feat: security post release blogpost

[marco-ippolito]

Pos release blogpost cc @RafaelGSS

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 82.97%. Comparing base (e3e19b3) to head (0db4650). Report is 5 commits behind head on main.

:exclamation: Current head 0db4650 differs from pull request most recent head 0c11384

Please upload reports for the commit 0c11384 to get more accurate results.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #785      +/-   ##
==========================================
- Coverage   83.08%   82.97%   -0.12%     
==========================================
  Files          37       37              
  Lines        4251     4200      -51     
==========================================
- Hits         3532     3485      -47     
+ Misses        719      715       -4     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[marco-ippolito]

once this lands: https://github.com/nodejs/node-core-utils/pull/788 we can automatically pull in dependencies and openssl updates

[marco-ippolito]

blocked by: https://github.com/nodejs/node-core-utils/pull/788 I will have to update the workflow once this lands

[richardlau]

This is a minor inconsistency note, but we used to add (Update <date>) to the blog posts as they were updated, e.g.

• https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

but didn't in the two most recent releases:

• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

[marco-ippolito]

Update

I thought that's for when the security release is delayed

[marco-ippolito]

Check lint please

lint seems to pass locally what command are you running?

[richardlau]

Update

I thought that's for when the security release is delayed

I thought we also did that to denote the update from the pre-announcement.

[RafaelGSS]

Check lint please

lint seems to pass locally what command are you running?

IIRC we are using * instead of - for listing vulnerabilities (or the inverse :sweat_smile:) and the linter of nodejs.org complains. Try to create a real example with vulnerabilities and run lint

[RafaelGSS]

@marco-ippolito do you need some help here?

[marco-ippolito]

@marco-ippolito do you need some help here?

Feel free to take over

[marco-ippolito]

Also thir PR should fix https://github.com/nodejs-private/security-release/issues/27