: `issues`, `issue`, `comments`, `prs`, `link-issue`, `advisories` (with `--patched-version`). Details: `mem:scripts/gh`. +- `scripts/changelog.py`: `check-merged`, `boom`, `security`, `cross-ref`, `report`. Details: `mem:scripts/changelog`. - Tests: `scripts/test_gh.py`, `scripts/test_changelog.py`. - The note contract for issue authors: `mem:workflow/creating-issues`, section **Breaking changes**. diff --git a/CHANGES.md b/CHANGES.md index 7a8edb8fb3..b085fa09c7 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,5 +1,21 @@ # CHANGELOG +## 2.19.1 (Unreleased) + +### :lock: Security fixes + +- Fix editor-role team members retrieving the signed invitation token of any pending invitation (https://github.com/penpot/penpot/security/advisories/GHSA-4mmc-j8rh-74pf) (PR: [#12892](https://github.com/penpot/penpot/pull/12892)) + +- Fix share-link page-scope escape in `get-profiles-for-file-comments` leaking the identity of comment authors outside the link's scope (https://github.com/penpot/penpot/security/advisories/GHSA-89cq-3wv7-987r) (PR: [#12888](https://github.com/penpot/penpot/pull/12888)) + +- Fix missing authorization and unbounded array in mark-all-threads-as-read that let any authenticated user write the status of inaccessible threads (https://github.com/penpot/penpot/security/advisories/GHSA-j4vc-cmf6-jhr7) (PR: [#12894](https://github.com/penpot/penpot/pull/12894)) + +- Fix incomplete SVG sanitizer escaping that let a "sanitized" SVG carry live script (CVE-2026-105694) (https://github.com/penpot/penpot/security/advisories/GHSA-qwhj-rchj-58mg) (PR: [#12887](https://github.com/penpot/penpot/pull/12887)) + +### :bug: Bugs fixed + +- Fix component instance (variant) inside a layout resetting to its original size after a shared library update of an unrelated component [#12670](https://github.com/penpot/penpot/issues/12670) (PR: [#12851](https://github.com/penpot/penpot/pull/12851)) + ## 2.19.0 ### :boom: Breaking changes & Deprecations diff --git a/scripts/changelog.py b/scripts/changelog.py index e964bacc18..280ffa1f85 100644 --- a/scripts/changelog.py +++ b/scripts/changelog.py @@ -8,6 +8,7 @@ flow memory (`mem:workflow/updating-changelog`) stays free of inline programs. Subcommands: check-merged Verify that every given PR is merged (warns otherwise) boom Generate the :boom: section from `breaking change` issues + security Generate the :lock: section from advisories fixed in a version cross-ref Compare merged milestone PRs against the changelog section report Generate the anomaly report (CHANGES-ISSUES.md) @@ -16,6 +17,8 @@ Usage: cat prs.txt | python3 scripts/changelog.py check-merged --stdin python3 scripts/changelog.py boom "2.19.0" python3 scripts/changelog.py boom "2.19.0" --write + python3 scripts/changelog.py security "2.19.1" + python3 scripts/changelog.py security "2.19.1" --write python3 scripts/changelog.py cross-ref "2.16.0" python3 scripts/changelog.py report "2.16.0" python3 scripts/changelog.py report "2.16.0" --changes CHANGES.md --output CHANGES-ISSUES.md @@ -38,9 +41,15 @@ REPO = "penpot/penpot" GH_PY = Path(__file__).resolve().parent / "gh.py" BOOM_HEADING = "### :boom: Breaking changes & Deprecations" +SECURITY_HEADING = "### :lock: Security fixes" BREAKING_LABEL = "breaking change" EXCLUDED_LABELS = {"release blocker", "no changelog"} +# PR label carried by the security fixes that reference their advisory in the +# PR body, and the GHSA id pattern used to find that reference. +SECURITY_PR_LABEL = "pr pt" +GHSA_ID_RE = re.compile(r"GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}", re.IGNORECASE) + # Marker line of the issue comment that carries the changelog text of a # breaking change. Everything after the marker line is the entry content. BREAKING_NOTE_RE = re.compile(r"(?im)^#{1,3}[ \t]+Breaking change note[ \t]*$") @@ -269,8 +278,8 @@ def version_section_bounds(content: str, milestone: str) -> tuple[int, int] | No return start, end -def boom_body(entries: list[str]) -> str: - """Return the body text that follows the ``:boom:`` heading line.""" +def entry_list_body(entries: list[str]) -> str: + """Return the body text that follows a generated subsection heading.""" if entries: return "\n\n" + "\n\n".join(entries) + "\n\n" return "\n\n" @@ -292,12 +301,12 @@ def replace_boom_section(content: str, milestone: str, entries: list[str]) -> st body_start = start + heading.end() next_heading = re.search(r"(?m)^### ", content[body_start:end]) body_end = body_start + next_heading.start() if next_heading else end - return content[:body_start] + boom_body(entries) + content[body_end:] + return content[:body_start] + entry_list_body(entries) + content[body_end:] header = re.match(r"(?m)^## [^\n]*\n", section) if header is None: raise ValueError(f'version "## {milestone}" header has no trailing newline') insert_at = start + header.end() - block = "\n" + BOOM_HEADING + boom_body(entries)[:-1] + block = "\n" + BOOM_HEADING + entry_list_body(entries)[:-1] return content[:insert_at] + block + content[insert_at:] @@ -373,7 +382,7 @@ def cmd_boom(args: argparse.Namespace) -> None: render_boom_entry(issue, note, [pr["number"] for pr in merged], author) ) - block = BOOM_HEADING + boom_body(entries) + block = BOOM_HEADING + entry_list_body(entries) print(block.rstrip("\n")) if not labelled: @@ -398,6 +407,177 @@ def cmd_boom(args: argparse.Namespace) -> None: print(f"{args.changes}: :boom: section updated", file=sys.stderr) +# ───────────────────────────────────────────── +# Subcommand: security +# ───────────────────────────────────────────── + + +def imperative_description(summary: str) -> str: + """Return a changelog description built from an advisory summary. + + Advisory summaries are declarative ("Missing authorization in ... lets + ..."), so the description prefixes ``Fix`` and decapitalizes the first + word unless it starts with an acronym (``SVG``, ``CVE-...``). The wording + may still be polished in the flow; re-running ``security --write`` + rewrites the entry from the advisory summary. + """ + summary = strip_title_prefix((summary or "").strip()) + if not summary: + return "" + first_word = summary.split(maxsplit=1)[0] + if len(first_word) > 1 and first_word[1:].islower(): + summary = summary[0].lower() + summary[1:] + return f"Fix {summary}" + + +def render_security_entry(advisory: dict, pr_numbers: list[int]) -> str: + """Render one ``:lock:`` entry: description, advisory link and PRs.""" + ghsa_id = advisory["ghsa_id"] + url = advisory.get("url") or ( + f"https://github.com/{REPO}/security/advisories/{ghsa_id}" + ) + description = imperative_description(advisory.get("summary", "")) or ( + "Fix a security issue" + ) + entry = f"- {description} ({url})" + if pr_numbers: + entry += " (PR: " + ", ".join(pr_link(n) for n in pr_numbers) + ")" + return entry + + +def fetch_security_advisories(milestone: str) -> list[dict]: + """Fetch the advisories that declare ``milestone`` as a patched version.""" + return json.loads(run_gh_py("advisories", "--patched-version", milestone)) + + +def fetch_security_prs(milestone: str) -> dict[str, list[int]]: + """Map each GHSA id to the merged ``pr pt`` PRs in a milestone referencing it.""" + by_ghsa: dict[str, list[int]] = {} + for pr in fetch_milestone_prs(milestone, "all"): + if pr.get("state") != "MERGED": + continue + if SECURITY_PR_LABEL not in pr.get("labels", []): + continue + for ghsa_id in GHSA_ID_RE.findall(pr.get("body") or ""): + by_ghsa.setdefault(ghsa_id.upper(), []).append(pr["number"]) + return {ghsa_id: sorted(set(numbers)) for ghsa_id, numbers in by_ghsa.items()} + + +def subsection_end( + content: str, section: str, start: int, end: int, heading_re: str +) -> int | None: + """Return the offset where the body of a ``###`` subsection ends. + + ``heading_re`` is a prefix of the heading line (e.g. ``### :rocket:``), so + the heading text that follows it does not matter. + """ + match = re.search(rf"(?m)^{heading_re}", section) + if not match: + return None + body_start = start + match.end() + next_heading = re.search(r"(?m)^### ", content[body_start:end]) + return body_start + next_heading.start() if next_heading else end + + +def replace_security_section( + content: str, milestone: str, entries: list[str] +) -> str: + """Return ``content`` with its ``:lock:`` subsection replaced or added. + + The subsection follows ``:rocket:`` (or ``:boom:`` when there is no + ``:rocket:``, or the version header when neither exists), which keeps the + layout order. An empty ``entries`` list removes the subsection: the + heading only exists when the version has security fixes to list. + """ + bounds = version_section_bounds(content, milestone) + if bounds is None: + raise ValueError(f'no "## {milestone}" section found') + start, end = bounds + section = content[start:end] + + heading = re.search(rf"(?m)^{re.escape(SECURITY_HEADING)}[ \t]*$", section) + if heading: + heading_start = start + heading.start() + body_start = start + heading.end() + next_heading = re.search(r"(?m)^### ", content[body_start:end]) + body_end = body_start + next_heading.start() if next_heading else end + if not entries: + return content[:heading_start] + content[body_end:] + return ( + content[:heading_start] + + SECURITY_HEADING + + entry_list_body(entries) + + content[body_end:] + ) + + if not entries: + return content + + anchor = subsection_end(content, section, start, end, r"### :rocket:") + if anchor is None: + anchor = subsection_end(content, section, start, end, r"### :boom:") + if anchor is None: + header = re.match(r"(?m)^## [^\n]*\n", section) + if header is None: + raise ValueError(f'version "## {milestone}" header has no trailing newline') + insert_at = start + header.end() + block = "\n" + SECURITY_HEADING + entry_list_body(entries)[:-1] + return content[:insert_at] + block + content[insert_at:] + + block = SECURITY_HEADING + entry_list_body(entries) + return content[:anchor] + block + content[anchor:] + + +def cmd_security(args: argparse.Namespace) -> None: + """Generate the ``:lock:`` section from advisories fixed in the version.""" + milestone = args.milestone + advisories = fetch_security_advisories(milestone) + prs_by_ghsa = fetch_security_prs(milestone) + + matched = { + advisory["ghsa_id"].upper() + for advisory in advisories + if advisory.get("ghsa_id") + } + for ghsa_id in sorted(set(prs_by_ghsa) - matched): + numbers = ", ".join(f"#{n}" for n in prs_by_ghsa[ghsa_id]) + print( + f"WARNING: PR {numbers} references {ghsa_id}, which declares no patched " + f'version "{milestone}"; it will not be listed under :lock:', + file=sys.stderr, + ) + + entries = [ + render_security_entry( + advisory, prs_by_ghsa.get(advisory["ghsa_id"].upper(), []) + ) + for advisory in sorted(advisories, key=lambda advisory: advisory["ghsa_id"]) + ] + + if entries: + print((SECURITY_HEADING + entry_list_body(entries)).rstrip("\n")) + else: + print( + f"No advisories declare patched version {milestone}", + file=sys.stderr, + ) + + if args.write: + with open(args.changes) as f: + content = f.read() + try: + updated = replace_security_section(content, milestone, entries) + except ValueError as err: + print(f"ERROR: {err}", file=sys.stderr) + sys.exit(1) + if updated == content: + print(f"{args.changes}: :lock: section already up to date", file=sys.stderr) + else: + with open(args.changes, "w") as f: + f.write(updated) + print(f"{args.changes}: :lock: section updated", file=sys.stderr) + + # ───────────────────────────────────────────── # Subcommand: cross-ref # ───────────────────────────────────────────── @@ -901,6 +1081,16 @@ def main() -> None: help="Replace the :boom: section in CHANGES.md in place") p_boom.set_defaults(func=cmd_boom) + p_security = sub.add_parser( + "security", help="Generate the :lock: section from advisories fixed in a version" + ) + p_security.add_argument("milestone", help="Milestone title (e.g. '2.19.1')") + p_security.add_argument("--changes", default="CHANGES.md", + help="Path to the changelog file (default: CHANGES.md)") + p_security.add_argument("--write", action="store_true", + help="Replace the :lock: section in CHANGES.md in place") + p_security.set_defaults(func=cmd_security) + p_cross = sub.add_parser( "cross-ref", help="Compare merged milestone PRs against the changelog section", diff --git a/scripts/gh.py b/scripts/gh.py index 2ec3eb8dc3..eebd5155fd 100755 --- a/scripts/gh.py +++ b/scripts/gh.py @@ -31,6 +31,7 @@ Usage: python3 scripts/gh.py comments 11235 11236 python3 scripts/gh.py advisories (list all advisories) python3 scripts/gh.py advisories --severity critical (filter by severity) + python3 scripts/gh.py advisories --patched-version 2.19.1 (filter by patched version) python3 scripts/gh.py advisories GHSA-xvj6-fh9w-gjw7 (single advisory detail) python3 scripts/gh.py link-issue 11235 11243 @@ -980,6 +981,22 @@ def format_advisory_summary(adv: dict) -> dict: } +def advisory_patched_versions(adv: dict) -> list[str]: + """Return every patched version declared by an advisory's vulnerabilities.""" + versions: list[str] = [] + for vuln in adv.get("vulnerabilities", []): + for token in re.split(r"[,;]", vuln.get("patched_versions") or ""): + token = token.strip() + if token and token not in versions: + versions.append(token) + return versions + + +def advisory_fixed_in_version(adv: dict, version: str) -> bool: + """Return True when the advisory declares ``version`` among its patched ones.""" + return version in advisory_patched_versions(adv) + + def format_advisory_detail(adv: dict) -> dict: """Extract full detail view of an advisory.""" summary = format_advisory_summary(adv) @@ -1020,6 +1037,16 @@ def cmd_advisories(args: argparse.Namespace) -> None: advisories = fetch_advisories() print(f"Fetched {len(advisories)} advisories", file=sys.stderr) + if args.patched_version: + version = args.patched_version.strip() + advisories = [ + adv for adv in advisories if advisory_fixed_in_version(adv, version) + ] + print( + f"After patched-version filter ({version}): {len(advisories)} advisories", + file=sys.stderr, + ) + results = [format_advisory_summary(adv) for adv in advisories] # Apply filters @@ -1160,6 +1187,10 @@ def main() -> None: "--state", choices=["triage", "draft", "published", "closed", "withdrawn"], help="Filter by advisory state" ) + p_adv.add_argument( + "--patched-version", type=str, + help="Filter by patched version declared in the advisory (e.g. '2.19.1')" + ) p_adv.set_defaults(func=cmd_advisories) args = parser.parse_args() diff --git a/scripts/test_changelog.py b/scripts/test_changelog.py index 5d6a19946e..e27d3de1d2 100644 --- a/scripts/test_changelog.py +++ b/scripts/test_changelog.py @@ -379,5 +379,283 @@ class ReportTests(unittest.TestCase): self.assertIn("**:boom: entry without breaking change label:** 1", report) +ADVISORY = { + "ghsa_id": "GHSA-j4vc-cmf6-jhr7", + "url": "https://github.com/penpot/penpot/security/advisories/GHSA-j4vc-cmf6-jhr7", + "summary": ( + "Missing authorization in mark-all-threads-as-read lets a user update " + "inaccessible threads" + ), +} + +SECURITY_CHANGES = """# CHANGELOG + +## 2.19.1 + +### :bug: Bugs fixed + +- Fix something [#1](https://github.com/penpot/penpot/issues/1) +""" + +SECURITY_CHANGES_WITH_ROCKET = """# CHANGELOG + +## 2.19.1 + +### :rocket: Epics and highlights + +- Add highlights [#1](https://github.com/penpot/penpot/issues/1) + +### :bug: Bugs fixed + +- Fix something [#2](https://github.com/penpot/penpot/issues/2) +""" + +SECURITY_CHANGES_WITH_BOOM = """# CHANGELOG + +## 2.19.1 + +### :boom: Breaking changes & Deprecations + +#### Old entry + +[#1](https://github.com/penpot/penpot/issues/1) + +### :bug: Bugs fixed + +- Fix something [#2](https://github.com/penpot/penpot/issues/2) +""" + + +class ImperativeDescriptionTests(unittest.TestCase): + def test_prefixes_fix_and_decapitalizes(self): + self.assertEqual( + ch.imperative_description("Missing authorization in foo"), + "Fix missing authorization in foo", + ) + + def test_keeps_acronyms(self): + self.assertEqual( + ch.imperative_description("SVG sanitizer escapes nothing"), + "Fix SVG sanitizer escapes nothing", + ) + self.assertEqual( + ch.imperative_description("CVE-2026-105694: sanitizer escapes nothing"), + "Fix CVE-2026-105694: sanitizer escapes nothing", + ) + + def test_strips_emoji_prefix_and_handles_empty(self): + self.assertEqual( + ch.imperative_description(":bug: Missing check"), "Fix missing check" + ) + self.assertEqual(ch.imperative_description(""), "") + + +class RenderSecurityEntryTests(unittest.TestCase): + def test_entry_has_description_advisory_and_prs(self): + self.assertEqual( + ch.render_security_entry(ADVISORY, [8, 9]), + "- Fix missing authorization in mark-all-threads-as-read lets a user " + "update inaccessible threads " + "(https://github.com/penpot/penpot/security/advisories/GHSA-j4vc-cmf6-jhr7)" + " (PR: [#8](https://github.com/penpot/penpot/pull/8)," + " [#9](https://github.com/penpot/penpot/pull/9))", + ) + + def test_entry_without_prs_links_only_the_advisory(self): + entry = ch.render_security_entry(ADVISORY, []) + self.assertNotIn("PR:", entry) + self.assertIn("security/advisories/GHSA-j4vc-cmf6-jhr7", entry) + + def test_entry_builds_the_url_when_the_advisory_lacks_it(self): + advisory = dict(ADVISORY) + del advisory["url"] + self.assertIn( + "(https://github.com/penpot/penpot/security/advisories/GHSA-j4vc-cmf6-jhr7)", + ch.render_security_entry(advisory, []), + ) + + +class FetchSecurityPrsTests(unittest.TestCase): + def test_maps_merged_pr_pt_prs_by_ghsa(self): + prs = [ + { + "number": 10, + "state": "MERGED", + "labels": ["internal", "pr pt"], + "body": "Relates to [GHSA-4mmc-j8rh-74pf]" + "(https://github.com/penpot/penpot/security/advisories/GHSA-4mmc-j8rh-74pf)", + }, + { + "number": 11, + "state": "CLOSED", + "labels": ["pr pt"], + "body": "Closes GHSA-j4vc-cmf6-jhr7", + }, + { + "number": 12, + "state": "MERGED", + "labels": ["bug"], + "body": "GHSA-qwhj-rchj-58mg", + }, + { + "number": 13, + "state": "MERGED", + "labels": ["pr pt"], + "body": "No advisory here", + }, + ] + with patch.object(ch, "fetch_milestone_prs", return_value=prs): + result = ch.fetch_security_prs("2.19.1") + self.assertEqual(result, {"GHSA-4MMC-J8RH-74PF": [10]}) + + +class ReplaceSecuritySectionTests(unittest.TestCase): + ENTRY = ( + "- Fix missing check (https://example.test/ghsa)" + " (PR: [#8](https://example.test/pr/8))" + ) + + def test_inserts_after_rocket(self): + updated = ch.replace_security_section( + SECURITY_CHANGES_WITH_ROCKET, "2.19.1", [self.ENTRY] + ) + self.assertIn( + "### :rocket: Epics and highlights\n\n" + "- Add highlights [#1](https://github.com/penpot/penpot/issues/1)\n\n" + "### :lock: Security fixes\n\n" + f"{self.ENTRY}\n\n" + "### :bug: Bugs fixed", + updated, + ) + + def test_inserts_after_boom_when_there_is_no_rocket(self): + updated = ch.replace_security_section( + SECURITY_CHANGES_WITH_BOOM, "2.19.1", [self.ENTRY] + ) + self.assertIn( + "#### Old entry\n\n[#1](https://github.com/penpot/penpot/issues/1)\n\n" + "### :lock: Security fixes\n\n" + f"{self.ENTRY}\n\n" + "### :bug: Bugs fixed", + updated, + ) + + def test_inserts_after_the_header_when_no_anchor_exists(self): + updated = ch.replace_security_section( + SECURITY_CHANGES, "2.19.1", [self.ENTRY] + ) + self.assertIn( + "## 2.19.1\n\n" + "### :lock: Security fixes\n\n" + f"{self.ENTRY}\n\n" + "### :bug: Bugs fixed", + updated, + ) + + def test_replacement_is_idempotent(self): + once = ch.replace_security_section( + SECURITY_CHANGES, "2.19.1", [self.ENTRY] + ) + twice = ch.replace_security_section(once, "2.19.1", [self.ENTRY]) + self.assertEqual(once, twice) + self.assertEqual(once.count("### :lock: Security fixes"), 1) + + def test_empty_entries_remove_the_subsection(self): + once = ch.replace_security_section( + SECURITY_CHANGES, "2.19.1", [self.ENTRY] + ) + removed = ch.replace_security_section(once, "2.19.1", []) + self.assertNotIn(":lock:", removed) + self.assertEqual(removed, SECURITY_CHANGES) + + def test_empty_entries_leave_a_section_without_heading_untouched(self): + self.assertEqual( + ch.replace_security_section(SECURITY_CHANGES, "2.19.1", []), + SECURITY_CHANGES, + ) + + def test_unknown_version_raises(self): + with self.assertRaises(ValueError): + ch.replace_security_section(SECURITY_CHANGES, "9.9.9", [self.ENTRY]) + + +class CmdSecurityTests(unittest.TestCase): + ADVISORIES = [ADVISORY] + PRS = [ + { + "number": 8, + "state": "MERGED", + "labels": ["pr pt"], + "body": "Closes GHSA-j4vc-cmf6-jhr7", + } + ] + + def setUp(self): + self.calls = [] + + def fake_run_gh_py(*args, input_text=None): + self.calls.append(args) + if args[0] == "advisories": + return json.dumps(self.ADVISORIES) + if args[0] == "prs": + return json.dumps(self.PRS) + raise AssertionError(f"unexpected gh.py call: {args}") + + patcher = patch.object(ch, "run_gh_py", side_effect=fake_run_gh_py) + patcher.start() + self.addCleanup(patcher.stop) + + def run_security(self, changes=SECURITY_CHANGES, write=False): + args = argparse.Namespace(milestone="2.19.1", changes=changes, write=write) + out, err = io.StringIO(), io.StringIO() + with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err): + ch.cmd_security(args) + return out.getvalue(), err.getvalue() + + def test_prints_the_section_with_the_linked_pr(self): + out, _ = self.run_security() + self.assertIn("### :lock: Security fixes", out) + self.assertIn("security/advisories/GHSA-j4vc-cmf6-jhr7", out) + self.assertIn("(PR: [#8](https://github.com/penpot/penpot/pull/8))", out) + self.assertEqual( + self.calls[0], ("advisories", "--patched-version", "2.19.1") + ) + + def test_no_advisories_prints_no_section(self): + self.ADVISORIES = [] + self.PRS = [] + out, err = self.run_security() + self.assertEqual(out, "") + self.assertIn("No advisories", err) + + def test_writes_the_section_in_place(self): + with tempfile.TemporaryDirectory() as tmp: + path = pathlib.Path(tmp) / "CHANGES.md" + path.write_text(SECURITY_CHANGES) + _, err = self.run_security(changes=str(path), write=True) + updated = path.read_text() + self.assertIn("### :lock: Security fixes", updated) + self.assertIn("(PR: [#8](https://github.com/penpot/penpot/pull/8))", updated) + self.assertIn(":lock: section updated", err) + + def test_no_advisories_leaves_the_file_untouched(self): + self.ADVISORIES = [] + self.PRS = [] + with tempfile.TemporaryDirectory() as tmp: + path = pathlib.Path(tmp) / "CHANGES.md" + path.write_text(SECURITY_CHANGES) + _, err = self.run_security(changes=str(path), write=True) + updated = path.read_text() + self.assertEqual(updated, SECURITY_CHANGES) + self.assertIn(":lock: section already up to date", err) + + def test_warns_when_a_pr_references_an_unmatched_advisory(self): + self.ADVISORIES = [] + _, err = self.run_security() + self.assertIn("GHSA-J4VC-CMF6-JHR7", err) + self.assertIn("#8", err) + self.assertIn("will not be listed", err) + + if __name__ == "__main__": unittest.main(verbosity=2) diff --git a/scripts/test_gh.py b/scripts/test_gh.py index 3255e8b495..b703b389eb 100644 --- a/scripts/test_gh.py +++ b/scripts/test_gh.py @@ -156,5 +156,69 @@ class CommentsTests(unittest.TestCase): self.assertEqual(error.exception.code, 1) +class AdvisoriesTests(unittest.TestCase): + def advisory(self, patched, ghsa="GHSA-aaaa-bbbb-cccc"): + return { + "ghsa_id": ghsa, + "severity": "medium", + "state": "draft", + "summary": "Something", + "html_url": f"https://github.com/penpot/penpot/security/advisories/{ghsa}", + "vulnerabilities": [ + { + "package": {"name": "penpot"}, + "vulnerable_version_range": "<2.19.1", + "patched_versions": patched, + } + ], + } + + def test_fixed_in_version_matches_exact_tokens(self): + self.assertTrue(gh.advisory_fixed_in_version(self.advisory("2.19.1"), "2.19.1")) + self.assertFalse( + gh.advisory_fixed_in_version(self.advisory("2.19.10"), "2.19.1") + ) + self.assertFalse(gh.advisory_fixed_in_version(self.advisory(""), "2.19.1")) + self.assertFalse( + gh.advisory_fixed_in_version({"vulnerabilities": []}, "2.19.1") + ) + + def test_fixed_in_version_accepts_several_tokens(self): + self.assertTrue( + gh.advisory_fixed_in_version(self.advisory("2.19.0, 2.19.1"), "2.19.1") + ) + self.assertTrue( + gh.advisory_fixed_in_version(self.advisory(" 2.19.1 "), "2.19.1") + ) + + @patch.object(gh, "fetch_advisories") + def test_cmd_advisories_filters_by_patched_version(self, fetch_advisories): + matching = self.advisory("2.19.1", "GHSA-j4vc-cmf6-jhr7") + other = self.advisory("2.19.0", "GHSA-4mmc-j8rh-74pf") + fetch_advisories.return_value = [matching, other] + args = types.SimpleNamespace( + ghsa_id=None, + severity=None, + state=None, + patched_version="2.19.1", + ) + stdout = io.StringIO() + + with contextlib.redirect_stdout(stdout), contextlib.redirect_stderr( + io.StringIO() + ): + gh.cmd_advisories(args) + + results = json.loads(stdout.getvalue()) + self.assertEqual([r["ghsa_id"] for r in results], ["GHSA-j4vc-cmf6-jhr7"]) + # The list output keeps the summary schema: raw vulnerabilities stay + # internal to the filter. + self.assertNotIn("vulnerabilities", results[0]) + self.assertEqual( + results[0]["url"], + "https://github.com/penpot/penpot/security/advisories/GHSA-j4vc-cmf6-jhr7", + ) + + if __name__ == "__main__": unittest.main(verbosity=2)