kova-ghsa-maintainer

To update a GitHub Security Advisory, fetch the current GHSA state, validate the linked private fork has no open PRs, assemble Markdown-to-JSON payloads safely, apply the PATCH in correct sequence, and verify the post-publish description formatting contains no escaped newline literals.

Publishing a GitHub Security Advisory fails with HTTP 422 when the linked advisory private fork has open pull requests. You must verify the private fork has no open PRs before attempting any publish action to avoid this validation failure.

Correct PATCH sequencing for GitHub Security Advisories requires building Markdown and JSON payloads safely, applying updates to required fields in the proper order, and executing a post-publish re-fetch to verify description formatting contains no escaped newline literals.

Validating a private fork before publishing a GitHub Security Advisory involves fetching the current advisory state via the GH API and performing an open-PR verification on the linked private fork to ensure it is in a publishable state.

Ensuring npm versioning context matches when updating GitHub Security Advisories requires fetching the current GHSA state and checking the latest published npm version to confirm the advisory context matches the package reality before applying patches.

Escaped newline literals in published GitHub Security Advisory descriptions occur during unsafe Markdown-to-JSON assembly. Prevent this by building payloads safely, applying correct PATCH sequencing for constrained fields, and performing a post-publish re-fetch verification.