Repository navigation
Backlog: Adopt OpenJS CNA for CVE Operations #1576
Description
This issue is for tracking the initiative to adopt OpenJS CNA for CVE Operations.
Blockers:
- We are waiting until
Phase 1: Build the APIOpenJS CNA API to support project operations openjs-foundation/security-wg#337 is completed to porperly test the workflow with NCU
Backlog:
- Update Node.js Security process documentation (doc: document OpenJS CNA publication step in security release node#63894)
- Add support to the OpenJS CNA to NCU (Support OpenJS Foundation CNA as CVE source node-core-utils#1093)
- Check how the H1 integration will work (confirm workflow and data details)
- Check if @UlisesGascon can get an API Token in H1 to validate the implementation
References:
Pinned by UlisesGascon
So... Ideally tomorrow we can discuss about this approach:
- Big picture: nodejs/node#67084
- Reservation step: nodejs/node-core-utils#1232
- Publication step: nodejs-private/security-release#89
The publication one can be much more iterated but I need first to publish @openjsfoundation/cna-tools (see: https://github.com/UlisesGascon/openjs-cna-tools) and that way we reduce a lot duplicated code including CVSS transformation, etc...
Activity
github-actions commentedon Oct 5, 2026
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
UlisesGascon commentedon Oct 28, 2026
So... Ideally tomorrow we can discuss about this approach:
The publication one can be much more iterated but I need first to publish
@openjsfoundation/cna-tools(see: https://github.com/UlisesGascon/openjs-cna-tools) and that way we reduce a lot duplicated code including CVSS transformation, etc...