feat: security post release blogpost

[marco-ippolito]

Pos release blogpost
cc @RafaelGSS

Fixes: https://github.com/nodejs-private/security-release/issues/27

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.97%. Comparing base (e3e19b3) to head (0db4650).
Report is 5 commits behind head on main.

❗ Current head 0db4650 differs from pull request most recent head 0c11384

Please upload reports for the commit 0c11384 to get more accurate results.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #785      +/-   ##
==========================================
- Coverage   83.08%   82.97%   -0.12%     
==========================================
  Files          37       37              
  Lines        4251     4200      -51     
==========================================
- Hits         3532     3485      -47     
+ Misses        719      715       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[marco-ippolito]

once this lands: #788 we can automatically pull in dependencies and openssl updates

[marco-ippolito]

blocked by: #788
I will have to update the workflow once this lands

[RafaelGSS]

I tried it today and it seems to have a lint error when updating the file.

Also, update use the vulnerabilities.json to read the date and patch author

[RafaelGSS]

Check lint please

[richardlau]

This is a minor inconsistency note, but we used to add (Update <date>) to the blog posts as they were updated,
e.g.

• https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

but didn't in the two most recent releases:

• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

[marco-ippolito]

Update

I thought that's for when the security release is delayed

[marco-ippolito]

Check lint please

lint seems to pass locally what command are you running?

[richardlau]

Update

I thought that's for when the security release is delayed

I thought we also did that to denote the update from the pre-announcement.

[RafaelGSS]

Check lint please

lint seems to pass locally what command are you running?

IIRC we are using * instead of - for listing vulnerabilities (or the inverse 😅) and the linter of nodejs.org complains. Try to create a real example with vulnerabilities and run lint

[RafaelGSS]

@marco-ippolito do you need some help here?

[marco-ippolito]

@marco-ippolito do you need some help here?

Feel free to take over

[marco-ippolito]

Also thir PR should fix https://github.com/nodejs-private/security-release/issues/27

[RafaelGSS]

late LGTM 😄