Remove link from Packages GraphQL 3.7 release notes (#34160)

data/release-notes/enterprise-server/3-7/0.yml

@@ -132,7 +132,7 @@ sections:
       notes:
         # https://github.com/github/releases/issues/2300
         - |
-          Enterprise owners, organization owners, and security managers can access a centralized view of risk across the entire instance. The view also includes an alert-centric view of all code scanning, secret scanning, and Dependabot alerts. Enterprise owners can view alerts for organizations that they are owners of. Organization owners and security managers can view repositories and alerts for the organizations that they have full access to.  For more information, see "[About the security overview](/code-security/security-overview/about-the-security-overview)." 
+          Enterprise owners, organization owners, and security managers can access a centralized view of risk across the entire instance. The view also includes an alert-centric view of all code scanning, secret scanning, and Dependabot alerts. Enterprise owners can view alerts for organizations that they are owners of. Organization owners and security managers can view repositories and alerts for the organizations that they have full access to.  For more information, see "[About the security overview](/code-security/security-overview/about-the-security-overview)."
 
         # https://github.com/github/releases/issues/2415
         - |
@@ -143,7 +143,7 @@ sections:
         # https://github.com/github/releases/issues/2307
         - |
           Users can take advantage of the following improvements to the [GitHub Advisory Database](https://github.com/advisories).
-          
+
           - The database displays advisories for for Elixir, Erlang's Hex package manager, and more.
           - Users can find malware advisories by searching for `type:malware`.
           - The database displays advisories for GitHub Actions vulnerabilities.
@@ -180,9 +180,9 @@ sections:
         # https://github.com/github/releases/issues/2325
         - |
           To support secure cloud deployments at scale, organization owners and repository administrators can complete the following tasks with the OpenID Connect REST API. For more information, see "[GitHub Actions OIDC](/rest/actions/oidc)" in the REST API documentation
-          
+
           - Enable a standard OpenID Connect configuration across cloud deployment workflows by customizing the `subject` claim format.
-          - Ensure additional compliance and security for OpenID Connect deployments by appending the `issuer` URL with the enterprise's slug. 
+          - Ensure additional compliance and security for OpenID Connect deployments by appending the `issuer` URL with the enterprise's slug.
           - Configure advanced OpenID Connect policies by using additional OpenID Connect token claims like `repository_id` and `repo_visibility`.
 
           For more information, see "[About security hardening with OpenID Connect](/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token)."
@@ -192,7 +192,7 @@ sections:
           GitHub Actions users who use dependency caching to speed up workflows can now use the GitHub Actions Cache REST API to accomplish the following tasks.
 
           - List all caches within a repository and sort by metadata.
-          - Delete a corrupt or stale cache entry. 
+          - Delete a corrupt or stale cache entry.
           For more information, see "[Caching dependencies to speed up workflows](/actions/using-workflows/caching-dependencies-to-speed-up-workflows#managing-caches)" and "[GitHub Actions Cache](/rest/actions/cache)" in the REST API documentation.
 
         # https://github.com/github/docs-content/issues/7689
@@ -238,7 +238,7 @@ sections:
         # https://github.com/github/releases/issues/2406
         - |
           Improvements have been made to the creation and management of forks.
-          
+
           - When forking a repository, users can choose to only include the repository's default branch in the fork.
           - Users can use a repository's' **Fork** button to see existing forks of the repository.
           - The **Fetch upstream** button has been renamed to **Sync fork** to better describe the button's behavior. If the sync causes a conflict, the web UI prompts the user to contribute changes to the parent repository, discard changes, or resolve the conflict.
@@ -297,13 +297,13 @@ sections:
   changes:
     # https://github.com/github/releases/issues/2344
     - |
-      To improve stability, the service for rendering GeoJSON, Jupyter Notebook, PDF, PSD, SVG, SolidWorks, and other binary formats has been replaced. 
+      To improve stability, the service for rendering GeoJSON, Jupyter Notebook, PDF, PSD, SVG, SolidWorks, and other binary formats has been replaced.
-      
+
     - |
       If TLS and subdomain isolation are configured for your instance and your certificate is not a wildcard certificate, you must generate a new certificate that includes the additional subdomains for these services, `notebooks.HOSTNAME` and `viewscreen.HOSTNAME`. For more information, see "[Enabling subdomain isolation](/admin/configuration/configuring-network-settings/enabling-subdomain-isolation)." [Updated: 2022-12-02]
 
     - Secret scanning no longer supports custom patterns that use `.*` as an end delimiter in the "After secret" field, as the pattern syntax would cause scan problems and inconsistencies.
-  
+
     # https://github.com/github/releases/issues/2535
     - When creating a new release, users can now submit the form using <kbd>Ctrl</kbd> + <kbd>Enter</kbd> in macOS, or <kbd>Ctrl</kbd> + <kbd>Enter</kbd> in Windows or Linux.
 
@@ -338,7 +338,7 @@ sections:
         To ghes.hostname.com:User/repo.git
         ! [remote rejected]       master -> master (Internal Server Error)
         ```
-      
+
       If these are encountered, please [contact GitHub Enterprise Support](/support/contacting-github-support/creating-a-support-ticket) with a support bundle. The known temporary workaround at this time is to restart the `github-gitauth` service with the commands below:
 
         ```
@@ -362,4 +362,5 @@ sections:
     - Diffing GeoJSON, PSD, and STL files is no longer possible.
 
     # https://github.com/github/releases/issues/2480
-    - Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well. GitHub recommends using the REST API to programmatically access information about GitHub Packages. For more information, see "[Packages](/rest/packages)" in the REST API documentation.
+    - |
+      Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well.

data/release-notes/enterprise-server/3-7/1.yml

@@ -5,26 +5,26 @@ sections:
     - "**HIGH**: A check was added within Pages to ensure the working directory is clean before unpacking new content to prevent an arbitrary file overwrite bug. This vulnerability has been assigned [CVE-2022-46255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46255)."
     - "**MEDIUM**: Updated [CommonMarker](https://github.com/gjtorikian/commonmarker) to address a scenario where parallel requests to the Markdown REST API could result in unbounded resource exhaustion. This vulnerability has been assigned [CVE-2022-39209](https://nvd.nist.gov/vuln/detail/CVE-2022-39209)."
     - "**MEDIUM**: Scoped user-to-server tokens from GitHub Apps could bypass authorization checks in GraphQL API requests when accessing non-repository resources. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2022-23739](https://www.cve.org/CVERecord?id=CVE-2022-23739)."
-    - "**MEDIUM**: Pull request preview links did not properly sanitize URLs, allowing a malicious user to embed dangerous links in the instances web UI. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com)." 
+    - "**MEDIUM**: Pull request preview links did not properly sanitize URLs, allowing a malicious user to embed dangerous links in the instances web UI. This vulnerability was reported via the [GitHub Bug Bounty program](https://bounty.github.com)."
   bugs:
-    - If a GitHub Actions dependency uses a pinned SHA version, Dependabot will no longer mark the dependency as vulnerable. 
+    - If a GitHub Actions dependency uses a pinned SHA version, Dependabot will no longer mark the dependency as vulnerable.
-    - Running the `ghe-spokesctl` command returned a `failed to get repo metrics` error. 
+    - Running the `ghe-spokesctl` command returned a `failed to get repo metrics` error.
-    - Setting the maintenance mode with an IP Exception List would not persist across upgrades. 
+    - Setting the maintenance mode with an IP Exception List would not persist across upgrades.
-    - GitHub Pages builds could time out on instances in AWS that are configured for high availability. 
+    - GitHub Pages builds could time out on instances in AWS that are configured for high availability.
-    - Status details for the replication of Git LFS objects to repository cache replica nodes were not visible in the `ghe-repl-status` output on those nodes. 
+    - Status details for the replication of Git LFS objects to repository cache replica nodes were not visible in the `ghe-repl-status` output on those nodes.
-    - The audit log timestamp for Dependabot alert events returned the creation date of the alert instead of the timestamp when a user took action on the alert. 
+    - The audit log timestamp for Dependabot alert events returned the creation date of the alert instead of the timestamp when a user took action on the alert.
-    - When accessing an instances JavaScript resources from behind a proxy, the browser displayed Cross-Origin Resource Sharing (CORS) errors. 
+    - When accessing an instances JavaScript resources from behind a proxy, the browser displayed Cross-Origin Resource Sharing (CORS) errors.
-    - If a user named a status check with leading or trailing spaces, the instance created a duplicate check if another check existed with the same name and no leading or trailing spaces. 
+    - If a user named a status check with leading or trailing spaces, the instance created a duplicate check if another check existed with the same name and no leading or trailing spaces.
-    - If a user configured a pre-receive hook for multiple repositories, the instances **Hooks** page would not always display the correct status for the hook. 
+    - If a user configured a pre-receive hook for multiple repositories, the instances **Hooks** page would not always display the correct status for the hook.
-    - In some cases, an instance could replace an active repository with a deleted repository. 
+    - In some cases, an instance could replace an active repository with a deleted repository.
-    - Git LFS objects in a repository with a cache replication policy would not be copied to cache replicas if the total number of objects in the repository exceeded 5,000. 
+    - Git LFS objects in a repository with a cache replication policy would not be copied to cache replicas if the total number of objects in the repository exceeded 5,000.
-    - After running migrations for the GitHub Enterprise Importer on an instance configured for high availability, replication of migration storage assets would not catch up. 
+    - After running migrations for the GitHub Enterprise Importer on an instance configured for high availability, replication of migration storage assets would not catch up.
-    - Zombie processes no longer accumulate in the `gitrpcd` container. 
+    - Zombie processes no longer accumulate in the `gitrpcd` container.
-    - On an instance with GitHub Packages configured, package upload and installation could fail for customers using a VPC endpoint URL for AWS S3 blob storage. 
+    - On an instance with GitHub Packages configured, package upload and installation could fail for customers using a VPC endpoint URL for AWS S3 blob storage.
     - In some cases, after upgrading to GitHub Enterprise Server 3.7.0, users may encounter `Internal Server Error` or `500` errors when initiating Git operations over SSH or HTTPS.
   changes:
-    - If a site administrator has not yet configured GitHub Actions for the instance, the UI for setting up code scanning will prompt the user to configure GitHub Actions. 
+    - If a site administrator has not yet configured GitHub Actions for the instance, the UI for setting up code scanning will prompt the user to configure GitHub Actions.
-    - To avoid failing domain verification due to the 63-character limit enforced by DNS providers for DNS records, the GitHub-generated `TXT` record to verify domain ownership is now limited to 63 characters. 
+    - To avoid failing domain verification due to the 63-character limit enforced by DNS providers for DNS records, the GitHub-generated `TXT` record to verify domain ownership is now limited to 63 characters.
   known_issues:
     - On a freshly set up {% data variables.product.prodname_ghe_server %} instance without any users, an attacker could create the first admin user.
     - Custom firewall rules are removed during the upgrade process.
@@ -55,4 +55,5 @@ sections:
     - Diffing GeoJSON, PSD, and STL files is no longer possible.
 
     # https://github.com/github/releases/issues/2480
-    - Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well. GitHub recommends using the REST API to programmatically access information about GitHub Packages. For more information, see "[Packages](/rest/packages)" in the REST API documentation.
+    - |
+      Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well.

data/release-notes/enterprise-server/3-7/2.yml

@@ -4,26 +4,26 @@ sections:
     - |
       **HIGH**: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was reported via the [GitHub Bug Bounty Program](https://bounty.github.com/) and has been assigned [CVE-2022-46256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46256).
   bugs:
-    - A race condition blocked upgrades to GitHub Enterprise Server 3.6 or later until a site administrator retried the upgrade. 
+    - A race condition blocked upgrades to GitHub Enterprise Server 3.6 or later until a site administrator retried the upgrade.
-    - When a site administrator ran the `ghe-repl-status` command on a cache replica via the administrative shell (SSH), the command incorrectly reported overall Git and Alambic cluster replication status information as if it pertained only to cache replication. 
+    - When a site administrator ran the `ghe-repl-status` command on a cache replica via the administrative shell (SSH), the command incorrectly reported overall Git and Alambic cluster replication status information as if it pertained only to cache replication.
-    - When a site administrator ran the `ghe-repl-sync-ca-certificates` command from an instances primary node via the administrative shell (SSH), the command only replicated CA certificates from the instances primary node to a single replica node. The command did not replicate the certificates to all available replica nodes. 
+    - When a site administrator ran the `ghe-repl-sync-ca-certificates` command from an instances primary node via the administrative shell (SSH), the command only replicated CA certificates from the instances primary node to a single replica node. The command did not replicate the certificates to all available replica nodes.
-    - In a high availability configuration, after promotion of a replica to be the primary node, a site administrator could not force replication to stop on a secondary replica node using the `ghe-repl-stop -f` command. 
+    - In a high availability configuration, after promotion of a replica to be the primary node, a site administrator could not force replication to stop on a secondary replica node using the `ghe-repl-stop -f` command.
-    - When using repository caching with an instance in a high availability configuration, if a Git client used SSH instead of HTTPS for a repositorys remote URL, Git LFS would fetch objects from the instances primary node instead of the appropriate cache replica node. 
+    - When using repository caching with an instance in a high availability configuration, if a Git client used SSH instead of HTTPS for a repositorys remote URL, Git LFS would fetch objects from the instances primary node instead of the appropriate cache replica node.
-    - Installation of GitHub Enterprise Server on the VMware ESXi hypervisor failed due to the generation of an OVA file with an invalid capacity value. 
+    - Installation of GitHub Enterprise Server on the VMware ESXi hypervisor failed due to the generation of an OVA file with an invalid capacity value.
     - When users performed an operation using the API, GitHub Enterprise Server enforced repository size quotas even when disabled globally.
-    - In some cases, searches via the API returned a `500` error. 
+    - In some cases, searches via the API returned a `500` error.
-    - Adding a collaborator to a user-owned fork of a private, organization-owned repository with triage, maintain, or custom access resulted in a `500` error. 
+    - Adding a collaborator to a user-owned fork of a private, organization-owned repository with triage, maintain, or custom access resulted in a `500` error.
-    - In some cases, the page for setting up code scanning would erroneously report that GitHub Actions was not configured for the instance. 
+    - In some cases, the page for setting up code scanning would erroneously report that GitHub Actions was not configured for the instance.
-    - Dismissing a Dependabot alert that contained certain characters could result in a `400` error. 
+    - Dismissing a Dependabot alert that contained certain characters could result in a `400` error.
-    - After a user's account was deleted from the instance, image attachments that the user uploaded in comments were no longer visible in the web interface. 
+    - After a user's account was deleted from the instance, image attachments that the user uploaded in comments were no longer visible in the web interface.
-    - On an instance that uses SAML for authentication, the **Configure SSO** dropdown menu appeared erroneously for personal access tokens and SSH keys. 
+    - On an instance that uses SAML for authentication, the **Configure SSO** dropdown menu appeared erroneously for personal access tokens and SSH keys.
-    - An upgrade from GitHub Enterprise Server 3.5 to 3.7 could fail because the instance had not yet purged deleted repositories. 
+    - An upgrade from GitHub Enterprise Server 3.5 to 3.7 could fail because the instance had not yet purged deleted repositories.
-    - In a high availability or repository caching configuration, Unicorn services on nodes other than the primary node were unable to send log events to the primary node. 
+    - In a high availability or repository caching configuration, Unicorn services on nodes other than the primary node were unable to send log events to the primary node.
     - Fixes a bug in which a GHES log file could get filled very quickly and cause the root drive to run out of free space.
     - When viewing code scanning results for Ruby, an erroneous beta label appeared.
   changes:
-    - After an enterprise owner enables Dependabot alerts, GitHub Enterprise Server enqueues the synchronization of advisory data to ensure hourly updates from GitHub.com. 
+    - After an enterprise owner enables Dependabot alerts, GitHub Enterprise Server enqueues the synchronization of advisory data to ensure hourly updates from GitHub.com.
-    - A user's list of recently accessed repositories no longer includes deleted repositories. 
+    - A user's list of recently accessed repositories no longer includes deleted repositories.
   known_issues:
     - On a freshly set up {% data variables.product.prodname_ghe_server %} instance without any users, an attacker could create the first admin user.
     - Custom firewall rules are removed during the upgrade process.
@@ -54,4 +54,5 @@ sections:
     - Diffing GeoJSON, PSD, and STL files is no longer possible.
 
     # https://github.com/github/releases/issues/2480
-    - Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well. GitHub recommends using the REST API to programmatically access information about GitHub Packages. For more information, see "[Packages](/rest/packages)" in the REST API documentation.
+    - |
+      Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well.

data/release-notes/enterprise-server/3-7/3.yml

@@ -50,4 +50,5 @@ sections:
     - Diffing GeoJSON, PSD, and STL files is no longer possible.
 
     # https://github.com/github/releases/issues/2480
-    - Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well. GitHub recommends using the REST API to programmatically access information about GitHub Packages. For more information, see "[Packages](/rest/packages)" in the REST API documentation.
+    - |
+      Package registries on the new GitHub Packages architecture, including Container registry and npm packages, no longer expose data through the GraphQL API. In a coming release, other GitHub Packages registries will migrate to the new architecture, which will deprecate the GraphQL API for those registries as well.