From 4ed593efbc3f7d8919f253389110fd3d671883ce Mon Sep 17 00:00:00 2001 From: guglielmoc Date: Tue, 27 Oct 2026 15:50:27 +0000 Subject: [PATCH 1/2] docs: add guidelines for reporting non-security issues in SECURITY.md --- SECURITY.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 502924200..65738e0a6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -11,6 +11,15 @@ for this repository. Please **do not** report security vulnerabilities through public GitHub issues, discussions, or pull requests. +## Report as a Regular Issue + +Open a public issue, or send a pull request, for: + +- Crashes or hangs of a client caused by the server it connected to +- Spec-compliance gaps, missing validation, and hardening suggestions without a concrete attack +- Resource exhaustion that requires non-default configuration +- Static-analysis or other tool findings without a demonstrated impact + ## What to Include To help us triage and respond quickly, please include: From 7c1794550b3bce810183a2e085146d25591d6bf8 Mon Sep 17 00:00:00 2001 From: guglielmoc Date: Wed, 28 Oct 2026 08:28:43 +0000 Subject: [PATCH 2/2] refactor: streamline PR intake gate bot messages and CONTRIBUTING guidelines regarding AI-generated code --- .github/scripts/pr_intake_gate.js | 23 ++++++++--------------- CONTRIBUTING.md | 3 +-- 2 files changed, 9 insertions(+), 17 deletions(-) diff --git a/.github/scripts/pr_intake_gate.js b/.github/scripts/pr_intake_gate.js index eb1b1f53c..48dad053e 100644 --- a/.github/scripts/pr_intake_gate.js +++ b/.github/scripts/pr_intake_gate.js @@ -143,28 +143,21 @@ module.exports = async function run({ github, context, core }) { const rule = `${opener}This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue`; const situation = linkedIssues.length ? [ - `${rule}, and you aren't currently assigned to ${issues}.`, - '', - `If a maintainer assigns you to ${issues}, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.`, - ] + `${rule}, and you aren't currently assigned to ${issues}.`, + ] : [ - `${rule}, and this PR doesn't link an open issue yet.`, - '', - "- **If you're already assigned to an issue for this**, add `Fixes #` (or `Updates #` for a partial fix) to the description and the PR will reopen on its own.", - `- **If there's no issue yet**, please [open one](https://github.com/${owner}/${repo}/issues/new/choose) instead: what you ran into, where you hit it, and a minimal reproduction. That context is what we use to decide what to prioritize.`, - "- **If there's an issue but you're not assigned**, add `Fixes #` anyway so they're linked, then engage on the issue itself by confirming the repro or describing the approach you'd take. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. If you are assigned, this PR reopens automatically.", - ]; + `${rule}, and this PR doesn't link an open issue yet.`, + '', + "- **If you're already assigned to an issue for this**, add `Fixes #` (or `Updates #` for a partial fix) to the description and the PR will reopen on its own.", + `- **If there's no issue yet**, please [open one](https://github.com/${owner}/${repo}/issues/new/choose) instead: what you ran into, where you hit it, and a minimal reproduction. That context is what we use to decide what to prioritize.`, + "- **If there's an issue but you're not assigned**, add `Fixes #` anyway so they're linked, then engage on the issue itself by confirming the repro or describing the approach you'd take. Assignment is a maintainer call based on capacity. If you are assigned, this PR reopens automatically.", + ]; return [ MARKER, ...situation, '', "You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned. There's no need to open a new PR either way.", '', - `[CONTRIBUTING.md](${contributingUrl}) has the full reasoning, but in short:`, - '', - "- We're a small team with limited capacity to review community PRs.", - '- Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.', - '', `*Maintainers: reopen, remove \`${LABEL}\`, or add \`${BYPASS_LABEL}\` to override.*`, ].join('\n'); } diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4bfbbca2e..541c86df7 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -46,8 +46,7 @@ transparently, while adhering to these goals. ### Why issues rather than pull requests -The SDK is maintained by a small team with limited time for review. Coding -agents can now turn any open issue into a plausible-looking pull request within +Coding agents can now turn any open issue into a plausible-looking pull request within hours, and generate speculative bug reports from a scan of the code, so we receive far more issues and PRs than we can read carefully. Reviewing a PR properly still takes as long as it always did. When an issue is well described,