update CLAUDE.md

Author: brendan-kellam

CLAUDE.md

@@ -297,15 +297,15 @@ CVEs often arrive in clusters because one package release fixes several at once.
 
    - **Sibling PR exists and its branch already pins ≥ `<min-patched-version>`**:
      - `gh pr checkout <number>`
-     - Add a CHANGELOG entry for *this* CVE on the same branch (one line per CVE).
+     - **Edit** the existing CHANGELOG line for this PR — append this CVE ID to the comma-separated list. Do not add a new CHANGELOG line.
      - `gh pr edit <number>` to append the CVE ID to the title and body, and add a `Fixes <LINEAR-ID>` line to the PR body alongside any existing `Fixes` lines (this auto-links the Linear issue and Linear will mark it Done when the PR merges).
      - Do not transition the Linear issue manually — leave it for the merge to close.
      - **Do not open a new PR.**
 
    - **Sibling PR exists but its pin is too low to cover this CVE**:
      - Check out the branch.
      - Bump the resolution / package version higher to cover both.
-     - Add a CHANGELOG entry. Update the PR title and body, and add `Fixes <LINEAR-ID>` to the PR body.
+     - **Edit** the existing CHANGELOG line — append this CVE and update the version. Update the PR title and body, and add `Fixes <LINEAR-ID>` to the PR body.
      - Do not transition the Linear issue manually — leave it for the merge to close.
 
    - **No sibling PR exists**:
@@ -315,10 +315,10 @@ CVEs often arrive in clusters because one package release fixes several at once.
 
 ### CHANGELOG and PR conventions for CVE fixes
 
-- CHANGELOG entry (under `[Unreleased] → Fixed`): `Upgraded \`<pkg>\` to \`^x.y.z\` to address CVE-XXXX-XXXXX. [#<PR>]`
-- One CHANGELOG line per CVE, even when multiple CVEs share a PR.
+- CHANGELOG entry (under `[Unreleased] → Fixed`): `Upgraded \`<pkg>\` to \`^x.y.z\` to address CVE-A, CVE-B, .... [#<PR>]`
+- **One CHANGELOG line per PR**, not per CVE. When the PR addresses multiple CVEs (batched), list all of them comma-separated on a single line.
 - PR title format: `chore: upgrade <pkg> to ^x.y.z to address CVE-A, CVE-B, ...` (list every CVE the PR resolves).
-- Keep entries short. The CVE ID is enough.
+- Keep entries short. The CVE IDs are enough.
 
 ## Branches and Pull Requests