From 125a0a9dd22b54b54e360d3852ef8819b1fa8e95 Mon Sep 17 00:00:00 2001
From: mariatta <mariatta.wijaya@gmail.com>
Date: Wed, 21 Oct 2026 13:12:14 -0700
Subject: [PATCH 1/2] Show the CVE field only when the Security section is
 selected

The CVE identifier only applies to Security entries, and the server
rejects it for any other section. Hide the field until Security is
chosen in the section dropdown, and clear it when the selection moves
away so a stale value is never submitted.
---
 templates/add_blurb.html | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/templates/add_blurb.html b/templates/add_blurb.html
index ce5baf3..79ee8d4 100644
--- a/templates/add_blurb.html
+++ b/templates/add_blurb.html
@@ -57,12 +57,12 @@ <h3>📜🤖 Blurb it again?</h3>
                         </select>
                     </div>
                 </div>
-                <div class="mb-3">
+                <div class="mb-3" id="cve-group">
                     <div class="col form-inline">
                         <label for="cve" class="form-inline">CVE</label><input type="text" class="form-control form-inline" pattern="^(?:[Cc][Vv][Ee]-)?\d{4}-\d{4,}$" maxlength="20" placeholder="CVE-2025-12345" id="cve" name="cve">
                     </div>
                     <div class="col form-inline">
-                        <small id="cve-help" class="form-text text-muted">Optional. The CVE identifier (CVE-YYYY-NNNN) for a <strong>Security</strong> entry only.</small>
+                        <small id="cve-help" class="form-text text-muted">Optional. The CVE identifier (CVE-YYYY-NNNN) for this security fix.</small>
                     </div>
                 </div>
                 <div class="mb-3">
@@ -76,4 +76,25 @@ <h3>📜🤖 Blurb it again?</h3>
         <div class="col-md-12">Alternatively, you can use <a href="https://devguide.python.org/getting-started/pull-request-lifecycle/#news-entry">blurb on the command line</a>.</div>
     </div>
 
+    <script>
+        // The CVE field only applies to the Security section, so show it
+        // only when that section is selected and clear it otherwise.
+        (function () {
+            var section = document.getElementById("section");
+            var cveGroup = document.getElementById("cve-group");
+            var cve = document.getElementById("cve");
+
+            function toggleCve() {
+                var isSecurity = section.value === "Security";
+                cveGroup.hidden = !isSecurity;
+                if (!isSecurity) {
+                    cve.value = "";
+                }
+            }
+
+            section.addEventListener("change", toggleCve);
+            toggleCve();
+        })();
+    </script>
+
 {% endblock %}

From 1e7cd103eb104ce329fc3dba481dd2a3e3bb8ea1 Mon Sep 17 00:00:00 2001
From: mariatta <mariatta.wijaya@gmail.com>
Date: Wed, 21 Oct 2026 13:20:22 -0700
Subject: [PATCH 2/2] Document the CVE field in the readme and howto page

Neither mentioned the field. Say that it appears for Security entries,
the form it takes, and that it is stored as .. cve: metadata in the
news file.
---
 readme.rst           | 4 ++++
 templates/howto.html | 1 +
 2 files changed, 5 insertions(+)

diff --git a/readme.rst b/readme.rst
index b07ca62..ffe9741 100644
--- a/readme.rst
+++ b/readme.rst
@@ -22,6 +22,10 @@ A ``Misc/NEWS.d`` file `is needed
 <https://devguide.python.org/getting-started/pull-request-lifecycle/#news-entry>`_
 for almost all non-trivial changes to CPython.
 
+For an entry in the ``Security`` section, blurb-it also offers an optional
+CVE field. Give the identifier in the ``CVE-YYYY-NNNN`` form and blurb-it
+records it as ``.. cve:`` metadata at the top of the news file.
+
 To use blurb-it, you must be logged in to GitHub.
 
 Install blurb-it GitHub App to your account, and then grant the ``write`` access to your
diff --git a/templates/howto.html b/templates/howto.html
index 1da3622..73a0f3e 100644
--- a/templates/howto.html
+++ b/templates/howto.html
@@ -6,6 +6,7 @@
         <p>So far, the way you would add the news entry is by using blurb command line tool, that can be installed using PyPI.</p>
         <p>But now, we’re going to defy the Zen of Python’s “there should be only one way to do it”, and present you with another way to do it: <strong>blurb-it</strong>. <a href="{{ app_protocol }}://{{ app_url }}/">{{ app_protocol }}://{{ app_url }}/</a></p>
         <p>blurb-it provides a web interface for you to create news entry to your own CPython pull request. That means, you can do this from your phone, as long as you have a webbrowser and connected to the internet.</p>
+        <p>Fill in the issue and pull request numbers, choose the section, and write the entry. When you choose the <strong>Security</strong> section, an optional <strong>CVE</strong> field appears. Give the identifier in the <code>CVE-YYYY-NNNN</code> form and blurb-it records it as <code>.. cve:</code> metadata at the top of the news file.</p>
         <p>blurb-it is a <a href="https://github.com/apps/blurb-it">GitHub App</a> owned by The PSF. You’ll need to <a href="/install"><strong>install it</strong></a> and <strong>give write permission</strong> to your own fork’s cpython repo (so it can create the news file). Since <strong>the app will have write access to the repo</strong>, you should not install this on any other repo.</p>
         <p>Please give this a try and let me know of any issues by filing a bug in the <a href="https://github.com/python/blurb_it">blurb-it repo</a>.</p>
         <p>The use of blurb-it is optional. You can still add news file using the <a href="https://pypi.org/project/blurb/">blurb command line tool</a>.</p>