Repository navigation
Add a warning on EOL versions #1401
Description
Activity
@RafaelGSS as you mentioned if they pin they won't get a warning.
If instead we published as CVE indicating the release was EOL they would get if they are running CVE scans. I suspect this would be a more reliable way of having it be recognized as a risk.
Reacted by Marco Ippolito, Zbyszek Tenerowicz and PamplemousseI think we could do both, issue a single CVE alerting EOL (after a sec release) and create a patch release with a warning?
I think doing both makes sense to me, provide we have a volunteer to do the patch release (as I think that's more work that doing the CVE).
Right, how can we move forward with it? Should we open a PR to document it somewhere?
For the warning, presumably there'd be an env/NODE_OPTIONS way to disable it, so as to not break CI and child process workflows?
Yes, we can use the same --security-revert CLI
Reacted by Jordan HarbandI'm not entirely convinced a warning is needed, but the idea of a cve is great.
Can we start by issuing one for all past releases?
I'm not entirely convinced a warning is needed, but the idea of a cve is great.
Can we start by issuing one for all past releases?
I think so, I think it needs to go through a H1 report
Let's do it for v16.x, v19.x, and v21.x. I can take care of it early this week.
Reacted by Marco Ippolito, Michael Dawson and Will SlattumFYI I'm going to create an "announcement" (https://github.com/orgs/nodejs/discussions/categories/announcements) informing Node.js collaborators that next week we'll be issuing a CVE for Node.js 16, 19 and 21, then I'll ask @nodejs/social to share a post that I can create or the official account can create informing our users.
Reacted by Marco Ippolito@RafaelGSS please write a public blog post instead, and set the date on or after the 7th of January. Doing this right before the holidays is not helping anyone.
Reacted by Michael Dawson15 remaining items
- added a commit that references this issue
on Mar 13, 2025 This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
I was talking with @marco-ippolito and we were discussing having ways for people to know when they are using an insecure version of Node.js. Instead of having a flag (#852), what if we release a patch version after one or two months of EOL alerting users they are using an EOL version?
I mean, if they pin the version and don't get the last release, they won't see the warning, but I assume it will affect most users. We could try to do it to non-LTS versions first, and then we expand the coverage to all EOL versions (starting this year, of course).
cc: @nodejs/security-wg @nodejs/tsc