From ca3ba67bc9c83264e017a358f1d31a219e8f6a5e Mon Sep 17 00:00:00 2001
From: Christoph Blecker <cblecker@redhat.com>
Date: Tue, 18 Aug 2026 14:52:24 -0700
Subject: [PATCH 1/2] fix(jira): harden GitHub PR URL check against substring
 bypass

Replace the substring guard `"github.com" in url and "/pull" in url` with
the class's existing anchored PR_PATTERN regex, so the host is pinned
immediately after the scheme. Resolves CodeQL alert
py/incomplete-url-substring-sanitization (CWE-20).

Assisted-by: Claude:claude-opus-4-8
---
 plugins/jira/.claude-plugin/plugin.json                         | 2 +-
 .../jira/skills/status-analysis/scripts/gather_status_data.py   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/jira/.claude-plugin/plugin.json b/plugins/jira/.claude-plugin/plugin.json
index 082650d0b..a9a90ac5c 100644
--- a/plugins/jira/.claude-plugin/plugin.json
+++ b/plugins/jira/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "jira",
   "description": "A plugin to automate tasks with Jira",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "author": {
     "name": "github.com/openshift-eng"
   }
diff --git a/plugins/jira/skills/status-analysis/scripts/gather_status_data.py b/plugins/jira/skills/status-analysis/scripts/gather_status_data.py
index 1ca4544bd..0eff09d82 100755
--- a/plugins/jira/skills/status-analysis/scripts/gather_status_data.py
+++ b/plugins/jira/skills/status-analysis/scripts/gather_status_data.py
@@ -1071,7 +1071,7 @@ async def _gather_internal(self, session: Optional[aiohttp.ClientSession]) -> Di
                 obj = link.get("object", {})
                 url = obj.get("url", "")
                 title = obj.get("title", "")
-                if url and "github.com" in url and "/pull" in url:
+                if url and self.PR_PATTERN.fullmatch(url):
                     # Check if the PR title references a descendant issue
                     references_descendant = any(desc_key in title for desc_key in desc_keys)
                     if references_descendant:

From b267fd333265fe0fcef998cf114d4440512a02f4 Mon Sep 17 00:00:00 2001
From: Christoph Blecker <cblecker@redhat.com>
Date: Tue, 18 Aug 2026 14:52:35 -0700
Subject: [PATCH 2/2] run make update

---
 .claude-plugin/marketplace.json |  2 +-
 docs/index.html                 | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 860b36d0f..bbb3b1cb3 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -92,7 +92,7 @@
       "name": "jira",
       "source": "./plugins/jira",
       "description": "A plugin to automate tasks with Jira",
-      "version": "0.9.3",
+      "version": "0.9.4",
       "category": "productivity",
       "keywords": [
         "jira",
diff --git a/docs/index.html b/docs/index.html
index 7753925a4..e4ba0553a 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1490,7 +1490,7 @@ <h1>ai-helpers</h1>
     {
       "name": "jira",
       "description": "A plugin to automate tasks with Jira",
-      "version": "0.9.2",
+      "version": "0.9.4",
       "has_readme": true,
       "commands": [
         {
@@ -1645,8 +1645,8 @@ <h1>ai-helpers</h1>
         },
         {
           "name": "create",
-          "description": "Create Jira issues — story, bug, epic, feature, initiative, task, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
-          "description_html": "Create Jira issues — story, bug, epic, feature, initiative, task, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
+          "description": "Create Jira issues — story, bug, epic, feature, initiative, task, risk, spike, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
+          "description_html": "Create Jira issues — story, bug, epic, feature, initiative, task, risk, spike, or feature-request — with CNTRLPLANE, OCPBUGS, GCP, HyperShift, ARO, ROSA conventions and type-specific templates",
           "meta": ""
         },
         {
@@ -1863,7 +1863,7 @@ <h1>ai-helpers</h1>
     {
       "name": "nid-team",
       "description": "NI&D team PR triage and review workflow tools",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "has_readme": true,
       "commands": [
         {
@@ -1872,7 +1872,7 @@ <h1>ai-helpers</h1>
           "description": "Send reminder comments on stale high-priority assigned PRs",
           "description_html": "Send reminder comments on stale high-priority assigned PRs",
           "synopsis": "/nid-team:nudge-prs [--dryrun] [--days 7] [--priority High,Urgent]",
-          "body_html": "Sends automated reminder comments on PRs that are assigned (Status=Assigned), high priority (PR Priority=High or Urgent), and have had no human activity for a configurable number of days. Determines whether the author or reviewer is blocking and @-mentions them in the comment."
+          "body_html": "Sends automated reminder comments on PRs that are assigned (Status=Assigned), high priority (PR Priority=High or Urgent), and have had no human activity for a configurable number of days."
         },
         {
           "name": "sync-pr-dashboard",