search

nodesource / docker-node

Dockerfiles for building docker images with the NodeSource Node.js binaries baked in.
MIT License
192 stars 22 forks source link

Update for vulnerability fixes please #52

Closed billinghamj closed 8 years ago

billinghamj commented 8 years ago

Hey all,

Node v6.1.0, v5.11.1, v4.4.4, v0.12.14, and v0.10.45 were released four days ago to fix vulnerabilities in OpenSSL. Could you release these versions please?

It might be worth you scheduling some time when the vulnerability announcements are made a few days ahead of the release in anticipation that important fixes will be released, in order to reduce the time it takes for end users to patch their systems. Particularly if a critical bug is fixed affecting Node, it could be very problematic having a week of exposure.

In any case, still really appreciate the work you all do - makes my life a hell of a lot easier. ❤️

chrislea commented 8 years ago

These are currently building. Unfortunately we can't really make them much faster for a few reasons. Basically, we can't make the distribution packages until the official sources are released, and building those takes some time. Then, after those exist, it takes additional time to make the Docker images. So in a situation like last week when there were basically five simultaneous security releases, things can get backed up. We try to do the current LTS release first, then "current", then the rest so that the highest priority things get to end users the fastest.

billinghamj commented 8 years ago

Looks like this is done now :)