Heads up of Node.js security releases 14 Feb 2023

[mhdawson]

As per the Node.js security release process this is the FYI that there is going to be a security release 14 Feb 2023

[tomymehdi]

Hello @mhdawson. This would address CVE-2023-0286 (https://avd.aquasec.com/nvd/cve-2023-0286) on alpine images with tag 19-alpine3.16 ?

[nschonni]

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

[mhdawson]

Security releases are now out and should be ready for intergration into containers.

[SimenB]

Ooops, linked PR is missing Node 18 for alpine. From what I can see it is built, but not available.

https://unofficial-builds.nodejs.org/logs/202302170648-v18.14.1/ shows musl as done
https://unofficial-builds.nodejs.org/download/release/v18.14.1/ is completely empty

/cc @nodejs/build

EDIT: arm build is still going, maybe the files aren't updated until all builds are completed? musl, which is the one we're waiting for, completed 30 minutes ago.

[nschonni]

EDIT: arm build is still going, maybe the files aren't updated until all builds are completed? musl, which is the one we're waiting for, completed 30 minutes ago.

nodejs/unofficial-builds#22

I'm not sure why the bot opened the PR when the 18 musl builds weren't ready. It's supposed to fail till they are all ready

[SimenB]

Ok, finally done now. Hopefully the bot picks it up as I cannot run the update script on my current machine (#1848)

[SimenB]

It's supposed to fail till they are all ready

Yeah, good point...