<div dir="ltr"><div>Update:</div><div><br></div><div>Done: node-rollup_3.15.0-1<br>Done: node-redis_4.5.1+~1.1.2-1<br>Not a regression of nodejs, but is a pkg-javascript problem so it's Done: node-minipass_3.3.6+~cs9.4.19-1<br>Not a regression of nodejs, not my problem at all: dask.distributed_2022.12.1+ds.1-3<br>Not part of bookworm - just ignore: jquery_3.3.1~dfsg-3<br>Done: node-csstype_3.1.1-1</div><div><br></div>"Done" means there is a FTBFS bug for that package,<div>and I opened a <a href="http://release.debian.org">release.debian.org</a> bug containing a diff that fixes the FTBFS bug for that package.</div><div><br><div><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Le lun. 17 févr. 2025 à 12:04, Jérémy Lal <<a href="mailto:kapouer@melix.org">kapouer@melix.org</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Thank you for this helpful work.<div>Yes, since the latest nodejs update to bookworm has been somewhat catastrophic,</div><div>it is our duty to ensure the next one goes very smoothly for it to be accepted.</div><div><br><div>To sum up, we have this:<div><br></div><div>Those packages fail with nodejs_18.19.0+dfsg-6~deb12u1 and nodejs_18.20.4+dfsg-1~deb12u1<br>node-rollup_3.15.0-1<br>node-redis_4.5.1+~1.1.2-1<br>node-minipass_3.3.6+~cs9.4.19-1<br>dask.distributed_2022.12.1+ds.1-3<br>jquery_3.3.1~dfsg-3<br>node-csstype_3.1.1-1<br>node-recast_0.21.1-1<br>node-js-sdsl_4.1.4-2<br>node-wikibase-cli_15.15.4-4<br>node-regexpp_3.2.0-4<br>science.js_1.9.3+dfsg-3<br>moment-timezone.js_0.5.40+dfsg-1+2023c<br>node-resolve_1.22.1+~cs5.31.10-1<br>node-jest_29.3.1~ds1+~cs70.48.25-2<br>node-jschardet_3.0.0+dfsg+~1.4.0-2<br>node-lib0_0.2.58-1<br><br>1 package builds with nodejs_18.20.4+dfsg-1~deb12u1<br>PASSED: firefox-esr_128.5.0esr-1~deb12u1<br><br>5 new failures with nodejs_18.20.4+dfsg-1~deb12u1:<br>node-node-rsa_1.1.1-4<br>node-rollup-plugin-sass_1.12.16-1<br>macaulay2_1.21+ds-3<br>node-public-encrypt_4.0.3-1<br>node-mutate-fs_2.1.1-2<br></div><div><br></div><div>The goal is to fix them (ensure they build, and their autopkgtest pass for node 18.20.4), then do a reportbug <a href="http://release.debian.org" target="_blank">release.debian.org</a></div><div>to bookworm-pu for each of them, finishing with a bookworm-pu for nodejs 18.20.4.</div><div>Attention: some of them might already have bookworm-pu bugs opened.</div><div><br></div><div><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le lun. 17 févr. 2025 à 11:36, Naaz, Syeda Shagufta <<a href="mailto:syedashagufta.naaz@siemens.com" target="_blank">syedashagufta.naaz@siemens.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<div lang="EN-IN">
<div>
<p class="MsoNormal"><span>Hi Jeremy Lal,<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Thank you for your earlier email.<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>As per your suggestion, I have attached the RATT test results for Node.js versions 18.19.0 and 18.20.4, covering a total of 1707 packages, along with the build logs for the failed packages.<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Upon reviewing the results, I noticed the following:<u></u><u></u></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal"><span>Version 18.19.0 has failures in
<b>18</b> packages.<u></u><u></u></span></li><ol style="margin-top:0cm" start="1" type="1">
<li style="margin-left:0cm"><span>firefox-esr_128.5.0esr-1~deb12u1: this package failed in version 18.19.0 but passed in version 18.20.4.<u></u><u></u></span></li></ol>
<li class="MsoNormal"><span>Version 18.20.4 has failures in
<b>22</b> packages, of which 5 are additional compared to v18.19.0:<u></u><u></u></span></li><ol style="margin-top:0cm" start="1" type="1">
<li style="margin-left:0cm"><span>node-public-encrypt_4.0.3-1 (failure in dh_auto_test)<u></u><u></u></span></li><li style="margin-left:0cm"><span>node-node-rsa_1.1.1-4 (failure in dh_auto_test)<u></u><u></u></span></li><li style="margin-left:0cm"><span>node-rollup-plugin-sass_1.12.16-1 (failure in dh_auto_test)<u></u><u></u></span></li><li style="margin-left:0cm"><span>macaulay2_1.21+ds-3 (failure in dh_auto_build)<u></u><u></u></span></li><li style="margin-left:0cm"><span>node-mutate-fs_2.1.1-2 (failure in dh_auto_test)<b><u></u><u></u></b></span></li></ol>
</ul>
<p class="MsoNormal"><span>I also noticed that the first two packages are failing due to the Openssl CVE fix for
<a href="https://salsa.debian.org/js-team/nodejs/-/blob/debian/bookworm/debian/changelog?ref_type=heads#L20" target="_blank">
CVE-2023-46809</a> .<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Could the additional failures in version 18.20.4 be the reason the update has not yet been implemented?<u></u><u></u></span></p>
<p class="MsoNormal"><span>I would appreciate your insights on this matter. Please let me know your thoughts.<u></u><u></u></span></p>
<p class="MsoNormal"><span>Best Regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black">Syeda Shagufta Naaz<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:"Times New Roman",serif;color:black">Senior Software Developer<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="FR" style="font-family:Calibri,sans-serif;color:teal">SIEMENS</span></b><span lang="FR" style="font-family:Calibri,sans-serif;color:black"> </span><b><span lang="EN-US" style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(1,95,191)">FT
FDS (Foundational Services)</span></b><span lang="EN-US" style="color:rgb(33,33,33)"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8pt;font-family:"Times New Roman",serif;color:rgb(127,127,127)"><u></u> <u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> Jérémy Lal <<a href="mailto:kapouer@melix.org" target="_blank">kapouer@melix.org</a>>
<br>
<b>Sent:</b> 07 February 2025 16:31<br>
<b>To:</b> Naaz, Syeda Shagufta (FT FDS CES LX PBU 1) <<a href="mailto:syedashagufta.naaz@siemens.com" target="_blank">syedashagufta.naaz@siemens.com</a>><br>
<b>Cc:</b> <a href="mailto:pkg-javascript-devel@alioth-lists.debian.net" target="_blank">pkg-javascript-devel@alioth-lists.debian.net</a>; Hombourger, Cedric (FT FDS CES LX) <<a href="mailto:cedric.hombourger@siemens.com" target="_blank">cedric.hombourger@siemens.com</a>>; Kumar, Ritesh (FT FDS CES LX PBU RSOL) <<a href="mailto:ritesh-kumar@siemens.com" target="_blank">ritesh-kumar@siemens.com</a>>; Koturappa, Hemanth (FT FDS CES LX PBU 2) <<a href="mailto:hemanth.koturappa@siemens.com" target="_blank">hemanth.koturappa@siemens.com</a>>;
Prusty, Badrikesh (FT FDS CES LX PBU 2) <<a href="mailto:badrikesh.prusty@siemens.com" target="_blank">badrikesh.prusty@siemens.com</a>><br>
<b>Subject:</b> Re: Discrepancy in nodejs version in Debian Bookworm vs. Salsa Debian repository<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Also note that debian/trixie will have a version of nodejs that uses even more external dependencies,<u></u><u></u></p>
<div>
<p class="MsoNormal">with a source tarball excluding the externalized dependencies, which will make the process of doing security uploads easier for everyone.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Le ven. 7 févr. 2025 à 11:59, Jérémy Lal <<a href="mailto:kapouer@melix.org" target="_blank">kapouer@melix.org</a>> a écrit :<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<p class="MsoNormal">Security uploads take a lot of work to ensure all reverse (build-)dependencies of a package build and pass their test suite successfully.<u></u><u></u></p>
<div>
<p class="MsoNormal">For that last upload, I in particular, lost track of time.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">To help me, one can redo those verifications, and then, once several packages failing to rebuild have been identified,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">they must be fixed, proposed to bookworm, and once they are all accepted, that version of nodejs can be proposed to bookworm too.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Le ven. 7 févr. 2025 à 11:04, Naaz, Syeda Shagufta <<a href="mailto:syedashagufta.naaz@siemens.com" target="_blank">syedashagufta.naaz@siemens.com</a>> a écrit :<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<div>
<div>
<p class="MsoNormal">Package: nodejs<u></u><u></u></p>
<p class="MsoNormal">Version: 18.19.0+dfsg-6~deb12u2<u></u><u></u></p>
<p class="MsoNormal">Severity: critical<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Dear Debian Community,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">We are currently working with the
<a href="https://packages.debian.org/bookworm/nodejs" target="_blank">Debian Bookworm</a> 12.9 release for our project and observed that the nodejs version is
<b>18.19.0+dfsg-6~deb12u2</b>. <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">However, upon reviewing the
<a href="https://salsa.debian.org/js-team/nodejs/-/blob/debian/bookworm/debian/changelog?ref_type=heads" target="_blank">
salsa-debian/bookworm</a> branch, we noticed that version <b>18.20.4+dfsg-1~deb12u1
</b>is available, which includes fixes for multiple CVE issues, such as, <u></u><u></u></p>
<ul type="disc">
<li class="MsoNormal">
<a href="https://security-tracker.debian.org/tracker/CVE-2024-27983" target="_blank">CVE-2024-27983</a> (<b>8.2 HIGH</b>)<u></u><u></u></li><li class="MsoNormal">
<a href="https://security-tracker.debian.org/tracker/CVE-2024-21892" target="_blank">CVE-2024-21892</a> (<b>7.5 HIGH</b>)<u></u><u></u></li><li class="MsoNormal">
<a href="https://security-tracker.debian.org/tracker/CVE-2024-22019" target="_blank">CVE-2024-22019</a> (<b>7.5 HIGH</b>)
<u></u><u></u></li></ul>
<p class="MsoNormal">These fixes are not included in the current Bookworm release. Having the severity of some of these vulnerabilities as High, we are eager for these fixes to be available.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Could you please help clarify why there is a discrepancy between the version in the Bookworm release and the one on salsa? Is there a any specific reason for the delay and, is there
any fixed timeline for resolving this? <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I appreciate your time and guidance on this matter.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Best Regards,<u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black">Syeda Shagufta Naaz</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:"Times New Roman",serif;color:black">Senior Software Developer</span><u></u><u></u></p>
<p class="MsoNormal"><b><span lang="FR" style="font-family:Calibri,sans-serif;color:teal">SIEMENS</span></b><span lang="FR" style="font-family:Calibri,sans-serif;color:black"> </span><b><span lang="EN-US" style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(1,95,191)">FT
FDS (Foundational Services)</span></b><u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</div></blockquote></div>
</blockquote></div></div></div></div>