release notes: include security dependency fixes in AI output

[qiancai]

What is changed, added or deleted? (Required)

Update the AI release-note classification prompt to treat known or reported vulnerability fixes in dependencies shipped with TiDB components as release-note-worthy, even when only dependency manifests or lockfiles change.

Keep dependency updates used exclusively by tests, development or build tooling, or other unshipped code eligible for the not-needed verdict.

Which TiDB version(s) do your changes apply to? (Required)

• master (the latest development version)
• v9.0 (TiDB 9.0 versions)
• v8.5 (TiDB 8.5 versions)
• v8.1 (TiDB 8.1 versions)
• v7.5 (TiDB 7.5 versions)
• v7.1 (TiDB 7.1 versions)
• v6.5 (TiDB 6.5 versions)

What is the related PR or file link(s)?

• This PR is translated from:
• Other reference link(s):
  • release-8.5: add dependency security fixes to v8.5.8 release notes #23710
  • release-8.5: add dependency security fixes to v8.5.8 release notes docs-cn#21913

AI agent involvement

• The changes in this PR were primarily made by an AI agent on behalf of the PR author.

Do your changes match any of the following descriptions?

• Delete files
• Change aliases
• Need modification after applied to another branch
• Might cause conflicts after applied to another branch

Summary by CodeRabbit

• Documentation
  • Updated release-note guidance to require notes for security fixes addressing known or reported vulnerabilities in dependencies shipped with product components, including changes limited to dependency manifests or lockfiles.
  • Clarified that these updates should not be treated as internal-only.
  • Confirmed that dependency changes affecting only tests, development or build tooling, or other non-shipped code do not require release notes.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign oreoxmt for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: ccb00b90-ee4a-4d6e-9055-70f73bf53e4f

📥 Commits

Reviewing files that changed from the base of the PR and between 7b08bc7 and 8b1338b.

📒 Files selected for processing (1)

• scripts/release-notes-ai-generator/prompts/release-note.md

Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release-note prompt requires release notes for security fixes in dependencies shipped with TiDB components. It excludes dependencies used exclusively by tests, development or build tooling, or other non-shipped code.

Changes

Security dependency classification

Layer / File(s)	Summary
Release-note prompt rules scripts/release-notes-ai-generator/prompts/release-note.md	The prompt classifies shipped security dependency fixes as release-note items, including manifest-only and lockfile-only changes. It limits not_needed to dependencies used exclusively by non-shipped code.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: 🟡 Moderate · up to 8b133

Shipped dependency vulnerability fixes may still be omitted from release notes when their impact appears indirect, leaving the intended security-release-note classification incomplete. Clarify the rule precedence before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding security dependency fixes to AI-generated release-note output.
Description check	✅ Passed	The description explains the change, identifies the affected master version, provides reference links, records AI involvement, and addresses the listed change categories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 554ec7ee-eda9-4dec-ab8b-2cd2927cf1ea

📥 Commits

Reviewing files that changed from the base of the PR and between 49887c1 and 7b08bc7.

📒 Files selected for processing (1)

• scripts/release-notes-ai-generator/prompts/release-note.md

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.