From b2b2b41dd44cf4e421301c2b3f4e9b4c6dfb2b37 Mon Sep 17 00:00:00 2001 From: Rafael Gonzaga Date: Tue, 18 Aug 2026 11:25:53 -0300 Subject: [PATCH] doc: update security release prepare command MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: RafaelGSS PR-URL: https://github.com/nodejs/node/pull/64699 Reviewed-By: Marco Ippolito Reviewed-By: Juan José Arboleda Reviewed-By: Luigi Pinca --- doc/contributing/releases.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md index da61b360ac9f..c214f8c97cc5 100644 --- a/doc/contributing/releases.md +++ b/doc/contributing/releases.md @@ -377,14 +377,20 @@ git checkout -b v1.2.3-proposal upstream/v1.x-staging You can also run: ```bash -git node release -S --prepare --security=../vulnerabilities.json --filterLabel vX.x +git node release -S --prepare --security=../security-release ``` +The `--security` flag takes the path to your clone of the `security-release` +repository (or directly to a `vulnerabilities.json` file). The reports and +dependency updates to cherry-pick are selected automatically from each entry's +`affectedVersions` mapping for the release line you are on, and the matching +`CVE-ID` trailers are added from the same file. + Example: ```bash git checkout v20.x -git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x +git node release -S --prepare --security=../security-release ``` to automate the remaining steps until step 6 or you can perform it manually @@ -392,7 +398,7 @@ following the below steps. For semver-minors, you can pass the new version explicitly with `--newVersion` arg: ```bash -git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x --newVersion 20.20.0 +git node release -S --prepare --security=../security-release --newVersion 20.20.0 ```