release notes: include security dependency fixes in AI output

[qiancai]

What is changed, added or deleted? (Required)

Update the AI release-note classification prompt to treat known or reported vulnerability fixes in dependencies shipped with TiDB components as release-note-worthy, even when only dependency manifests or lockfiles change.

Keep dependency updates used exclusively by tests, development or build tooling, or other unshipped code eligible for the not-needed verdict.

Which TiDB version(s) do your changes apply to? (Required)

• master (the latest development version)
• v9.0 (TiDB 9.0 versions)
• v8.5 (TiDB 8.5 versions)
• v8.1 (TiDB 8.1 versions)
• v7.5 (TiDB 7.5 versions)
• v7.1 (TiDB 7.1 versions)
• v6.5 (TiDB 6.5 versions)

What is the related PR or file link(s)?

• This PR is translated from:
• Other reference link(s):
  • release-8.5: add dependency security fixes to v8.5.8 release notes #23710
  • release-8.5: add dependency security fixes to v8.5.8 release notes docs-cn#21913

AI agent involvement

• The changes in this PR were primarily made by an AI agent on behalf of the PR author.

Do your changes match any of the following descriptions?

• Delete files
• Change aliases
• Need modification after applied to another branch
• Might cause conflicts after applied to another branch

Summary by CodeRabbit

• Documentation
  • Updated release-note guidance to require notes for security fixes addressing known or reported vulnerabilities in dependencies shipped with product components, including manifest- or lockfile-only changes.
  • Clarified that these updates are not internal-only when they affect shipped components.
  • Specified that dependency changes affecting only tests, unshipped code, development or build tooling, or components unaffected by the vulnerability may remain internal-only.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 622d2c3b-15f5-45f9-8d1a-a17625c2af02

📥 Commits

Reviewing files that changed from the base of the PR and between 8b1338b and 5ab68e2.

📒 Files selected for processing (1)

• scripts/release-notes-ai-generator/prompts/release-note.md

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The release-note prompt now requires release notes for security fixes in dependencies shipped with TiDB components. Manifest-only and lockfile-only fixes are included. Internal-only classification remains limited to test-only, unshipped, or unaffected dependencies.

Changes

Security dependency classification

Layer / File(s)	Summary
Release-note prompt rules scripts/release-notes-ai-generator/prompts/release-note.md	The prompt classifies shipped security dependency fixes as release-note items, including manifest-only and lockfile-only changes. It limits not_needed to test-only, unshipped, or unaffected dependencies.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: 🟡 Moderate · up to 5ab68

Shipped dependency vulnerability fixes may still be omitted from release notes when classified through the indirect-impact fallback, reducing visibility of security-relevant updates. This should be resolved before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains the prompt change, affected version, reference links, AI involvement, and applicable checklist items. It provides the required information and is sufficiently complete.
Title check	✅ Passed	The title clearly and concisely identifies the main change: including security-related dependency fixes in generated release notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 554ec7ee-eda9-4dec-ab8b-2cd2927cf1ea

📥 Commits

Reviewing files that changed from the base of the PR and between 49887c1 and 7b08bc7.

📒 Files selected for processing (1)

• scripts/release-notes-ai-generator/prompts/release-note.md

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

[qiancai]

/approve

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiancai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [qiancai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment