feat: security post release blogpost

[marco-ippolito]

Pos release blogpost cc @RafaelGSS

Fixes: https://github.com/nodejs-private/security-release/issues/27

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 82.97%. Comparing base (8a04848) to head (0db4650). Report is 3 commits behind head on main.

:exclamation: Current head 0db4650 differs from pull request most recent head 585007a. Consider uploading reports for the commit 585007a to get more accurate results

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #785 +/- ## ======================================= Coverage 82.97% 82.97% ======================================= Files 37 37 Lines 4200 4200 ======================================= Hits 3485 3485 Misses 715 715 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[marco-ippolito]

once this lands: https://github.com/nodejs/node-core-utils/pull/788 we can automatically pull in dependencies and openssl updates

[marco-ippolito]

blocked by: https://github.com/nodejs/node-core-utils/pull/788 I will have to update the workflow once this lands

[richardlau]

This is a minor inconsistency note, but we used to add (Update <date>) to the blog posts as they were updated, e.g.

• https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

but didn't in the two most recent releases:

• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
• https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

[marco-ippolito]

Update

I thought that's for when the security release is delayed

[marco-ippolito]

Check lint please

lint seems to pass locally what command are you running?

[richardlau]

Update

I thought that's for when the security release is delayed

I thought we also did that to denote the update from the pre-announcement.

[RafaelGSS]

Check lint please

lint seems to pass locally what command are you running?

IIRC we are using * instead of - for listing vulnerabilities (or the inverse:sweat_smile:) and the linter of nodejs.org complains. Try to create a real example with vulnerabilities and run lint