SSF-122 is our internal reference to security issues detected in SonarSource products. We don’t reveal the content of security issues before the fix is available, to avoid the issues being exploited. I updated the release notes with the description of vulnerability now.
Thanks, this helps. Does this also mean the detailed release notes that we used to see with hyperlinks pointing to SonarSource JIRA are things of the past now ? I can still see them for Java plugin but not for CSS or JS plugins. Looks like release notes are being moved over to GitHub now and eventually it will be done for Java plugin too.
We use github issues instead for JIRA for some of the plugins, but so far there is no strong preference for one tool or the other. I don’t think we are going to move Java anytime soon.
Can I ask you what is missing for you in CSS and JS release notes? To me both tools provide more/less same information, so I would be curious to understand what’s missing.
It’s the level of detail about the changes made. In Jira release notes format, there was always a hyperlink which would provide more details. I do not see that in GitHub release notes.