From 7309beaf255d639b92c3931856f4869e223d90c0 Mon Sep 17 00:00:00 2001 From: RafaelGSS Date: Thu, 23 Jul 2026 12:37:49 -0300 Subject: [PATCH] doc: update security release prepare command Signed-off-by: RafaelGSS --- doc/contributing/releases.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md index c6b51bc2acffe9..abdf8c20cfeb70 100644 --- a/doc/contributing/releases.md +++ b/doc/contributing/releases.md @@ -377,14 +377,20 @@ git checkout -b v1.2.3-proposal upstream/v1.x-staging You can also run: ```bash -git node release -S --prepare --security=../vulnerabilities.json --filterLabel vX.x +git node release -S --prepare --security=../security-release ``` +The `--security` flag takes the path to your clone of the `security-release` +repository (or directly to a `vulnerabilities.json` file). The reports and +dependency updates to cherry-pick are selected automatically from each entry's +`affectedVersions` mapping for the release line you are on, and the matching +`CVE-ID` trailers are added from the same file. + Example: ```bash git checkout v20.x -git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x +git node release -S --prepare --security=../security-release ``` to automate the remaining steps until step 6 or you can perform it manually @@ -392,7 +398,7 @@ following the below steps. For semver-minors, you can pass the new version explicitly with `--newVersion` arg: ```bash -git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x --newVersion 20.20.0 +git node release -S --prepare --security=../security-release --newVersion 20.20.0 ```