Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update node.js and related components to fix CVEs #591

Closed
hohwille opened this issue Jul 8, 2021 · 0 comments · Fixed by #592
Closed

Update node.js and related components to fix CVEs #591

hohwille opened this issue Jul 8, 2021 · 0 comments · Fixed by #592
Labels
enhancement New feature or request security related to IT-Security (e.g. vulnerability) update related to updating software or the entire devonfw-ide
Milestone
release:2021.04.002

Comments

@hohwille
Copy link
Member

hohwille commented Jul 8, 2021

As a user of devonfw-ide, I want to get secure software by default so that I am not vulnerable.

https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

Currently we are using node v14.16.0 that is affected:

ide/scripts/src/main/resources/scripts/command/node

Line 21 in 10722e0

local software_version="${NODE_VERSION:-v14.16.0}"

We need to update to at least v14.17.2 or even v16.4.1.
@hohwille hohwille added enhancement New feature or request update related to updating software or the entire devonfw-ide security related to IT-Security (e.g. vulnerability) labels Jul 8, 2021
@hohwille hohwille added this to the release:2021.04.002 milestone Jul 8, 2021
@hohwille hohwille linked a pull request Jul 8, 2021 that will close this issue
#592: update node v14.17.3 to fix CVEs #592
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request security related to IT-Security (e.g. vulnerability) update related to updating software or the entire devonfw-ide
Projects
None yet
Milestone
release:2021.04.002
Development

Successfully merging a pull request may close this issue.

#592: update node v14.17.3 to fix CVEs
1 participant
@hohwille