Anyone know when this update may happen, to correct the 10/21 vulnerability issues
./launcher enter app -c "node -v"
x86_64 arch detected.
/var/www/discourse# node -v
v22.23.3
AI-generated summary
The discussion addresses a user’s inquiry regarding the timeline for updating Node.js to version 22.23.4 to address vulnerabilities related to the eMudhra Intermediate CA compromise. david clarified that Discourse had already updated OS-level trusted CAs and Ruby dependencies, noting that since Discourse does not use Node.js at runtime, these updates were more critical than the Node upgrade. However, work on the Node upgrade was in progress. Subsequently, david confirmed that the Discourse Docker image now includes the latest Node.js version (v22.23.4), resolving the issue.
We have already updated OS-level trusted CAs and relevant Ruby dependencies. We’re working on applying that node upgrade as well, and will update here when it’s done.
It’s worth noting: Discourse does not use node at runtime, so this is less important than the ruby & system-level upgrades.
(for those who aren’t aware, these CA upgrades are for Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds)
As of Bump default base image to discourse/base:2.0.20261022-1808 · discourse/discourse_docker@163a8da · GitHub, the Discourse docker image has the latest node 22:
# node -v
v22.23.4