Spend from Node.js Bug Bounty/Security Fund (LFX crowdfunding account) to have collaborator fix urgent vulnerability

[tniessen]

Due to a rather unique situation, we are seeking approval for using up to $2000 of the security fund for contracting a collaborator to fix a security vulnerability. Details are available through the private TSC mailing list. Please let us know if there are any concerns or objections by the end of 2024-02-21, and please +1 the issue if you don't have any concerns.

cc @nodejs/tsc

[mcollina]

+1

[joyeecheung]

+1

…

On Sun, Feb 18, 2024 at 15:30 Matteo Collina ***@***.***> wrote: +1 — Reply to this email directly, view it on GitHub <#1506 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABAZVHF37MSC7KVOBKHB7W3YUIGBFAVCNFSM6AAAAABDOFSL7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJRGM2DENZXHA> . You are receiving this because you are on a team that was mentioned.Message ID: ***@***.***>

[aduh95]

+1

[gireeshpunathil]

+1

[MoLow]

+1 בתאריך יום א׳, 18 בפבר׳ 2024, 17:01, מאת Gireesh Punathil ‏< ***@***.***>:

…

+1 — Reply to this email directly, view it on GitHub <#1506 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB6XJHXKJIIBWHOJY3Y6KG3YUIJTRAVCNFSM6AAAAABDOFSL7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJRGM2TCMBWHA> . You are receiving this because you are on a team that was mentioned.Message ID: ***@***.***>

[anonrig]

+1

[mhdawson]

+1

[tniessen]

Consensus has been reached.

[mhdawson]

Based on the pre-approval here, and the fix which was published in the recent security release, I'm approving payment for this on behalf of the TSC as per the process in https://github.com/nodejs/TSC/blob/main/Nodejs-Bug-Bounty-Security-Fund.md#disbursements.