feat: security post release blogpost

[marco-ippolito]

Pos release blogpost
cc @RafaelGSS

Fixes: https://github.com/nodejs-private/security-release/issues/27

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.97%. Comparing base (8a04848) to head (0db4650).
Report is 3 commits behind head on main.

❗ Current head 0db4650 differs from pull request most recent head 585007a. Consider uploading reports for the commit 585007a to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #785   +/-   ##
=======================================
  Coverage   82.97%   82.97%           
=======================================
  Files          37       37           
  Lines        4200     4200           
=======================================
  Hits         3485     3485           
  Misses        715      715           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[marco-ippolito]

once this lands: #788 we can automatically pull in dependencies and openssl updates

[marco-ippolito]

blocked by: #788
I will have to update the workflow once this lands

[RafaelGSS]

I tried it today and it seems to have a lint error when updating the file.

Also, update use the vulnerabilities.json to read the date and patch author

[RafaelGSS]

Check lint please

[richardlau]

This is a minor inconsistency note, but we used to add (Update <date>) to the blog posts as they were updated,
e.g.

• https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

but didn't in the two most recent releases:

• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

[marco-ippolito]

Update

I thought that's for when the security release is delayed

[marco-ippolito]

Check lint please

lint seems to pass locally what command are you running?

[richardlau]

Update

I thought that's for when the security release is delayed

I thought we also did that to denote the update from the pre-announcement.

[RafaelGSS]

Check lint please

lint seems to pass locally what command are you running?

IIRC we are using * instead of - for listing vulnerabilities (or the inverse:sweat_smile:) and the linter of nodejs.org complains. Try to create a real example with vulnerabilities and run lint