-
Task
-
Resolution: Done
-
Critical
-
1.5.0
-
3
-
False
-
-
False
-
-
Captured from: https://github.com/redhat-developer/red-hat-developers-documentation-rhdh/pull/980/files#r1991925892
The whole process for documenting CVEs is changing as of 1.5. We don't intend to put CVEs in the release notes anymore as customers do not look there first; instead they will appear in the security pages under access.redhat.com/security/security-updates/cve
For example, here's a CVE we fixed in 1.4.2 & 1.3.5:
CVE fixed in 1.3.5: issues.redhat.com/browse/RHIDP-5739
CVE fixed in 1.4.2: issues.redhat.com/browse/RHIDP-5740
CVE listed as fixed for 1.3 and 1.4: access.redhat.com/security/cve/CVE-2025-22150 (search for RHDH):
So we no longer need to collect CVEs into the Release Notes. Instead they're collected into the Release CR when pushing the GA bits via Konflux. Process documented here:
Therefore:
- Replace the generated fixed-security issues content with static content containing a link: https://access.redhat.com/security/security-updates/cve?q=red+hat+developer+hub&p=1&sort=cve_publicDate+desc,allTitle+desc&rows=10&documentKind=Cve
- Remove the single-source-fixed-security-issues.sh script and the associated `list-fixed-security-issues*` files.
This is being addressed with 1.5 RN PR: https://github.com/redhat-developer/red-hat-developers-documentation-rhdh/pull/979