feat: sort by severity on post-release

Author: RafaelGSS

lib/security_blog.js

@@ -14,6 +14,8 @@ import {
 import auth from './auth.js';
 import Request from './request.js';
 
+const SEVERITY_ORDER = ['critical', 'high', 'medium', 'low'];
+
 export default class SecurityBlog extends SecurityRelease {
   req;
 
@@ -256,7 +258,8 @@ export default class SecurityBlog extends SecurityRelease {
   }
 
   async getReportsTemplate(content) {
-    const reports = content.reports;
+    const reports = [...content.reports].sort((a, b) =>
+      this.getSeverityOrder(a) - this.getSeverityOrder(b));
     let template = '';
     for (const report of reports) {
       const cveId = report.cveIds?.join(', ');
@@ -282,6 +285,13 @@ export default class SecurityBlog extends SecurityRelease {
     return template;
   }
 
+  getSeverityOrder(report) {
+    const rating = report.severity?.rating?.toLowerCase();
+    const index = SEVERITY_ORDER.indexOf(rating);
+    if (index === -1) return SEVERITY_ORDER.length;
+    return index;
+  }
+
   getDependencyUpdatesTemplate(dependencyUpdates) {
     if (typeof dependencyUpdates !== 'object') return '';
     if (Object.keys(dependencyUpdates).length === 0) return '';

test/unit/security_release.test.js

@@ -301,6 +301,31 @@ describe('security_blog: post-release severity wording', () => {
     assert.throws(() => blog.getVulnerabilities(content), /severity\.rating not found for report 1/);
   });
 
+  it('sorts post-release reports by severity', async() => {
+    const blog = new SecurityBlog();
+    const createReport = (title, rating) => ({
+      title,
+      cveIds: [`CVE-2026-${title}`],
+      severity: { rating },
+      summary: 'summary',
+      affectedVersions: ['24.x'],
+      patchAuthors: ['nodejs'],
+      reporter: 'reporter',
+      link: `https://hackerone.com/reports/${title}`
+    });
+
+    const output = await blog.getReportsTemplate({
+      reports: [
+        createReport('low-report', 'low'),
+        createReport('high-report', 'high'),
+        createReport('medium-report', 'medium')
+      ]
+    });
+
+    assert.ok(output.indexOf('## high-report') < output.indexOf('## medium-report'));
+    assert.ok(output.indexOf('## medium-report') < output.indexOf('## low-report'));
+  });
+
   it('formats dependency update object versions', () => {
     const blog = new SecurityBlog();