From c4c6472fcf6e87750e61becff863c1b600c5c032 Mon Sep 17 00:00:00 2001 From: coleenquadros Date: Mon, 20 Apr 2026 14:46:37 +0000 Subject: [PATCH 1/2] chore: update CVE fix guidance (2026-04-20) Refreshed .cve-fix/examples.md with patterns from PRs/commits since 2026-04-16. Changes: - Added alternate title format: fix(cve): CVE-YYYY-XXXXX - package - Added npm/JS ecosystem file co-change rules (web/ui/package.json, package-lock.json, embed.go, static/*.gz) - Added npm override strategy for transitive dep CVEs - Expanded PR description guidance (impact, vuln range, fixed version, Resolves: ACM-XXXXX, bot markers) - Updated last-analyzed date to 2026-04-20 - Added limited-data warning (0 new merges since last analysis) Co-Authored-By: PR Guidance Generator --- .cve-fix/examples.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.cve-fix/examples.md b/.cve-fix/examples.md index a1bf7586df5..844fe9fae09 100644 --- a/.cve-fix/examples.md +++ b/.cve-fix/examples.md @@ -1,29 +1,39 @@ - + ## Titles - `Security: Fix CVE-YYYY-XXXXX ()` (4/27 merged PRs) - e.g. `Security: Fix CVE-2026-33186 (grpc-go)` - - e.g. `Security: Fix CVE-2026-33186 (grpc-go)` +- `fix(cve): CVE-YYYY-XXXXX - ` — alternate format used by CVE Fixer workflow (1 open PR + 1 commit) + - e.g. `fix(cve): CVE-2025-13465 - lodash` ## Branches - `fix/cve----attempt-N` (4/27 merged PRs) - e.g. `fix/cve-2026-33186-grpc-go-release-2.14-attempt-1` - - e.g. `fix/cve-2026-33186-grpc-go-release-2.15-attempt-1` + - e.g. `fix/cve-2025-13465-lodash-release-2.14-attempt-1` - `dependabot//-` (3/27 merged PRs) - e.g. `dependabot/go_modules/github.com/golang-jwt/jwt/v5-5.2.2` - e.g. `dependabot/go_modules/golang.org/x/crypto-0.35.0` -## Files +## Files — Go ecosystem - `go.mod` + `go.sum` always change together for Go dependency updates - `Dockerfile` / `Containerfile.operator` may also be updated (Go version bumps) +## Files — npm/JS ecosystem (web/ui) +- `web/ui/package.json` + `web/ui/package-lock.json` change together for npm CVEs (1 open PR) +- `web/ui/embed.go` updated when embedded assets are rebuilt +- `web/ui/static/**/*.gz` files regenerated (compressed static assets rebuilt) + ## Co-upgrades - When bumping a Go dependency, always run `go mod tidy` to update `go.sum` - Go version bumps (`go.mod` directive) often require updating `Dockerfile` / `Containerfile.operator` +- For transitive npm deps (e.g. lodash): use `overrides.: "^"` in `package.json` (1 open PR) ## PR Description - Include CVE ID, severity, and affected package in description +- Include impact description, vulnerable version range, and fixed version - Reference the target branch (e.g. `release-2.16`) when targeting non-default branches +- Include Jira reference in format: `Resolves: ACM-XXXXX` (1 open PR + commit) +- For bot-generated PRs: preserve `🤖 Generated by CVE Fixer Workflow` and `` markers (1 open PR) - Include test results section - For multi-branch fixes, create separate PRs per branch (not a single PR) From aaaefe05608c9f38ec154b494bf22312e0264a8c Mon Sep 17 00:00:00 2001 From: coleenquadros Date: Mon, 20 Apr 2026 14:49:46 +0000 Subject: [PATCH 2/2] chore: add npm asset build steps to CVE guidance Document the required build sequence for npm/JS CVE fixes in web/ui: 1. npm install (resolves override) 2. build_ui.sh --all (rebuilds React app) 3. compress_assets.sh (regenerates .gz files + embed.go) These steps produce ~66 changed asset files and must be run in order. Co-Authored-By: PR Guidance Generator --- .cve-fix/examples.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.cve-fix/examples.md b/.cve-fix/examples.md index 844fe9fae09..9ef46710c55 100644 --- a/.cve-fix/examples.md +++ b/.cve-fix/examples.md @@ -20,9 +20,14 @@ ## Files — npm/JS ecosystem (web/ui) - `web/ui/package.json` + `web/ui/package-lock.json` change together for npm CVEs (1 open PR) -- `web/ui/embed.go` updated when embedded assets are rebuilt +- `web/ui/embed.go` updated when embedded assets are rebuilt (~66 files total change) - `web/ui/static/**/*.gz` files regenerated (compressed static assets rebuilt) +## Build steps — npm/JS ecosystem (must run in order) +1. `npm install` — resolves the override and updates `package-lock.json` +2. `build_ui.sh --all` — rebuilds the React app +3. `compress_assets.sh` — regenerates all `.gz` files and updates `embed.go` + ## Co-upgrades - When bumping a Go dependency, always run `go mod tidy` to update `go.sum` - Go version bumps (`go.mod` directive) often require updating `Dockerfile` / `Containerfile.operator`