Merge pull request #721 from tulibraries/update-packages-and-document…

…-security-issue Update packages and document CVE-2025-25186
tulibraries · Feb 11, 2025 · 843c8d2 · 843c8d2
2 parents d1cd0fb + dd76841
commit 843c8d2
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 1 deletion.
diff --git a/.docker/app/Dockerfile b/.docker/app/Dockerfile
@@ -25,7 +25,7 @@ RUN apk add -U --no-cache \
       git=2.47.2-r0 \
       libxslt-dev=1.1.42-r1 \
       postgresql16-dev=16.6-r0 \
-      nodejs=22.11.0-r1 \
+      nodejs=22.13.1-r0 \
       yaml=0.2.5-r2 \
       yaml-dev=0.2.5-r2 \
       yarn=1.22.22-r1 && \

diff --git a/Documentation/Ruby-CVE-2025-25186 b/Documentation/Ruby-CVE-2025-25186
@@ -0,0 +1,2 @@
+We've updated to the secure version of net-imap in our Gemfile,
+but the base image still contains a bundled version that is unsecure.
diff --git a/Documentation/essential_packages.txt b/Documentation/essential_packages.txt
@@ -1,2 +1,3 @@
 view_component
 rexml
+net-imap
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		We've updated to the secure version of net-imap in our Gemfile,
		but the base image still contains a bundled version that is unsecure.