Branch: refs/heads/vmassol/security-advisory-gaps Home: https://github.com/xwiki/xwiki-dev-llm Commit: 44b1ab6b270591208c22cc34ffb2c806cf43725c https://github.com/xwiki/xwiki-dev-llm/commit/44b1ab6b270591208c22cc34ffb2c8... Author: Vincent Massol <[email protected]> Date: 2026-10-13 (Tue, 13 Oct 2026) Changed paths: M xwiki/skills/xwiki-security-advisory/SKILL.md M xwiki/skills/xwiki-security-advisory/references/affected-products.md Log Message: ----------- [Misc] Security advisory skill: check for an existing advisory, read CVSS 4 vectors, find assembly repackaging * Step 1 checks for an existing advisory (JIRA `Security Advisory` web link and a GHSA referencing the key) before drafting, and Step 6 re-runs it before creating one * Step 1 says what an empty `security` field means (disclosed, or filed public and to be made Confidential first) * Step 3 reads the vector from `.cvss_severities.cvss_v4` (`.cvss` is CVSS 3 only), filters on `state=published` server side and paginates * Step 3 no longer assumes precedents with a CVSS table: it names the two published advisories that comment each metric and falls back on Step 2's guidance * affected-products.md finds repackaging through assembly `<dependencySet>` as well as `<artifactItem>`, with one `git grep` tested on xwiki-platform * affected-products.md covers non-jar packages, distributions that repackage the code, and sibling variants the fix did not touch Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications