Skip to content

Update Node to v14.17.2 #3876

Closed
Closed
@jsjoeio

Description

@jsjoeio

One of the code-server community members reached out asking if we could update the node version in code-server to 14.17.2 to fix a couple security vulnerabilities in 14.17.1

Original message:

My team is using code-server in our work and in doing a scan for vulnerabilities, we noticed that the most recent release of code-server updated the node version to 14.17.1. This resolved a lot of high severity vulnerabilities, but in doing a snyk.io scan, it detected two more high severity vulnerabilities that are resolved in Node v14.17.2.

Output from docker scan via snyk.io:

✗ High severity vulnerability found in node
Description: Privilege Escalation
Info: https://snyk.io/vuln/SNYK-UPSTREAM-NODE-1315789
Introduced through: [email protected]
From: [email protected]
Fixed in: 14.17.2

✗ High severity vulnerability found in node
Description: Out-of-bounds Read
Info: https://snyk.io/vuln/SNYK-UPSTREAM-NODE-1315790
Introduced through: [email protected]
From: [email protected]
Fixed in: 14.17.2

​In the interim, we're fine to use a fork that's bumped the version of Node, but figured it might be worth doing in the source repo as well given it would only mean doing a patch-version bump.

Metadata

Metadata

Assignees

No one assigned

    Labels

    choreRelated to maintenance or clean updependenciesPull requests that update a dependency filehigh-priorityThis issue needs to be resolved ASAPsecuritySecurity related

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions