search

coder / code-server

VS Code in the browser
https://coder.com
MIT License
67.27k stars 5.51k forks source link

Update .node-version #6676

Closed puneethrai closed 4 months ago

puneethrai commented 6 months ago

This is to fix security vulnerability mentioned in https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20231016

Fixes # Update Node version to 18.19.1 to fix vulnerabilities in NodeJS

code-asher commented 6 months ago

Thank you for the PR! We keep our version is sync with upstream so we will need to wait for them to update. https://github.com/microsoft/vscode/blob/main/remote/.yarnrc

puneethrai commented 6 months ago

@code-asher any idea when can the update be possible ?

code-asher commented 6 months ago

They follow Electron, and the next Electron update appears to be 28, scheduled for Februrary. Electron 28 uses Node 18.18.2 so I think that will be the next version. I am not sure about 18.19.1 though.

puneethrai commented 6 months ago

Thanks for the update @code-asher . So this is my first time PR for this repo, If you could guide if the PR is fine

I'll change the version to 18.18.2 if that is what we upgrade to and I believe changelog will be maintained by you

code-asher commented 6 months ago

Yeah I will handle the changelog. I believe we can update to 18.18.2 once VS Code 1.87.0 comes out.

puneethrai commented 6 months ago

Thanks @code-asher . I've made the appropriate changes. Will keep an eye on VSCode 1.87.0 release. Looking forward for my first PR merge

code-asher commented 5 months ago

Apparently I was wrong about the Node version, looks like they are going to update it in 1.88, not 1.87.

puneethrai commented 5 months ago

That would add another month or so right ? We will be dealing with vulnerabilities much longer.

code-asher commented 5 months ago

That would add another month or so right ?

Yup, that is right.

code-asher commented 4 months ago

The time has finally come!