The 🔒 section is generated from advisories instead of being written
by hand: an advisory becomes an entry when its patched_versions include
the release version, so unpublished (triage/draft) advisories are valid.
- gh.py advisories --patched-version filters on the exact token of
vulnerabilities[*].patched_versions; the list output keeps the summary
schema.
- changelog.py security renders the entries sorted by GHSA id, links the
merged milestone PRs labelled "pr pt" that reference the GHSA id and
warns when a reference has no matching patched version. The subsection
follows 🚀 (or 💥, or the version header) and is removed
when the version has no advisories.
- Tests cover the filter, the entry rendering, PR discovery and the
subsection placement.
- Memories and the update-changelog skill document the contract.
- CHANGES.md: add 2.19.1 with its security fixes and the remaining bug
fix.
AI-assisted-by: deepseek-v4.1-flash
Add a `boom` subcommand that generates the `💥` section of CHANGES.md
from the closed, non-excluded milestone issues labelled `breaking change`,
using the last `## Breaking change note` comment of each issue. The whole
comment is copied (headings demoted to `#####` outside code fences), and
each issue becomes a `#### <title>` block with the issue and merged
closing PR references on their own line. `--write` replaces only that
subsection and is idempotent.
Add a `comments` subcommand to gh.py (REST, paginated) so the generator can
read issue comments, and report anomaly type G (`breaking change` issue
missing from `💥`), mirroring the `release highlight` check.
Document the flow in `mem:workflow/updating-changelog` (also readable by
release managers, like `mem:audit-log`), turn the `update-changelog` skill
into a router to it, and update the references in `critical-info`,
`creating-issues` and the scripts memories.
AI-assisted-by: deepseek-v4.1-flash
