search

cobyism / ghost-on-heroku

One-button Heroku deploy for the Ghost blogging platform.
MIT License
743 stars 686 forks source link

specify node versions with the latest security patch #113

Closed vinvasir closed 7 years ago

vinvasir commented 7 years ago

There's a new patch out for Node that addresses a Constant Hashtable Seeds security vulnerability. I updated the package.json to make sure that existing installations of ghost-on-heroku use the new patch.

cobyism commented 7 years ago

Thanks for the PR, @vinvasir! ❤️

Happy to merge this in, but it’s worth noting that the code in the current master branch, when deployed to Heroku, resolves the node version to 6.11.1 (see screenshot below):

2017-07-17 at 11 20

Any deployments to Heroku made since the newly patched node versions were added to their stack should have ended up with this version, and thus should be secure.