Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: c82028ac3a0f2e81c2dd24773bad4b5cfa06bc3f https://github.com/xwiki/xwiki-dev-llm/commit/c82028ac3a0f2e81c2dd24773bad4b... Author: Vincent Massol <[email protected]> Date: 2026-10-14 (Wed, 14 Oct 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md M xwiki/skills/xwiki-security-advisory/references/affected-products.md Log Message: ----------- [Misc] Security advisory skill: check for an existing advisory, read CVSS 4 vectors, find assembly repackaging (#270) * Step 1 checks for an existing advisory (JIRA `Security Advisory` web link and a GHSA referencing the key) before drafting, and Step 6 re-runs it before creating one * Step 1 says what an empty `security` field means (disclosed, or filed public and to be made Confidential first) * Step 3 reads the vector from `.cvss_severities.cvss_v4` (`.cvss` is CVSS 3 only), filters on `state=published` server side and paginates * Step 3 no longer assumes precedents with a CVSS table: it names the two published advisories that comment each metric and falls back on Step 2's guidance * affected-products.md finds repackaging through assembly `<dependencySet>` as well as `<artifactItem>`, with one `git grep` tested on xwiki-platform * affected-products.md covers non-jar packages, distributions that repackage the code, and sibling variants the fix did not touch Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications