Maintainer Controls Feedback

[psmoros]

What do you think of the new maintainer controls? Do you like them? Were they easy to find and use?

Please let us know below :)

[mvz]

It's confusing that you still have to click the same action below the comment box.

[JamieSlome]

Just re-posting some feedback from @foosel:

A friendly suggestion, would it be possible to add some option to mark this as "in progress" in the future? IMHO there's definitely a state between "awaiting fix" and "fixed and can go public right away"

[hpjansson]

Somewhat relatedly, it'd be nice to be able to indicate the fix as a commit only without having to make a versioned release. That way one can take the time to roll more fixes into a single release, which saves both the maintainer and downstream packagers time. If someone urgently needs the fix, they can grab the commit and apply it as a patch in their build system.

[myvesta]

Many thanks for finding issues in myVesta / Hestia / Vesta :)
If I can send you a bounty, please tell me how.

[tommoor]

I need to be able to mark an issue Duplicate but of something external. In this case it was already reported in our public issue tracker. What is the recommended way of doing this?

[JamieSlome]

@tommoor - currently, we do not have a way of marking something as a duplicate to an external resource, but we are aware of the need for this - thanks for bumping :)

In the meantime, you can always mark as informative, and just ensure you have provided the URL to the external reference in your reasoning 👍

[mvz]

When marking an issue as valid, you can change the severity, but then the Mark as valid button no longer works. I just lost my entire CVE descriptiion 😢

[mvz]

It's even worse: If I want to change the description from the given value (which is too generic and uninformative in this case), the Mark as valid button is grayed out. So it's impossible to change the description.

[JamieSlome]

@benharvie - can we create an internal bug ticket on the above issues mentioned by @mvz?

[mitchelsellers]

It would be awesome if we could "mark as fixed" but delay disclosure. The situation we have is that we have a fix, its validated, but our release is about 4-6 weeks out yet. I'll have to maintain the list, with the SHA of the commit then update later.

[psmoros]

This has been delivered 🥳

[icret]

Thank you for your feedback. I hope you can continue to pay attention to the code. Thanks again!

[patrys]

Please allow reports to be closed as duplicates of reports from other repositories the current user can access.

[psmoros]

Thanks for the feedback :))

[benharvie]

Feedback from @BelleNottelling

• Tooltips on each action, wasn't sure whether each action was instant or required more information.
• CVE input information after scheduled publication shows the old title/description and not the previously populated title/description.
• An alternative valid state where a report is valid but is of poor content quality so that the researcher does not gain full reputation points despite the vulnerability being valid.

[ankush]

Allow reopening accidentally closed issues.