From 05e764d3fe183184962f5ee8c5f728f9bb46600d Mon Sep 17 00:00:00 2001 From: Michael Dawson Date: Thu, 12 Dec 2019 13:19:20 -0500 Subject: [PATCH 1/2] blog: add blog for dec security releases Add blog and make visible in main banner --- build.js | 6 ++-- .../december-2019-security-releases.md | 28 +++++++++++++++++++ 2 files changed, 31 insertions(+), 3 deletions(-) create mode 100644 locale/en/blog/vulnerability/december-2019-security-releases.md diff --git a/build.js b/build.js index 6877cd2dc35e4..1a0e0a9a150eb 100755 --- a/build.js +++ b/build.js @@ -290,9 +290,9 @@ function getSource (callback) { lts: latestVersion.lts(versions) }, banner: { - visible: false, - text: 'New security releases now available for all release lines', - link: '/en/blog/vulnerability/february-2019-security-releases/' + visible: true, + text: 'New security releases to be made available Dec 17, 2019', + link: '/en/blog/vulnerability/december-2019-security-releases/' } } } diff --git a/locale/en/blog/vulnerability/december-2019-security-releases.md b/locale/en/blog/vulnerability/december-2019-security-releases.md new file mode 100644 index 0000000000000..10a4e17e26529 --- /dev/null +++ b/locale/en/blog/vulnerability/december-2019-security-releases.md @@ -0,0 +1,28 @@ +--- +date: 2019-12-12T18:R2047.733Z +category: vulnerability +title: December 2019 Security Releases +slug: december-2019-security-releases +layout: blog-post.hbs +author: Michael Dawson +--- + +# Summary

 + +The Node.js project will release new versions of all supported release lines on or shortly after Tuesday December 17, 2019 UTC. The only update in these releases will be an updated version of npm addressing the vulnerability announced in https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli. + +In the meantime, users should update to npm 6.13.4 by following the instructions provided in the npm advisory. As a general rule, avoid running npm in production environments. + +# Impact + +All versions of Node.js are vulnerable including the LTS and current releases: Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium") , Node.js 12 (LTS "Erbium"), and Node.js 13. + +# Release timing
 + +Releases will be available at, or shortly after, Tuesday, December 17, 2019 UTC. + +# 
Contact and future updates

 + +The current Node.js security policy can be found at https://nodejs.org/en/security/.

 Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.

 + +Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. From bb0fe0ed09f6646c941b68fbfca60f6194d3e63a Mon Sep 17 00:00:00 2001 From: Michael Dawson Date: Thu, 12 Dec 2019 14:01:11 -0500 Subject: [PATCH 2/2] Update locale/en/blog/vulnerability/december-2019-security-releases.md Co-Authored-By: Richard Lau --- locale/en/blog/vulnerability/december-2019-security-releases.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locale/en/blog/vulnerability/december-2019-security-releases.md b/locale/en/blog/vulnerability/december-2019-security-releases.md index 10a4e17e26529..89351331e8dfd 100644 --- a/locale/en/blog/vulnerability/december-2019-security-releases.md +++ b/locale/en/blog/vulnerability/december-2019-security-releases.md @@ -1,5 +1,5 @@ --- -date: 2019-12-12T18:R2047.733Z +date: 2019-12-12T18:20:47.733Z category: vulnerability title: December 2019 Security Releases slug: december-2019-security-releases