From 660d84661d32b271a037e4af25856833d49dca99 Mon Sep 17 00:00:00 2001 From: Henrique Dias Date: Sat, 25 Jul 2026 08:47:34 +0200 Subject: [PATCH] docs: update CLAUDE.md --- .claude/CLAUDE.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index cbe70fdc..3c5db23a 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -100,11 +100,16 @@ gh api -X PATCH .../security-advisories/GHSA-xxxx-xxxx-xxxx \ ## 7. Set affected & patched versions The package is always `{ecosystem: "go", name: "github.com/filebrowser/filebrowser/v2"}`. -`patched_versions` must be the release that will actually ship the fix (cut it — it does not exist just -because the branch does). + +- `vulnerable_version_range` — `<= ` (the newest tag; find it with + `git tag --list 'v2.*' --sort=-version:refname | head -1`). +- `patched_versions` — the **next** release that will actually ship the fix. It doesn't exist just + because the branch does; it still has to be cut. **When unsure which version that will be, ask.** + +Replace the placeholder versions below before sending: ```bash -printf '%s' '{"vulnerabilities":[{"package":{"ecosystem":"go","name":"github.com/filebrowser/filebrowser/v2"},"vulnerable_version_range":"<= 2.63.18","patched_versions":"2.63.19","vulnerable_functions":[]}]}' \ +printf '%s' '{"vulnerabilities":[{"package":{"ecosystem":"go","name":"github.com/filebrowser/filebrowser/v2"},"vulnerable_version_range":"<= ","patched_versions":"","vulnerable_functions":[]}]}' \ | gh api -X PATCH .../security-advisories/GHSA-xxxx-xxxx-xxxx --input - ```