Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GHSL-2020-111 #602

Closed
kevinbackhouse opened this issue Jun 15, 2020 · 4 comments
Closed

GHSL-2020-111 #602

kevinbackhouse opened this issue Jun 15, 2020 · 4 comments
Labels

Comments

@kevinbackhouse
Copy link

Hello,

I am a member of the GitHub Security Lab (https://securitylab.github.com).

I've attempted to reach a maintainer for this project to report a potential security issue but have been unable to verify the report was received. Please could a project maintainer could contact us at securitylab@github.com, using reference GHSL-2020-111?

Thank you,
Kevin Backhouse
GitHub Security Lab

@bcoe bcoe added the bug label Jul 12, 2020
@bcoe
Copy link
Member

bcoe commented Jul 12, 2020

@kevinbackhouse thanks for filing this 👍

A little bit of feedback, it's annoying that the commit format of the merged security fix doesn't follow our repositories conventional commit conventions:

GHSA-7xcx-6wjh-7xp2

As a result, we end up in a position where we don't call out @jbottigliero's security fix in the automated release we create.

tldr; your security patch process takes away some of our ability to manage our projects git history.

Edit: for what it's worth, I added a fake commit to the history to address this issue.

@bcoe
Copy link
Member

bcoe commented Jul 12, 2020

@jbottigliero's patch is published in v8.0.1.

@kevinbackhouse
Copy link
Author

@bcoe: Thank you very much for the feedback. I hadn't heard of conventional commits before! I have passed your feedback on to the team that works on the security advisories.

@bcoe
Copy link
Member

bcoe commented Jul 14, 2020

@kevinbackhouse thanks for passing the feedback along 😄

Having the button work like squash and merge, where you can rename would do the trick ... or, better still, I bet folks would be appreciative of you adopting a prefix, like conventional commit ...

security: GitHub Security La Vulnerability Report for GHSL-2020-111

shall we close this issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants