Human-readable release notes are published on GitHub Releases. They are generated by semantic-release from Conventional Commits (not raw git log). Container users upgrade via newer ghcr.io/wfcd/warframe-hub tags; web users via the Vercel/dev deployment.
See also CI.md.
Criterion: each release’s notes MUST identify every publicly known run-time vulnerability fixed in that release that already had a CVE (or similar public ID) when the release was created.
Scope notes from the criterion:
- Applies to this project’s results (hub application / first-party code we ship), not to unrelated dependency CVEs fixed only by bumping third-party packages with no hub-specific advisory.
- If there are no such publicly known vulnerabilities (the usual case so far), the badge answer is N/A.
- Users can update themselves (pull a new image or redeploy), so “kernel-style N/A” does not apply.
If a release fixes a run-time issue in hub code that already has a public ID (CVE, GHSA for this repo’s code, etc.):
- Prefer a Conventional Commit that names the ID, e.g.
fix: prevent XSS in panel title (CVE-20XX-NNNNN)
or body/footer:Fixes: CVE-20XX-NNNNN/Refs: GHSA-xxxx. - Confirm the generated GitHub Release notes explicitly list that ID and a short user-facing summary (edit the release text after publish if the generator omitted it).
- Link the advisory when one exists.
Dependency-only bumps (Dependabot / overrides with no first-party CVE) do not need a CVE line under this criterion; optional mention in notes is fine for operators but is out of scope for the badge item.
| Situation | Suggested answer |
|---|---|
| No project CVE/GHSA fixes in releases yet | N/A — “No publicly known run-time vulnerabilities with CVE/similar IDs have been fixed in project releases to date. Policy: docs/RELEASES.md. Notes: GitHub Releases.” |
| A release fixed such an issue | Met — URL to that GitHub Release (and keep following this policy) |
- SECURITY.md — how to report vulnerabilities
- README.md — Cosign / SBOM verify for released images