New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

blog: add pos release announcement #5993

Merged

RafaelGSS merged 3 commits into main from pos-release-announcement

Oct 13, 2023

Member

RafaelGSS commented Oct 13, 2023

No description provided.

RafaelGSS added 3 commits

October 13, 2023 18:12


          Blog: v20.8.1

1db5794

Refs: nodejs-private/node-private#491


          Blog: v18.18.2

ff24d98

Refs: nodejs-private/node-private#492


          blog: add pos security release announcement

4017cfa

RafaelGSS requested review from a team as code owners

October 13, 2023 21:14

vercel bot commented Oct 13, 2023 •

edited

Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
nodejs-org	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Oct 13, 2023 9:15pm

RafaelGSS commented

View reviewed changes

pages/en/blog/release/v20.8.1.md

+              * \[[`a4cb7fc7c0`](https://github.com/nodejs/node/commit/a4cb7fc7c0)] - **policy**: use tamper-proof integrity check function (Tobias Nießen) [nodejs-private/node-private#462](https://github.com/nodejs-private/node-private/pull/462)
+              Windows 32-bit Installer: https://nodejs.org/dist/v20.8.1/node-v20.8.1-x86.msi \
+              Windows 64-bit Installer: *Coming soon* \

Member Author

RafaelGSS Oct 13, 2023

Is it expected? @richardlau

Member

richardlau Oct 13, 2023

No. 😕

Suggested change

      
            Windows 64-bit Installer: *Coming soon* \
          
            Windows 64-bit Installer: https://nodejs.org/dist/v20.8.1/node-v20.8.1-x64.msi \

vercel bot deployed to Preview

October 13, 2023 21:15

View deployment

MattIPv4 added the github_actions:pull-request label

github-actions bot removed the github_actions:pull-request label

MattIPv4 deployed to Storybook

October 13, 2023 21:16

— with

GitHub Actions View deployment

github-actions bot commented Oct 13, 2023

Unit Test Coverage Report

Lines	Statements	Branches	Functions
	94.68% (267/282)	78.12% (50/64)	92.98% (53/57)

Unit Test Report

Tests	Skipped	Failures	Errors	Time
27	0 💤	0 ❌	0 🔥	5.572s ⏱️

RafaelGSS merged commit ce46d3c into main

11 of 14 checks passed

RafaelGSS deleted the pos-release-announcement branch

October 13, 2023 21:20

tniessen reviewed

View reviewed changes

Member

tniessen left a comment

Nit: typo pos in commit message

pages/en/blog/release/v18.18.2.md

+              * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security Release (High)
+              * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security Release (High)
+              * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks according to policies can be circumvented (Medium)

Member

tniessen Oct 13, 2023

Suggested change

      
            * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks according to policies can be circumvented (Medium)
          
            * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552): Integrity checks according to policies can be circumvented (Medium)

pages/en/blog/release/v20.8.1.md

+              * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security Release (High)
+              * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through path stored in Uint8Array (High)
+              * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model improperly protects against path traversal (High)
+              * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks according to policies can be circumvented (Medium)

Member

tniessen Oct 13, 2023

Suggested change

      
            * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks according to policies can be circumvented (Medium)
          
            * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552): Integrity checks according to policies can be circumvented (Medium)

pages/en/blog/vulnerability/october-2023-security-releases.md


		## nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)

		Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.

Member

tniessen Oct 13, 2023

Suggested change

      
            Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service.
          
            Rapidly creating and cancelling streams (`HEADERS` frame immediately followed by `RST_STREAM`) without bound causes denial of service.

pages/en/blog/vulnerability/october-2023-security-releases.md


		Impacts:

		* This vulnerability affects all users of HTTP2 servers in all active

Member

tniessen Oct 13, 2023

Suggested change

      
            * This vulnerability affects all users of HTTP2 servers in all active
          
            * This vulnerability affects all users of HTTP/2 servers in all active

pages/en/blog/vulnerability/october-2023-security-releases.md

Comment on lines +81 to +82

Member

tniessen Oct 13, 2023

Suggested change

pages/en/blog/vulnerability/october-2023-security-releases.md

Comment on lines +108 to +109

		- 1 medium severity issues.
		- 1 low severity issues.

Member

tniessen Oct 13, 2023

Suggested change

      
            - 1 medium severity issues.
          
            - 1 low severity issues.
          
            - 1 medium severity issue.
          
            - 1 low severity issue.

pages/en/blog/vulnerability/october-2023-security-releases.md

               ## Contact and future updates
-              The current Node.js security policy can be found at <https://nodejs.org/en/security/>. Please follow the process outlined in <https://github.com/nodejs/node/blob/main/SECURITY.md> if you wish to report a vulnerability in Node.js.
+              The current Node.js security policy can be found at <https://nodejs.org/en/security/>. Please follow the process outlined in <https://github.com/nodejs/node/blob/master/SECURITY.md> if you wish to report a vulnerability in Node.js.

Member

tniessen Oct 13, 2023

Suggested change

      
            The current Node.js security policy can be found at <https://nodejs.org/en/security/>. Please follow the process outlined in <https://github.com/nodejs/node/blob/master/SECURITY.md> if you wish to report a vulnerability in Node.js.
          
            The current Node.js security policy can be found at <https://nodejs.org/en/security/>. Please follow the process outlined in <https://github.com/nodejs/node/blob/main/SECURITY.md> if you wish to report a vulnerability in Node.js.

Member

ovflowd commented Oct 13, 2023

@RafaelGSS did you wait for CI? I don't see that this PR got any approval, nor the CI did pass. Please avoid direct merges when possible 🙇

Member

MattIPv4 commented Oct 13, 2023

@tniessen or @RafaelGSS would you be able to fast-follow with those suggested changes in a new PR?

Member Author

RafaelGSS commented Oct 13, 2023

I didn't wait for CI, sorry. The release is out and we should have this post asap. I'll create a PR with the suggested changes.

Member

tniessen commented Oct 13, 2023

@MattIPv4 I'll open a separate PR. @RafaelGSS probably still has work to do due to the security releases, which take priority :)

Member

ovflowd commented Oct 13, 2023

I didn't wait for CI, sorry. The release is out and we should have this post asap. I'll create a PR with the suggested changes.

Right, the CI takes usually just around 50s-1 minute and half, we just want to ensure that the build passes and works as expected :) (I don't think one extra minute would hurt 🙇)

Member

ovflowd commented Oct 13, 2023

Well, main is broken now.

Member Author

RafaelGSS commented Oct 13, 2023

Working on that.

tniessen mentioned this pull request

blog: make minor improvements to latest posts #5994

Merged

Member

tniessen commented Oct 13, 2023

Linter errors should be fixed #5994.

On a side note, I think the Markdown rules in this repo differ from the Markdown rules in the core repo, but we use some of the same content for both reps.

Member

ovflowd commented Oct 13, 2023

On a side note, I think the Markdown rules in this repo differ from the Markdown rules in the core repo, but we use some of the same content for both reps.

Are you referring to the * instead of -? We don't use the remark-preset-lint-node as it is incompatible with MDX and causes serious issues.

But we can change the rules to use * instead of - as it is on Node core. Besides of that, I would always recommend to:

Run your changes locally
Ensure you have the Git Hooks installed (simply do npm i
Ensure it builds locally
Commit (linting is done automatically)
CI on a PR.

Member

tniessen commented Oct 13, 2023

Are you referring to the * instead of -?

That's the main difference that I noticed so far :)

Member

ovflowd commented Oct 13, 2023

Are you referring to the * instead of -?

That's the main difference that I noticed so far :)

Apparently prettier enforces -, there's nothing I can do here, at least I can try to make the ride smoother... #5997

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet