We always ship advisories (errata) for all runtimes:

• Java-based runtimes: we only ship text-only advisories to let our customers know that new release is available
  • the QE process for handling errata is described at https://gitlab.cee.redhat.com/rhoar-qe/docs/blob/master/errata.md
• Node.js releases RPMs and container images through Errata Tool