Andrey Antukh d5c4bfb234 ✨ Add security fixes section to the changelog flow ...

The 🔒 section is generated from advisories instead of being written
by hand: an advisory becomes an entry when its patched_versions include
the release version, so unpublished (triage/draft) advisories are valid.

- gh.py advisories --patched-version filters on the exact token of
  vulnerabilities[*].patched_versions; the list output keeps the summary
  schema.
- changelog.py security renders the entries sorted by GHSA id, links the
  merged milestone PRs labelled "pr pt" that reference the GHSA id and
  warns when a reference has no matching patched version. The subsection
  follows 🚀 (or 💥, or the version header) and is removed
  when the version has no advisories.
- Tests cover the filter, the entry rendering, PR discovery and the
  subsection placement.
- Memories and the update-changelog skill document the contract.
- CHANGES.md: add 2.19.1 with its security fixes and the remaining bug
  fix.

AI-assisted-by: deepseek-v4.1-flash

2026-11-10 18:18:00 +00:00

..

memories

✨ Add security fixes section to the changelog flow

2026-11-10 18:18:00 +00:00

.gitignore

📎 Backport devenv improvements

2026-06-05 11:44:20 +02:00

project.yml

⬆️ Update Serena to 1.6.1 in agentic devenv (#10770)

2026-07-22 09:35:50 +02:00