Heads up of Node.js security releases 8 August 2023

[RafaelGSS]

As per the Node.js security release process, this is the FYI that there is going to be a security release on 8 August 2023.

https://nodejs.org/en/blog/vulnerability/august-2023-security-releases

[RafaelGSS]

The release is ready for integration.

[SimenB]

The autoupdater fails to verify the shasum for some reason: https://github.com/nodejs/docker-node/actions/runs/5818818729/job/15775983962.

And the update script doesn't work on mac 😅 #1848

[SimenB]

Ok, the issue is that https://nodejs.org/dist is gone, leading the curl to 404.

docker-node/config

Line 1 in c1a8937

baseuri https://nodejs.org/dist

docker-node/update.sh

Line 125 in c1a8937

fullVersion="$(curl -sSL --compressed "${baseuri}" | grep '<a href="v'"${version}." | sed -E 's!.*<a href="v([^"/]+)/?".*!\1!' | cut -d'.' -f2,3 | sort -V | tail -1)"

/cc @nodejs/docker @nodejs/build (sorry, I don't know who to tag for the website)

[UlisesGascon]

cc: @ovflowd

[UlisesGascon]

I got a 404 on https://nodejs.org/dist but https://nodejs.org/dist/ is working as expected. Maybe the issue is related to the /?

[SimenB]

Haha, wow 😅 great catch 👍 it's definitely a bug (and regression), but adding the trailing slash should at least unblock the update

[UlisesGascon]

I will create an issue for the webteam regarding the trailing slash, maybe a redirection from https://nodejs.org/dist to https://nodejs.org/dist/ will fix the regression

[UlisesGascon]

I created a PR that I hope fix this @SimenB nodejs/nodejs.org#5623

[SimenB]

Ah sweet, thanks! Then I'll not change anything here. The cron runs every 15 minutes, so it'll Just Work ™️ once the URL works (as long as cURL follows redirects)

[targos]

I just fixed it in the Cloudflare rule.

[SimenB]

cURL doesn't follow redirects, so I'll have to tweak the script

[ovflowd]

@SimenB no tweak needed, we're not going to make the redirect approach. (We just updated Cloudflare rule, so it should be ok now)

[SimenB]

We actually provide -L to curl already, so it'll follow it.

[targos]

It was already a redirect before.

[SimenB]

Worked: #1950 🎉