Docker-node: New 4.x, 6.x, and 8.x images needed to patch DOS vulnerability

[iamwillbar]

Now that the NodeJS vulnerability has been disclosed and the corresponding patched versions are available will new Docker images be made available ASAP?
https://nodejs.org/en/blog/vulnerability/oct-2017-dos/

Specifically, images needed for:

• 4.8.5
• 6.11.5
• 8.8.0

Thanks!

[adonisv79]

This should be released in unison. Anyway, hoping to have this asap

[spywhere]

Can't this be done by use an automated build?

[SimenB]

PR merged. New images will be available when https://github.com/docker-library/official-images/pull/3621 is merged, and docker's infra builds the images (usually it takes about an hour ftaer merge for all images to be available).

Issue for updating the docker image along with the main node releases: https://github.com/nodejs/node/issues/14190

Please note that it will never be completely in sync, as we don't build the images, we just maintain the Dockerfiles

[SimenB]

I'm gonna close this, as there's nothing to do on our side. Please subscribe to https://github.com/docker-library/official-images/pull/3621 for updates

(happy to discuss how to improve our process in a separate issue, not this one)