From 8651e25440b340a3a86312c3507fcbf88bfa4ff0 Mon Sep 17 00:00:00 2001 From: Sorin Marta Date: Tue, 21 Jul 2026 07:32:27 +0300 Subject: [PATCH] Omit security fixes from release changelogs Keep vulnerability details out of public README changelog entries. --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a204bb163..fe053e949 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -80,6 +80,7 @@ jobs: - Each subsequent line: * New: , * Enhancement: , or * Fix: followed by a concise user-facing description - Group related changes into single entries - Skip merge commits, CI/tooling changes, dependency updates, and non-user-facing changes + - Omit any security-related fixes entirely (auth bypasses, XSS, CSRF, privilege escalation, sanitization/escaping hardening for vulnerabilities, CVEs, etc.). Do not describe them and do not add vague placeholders like "* Fix: Security improvements" or "* Fix: Security Vulnerabilities". If a change mixes security and non-security work, include only the non-security user-facing parts. - Match the exact formatting style of the existing entries in README.TXT - End the entry with an empty line before the next entry