From 4cffabf4c7c19d79753fd9dc3b0d3db65d6483aa Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 23:35:11 +0000 Subject: [PATCH] fix(cve-alerts): allow a major bump when it is the only fix The triage prompt told Claude to change nothing when the only fix was a new major version. Now Claude picks the lowest fixed release of the lowest major that has one, and starts the note with "MAJOR bump" so the reviewer checks for breaking changes. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01E2K27DFf4J3iAGXYpe4xtR --- .github/prompts/cve-fix.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/prompts/cve-fix.md b/.github/prompts/cve-fix.md index d215eecbb0..03696d1dac 100644 --- a/.github/prompts/cve-fix.md +++ b/.github/prompts/cve-fix.md @@ -20,8 +20,11 @@ their own update jobs. - From the OSV records, find the version that fixes each advisory. Pick one exact version that fixes all of them: the lowest release at or above every - fixed version, on the major line of the newest pin in the repo. If the fix - needs a new major version, change nothing and say so in the note. + fixed version, on the major line of the newest pin in the repo. +- When no fixed version exists on that major line, a new major version is the + only fix. Then pick the lowest fixed release of the lowest major that has + one, never higher. Start the note with "MAJOR bump" and name the old and + new versions, so the reviewer checks for breaking changes. - Put every pin of the package in the repo on that exact version, including pins the audit did not flag, so the whole repo runs one version. Find them with the Grep tool: `"": "` in `package.json` files for npm, and @@ -47,8 +50,7 @@ production deployment. Write `$NOTE_FILE` in Markdown for the reviewer: three to six short sentences. Say what you searched, what you found, and whether Onyx is affected. If you -changed nothing, say why (no fix released, needs a major version, OS package, -or GitHub Action). +changed nothing, say why (no fix released, OS package, or GitHub Action). Use plain words, and no headings. Write `$RESULT_FILE` as JSON with exactly these keys: