<div dir="ltr">I intend to fix them as much as possible, then propose nodejs to stable.<div>There will be a (possibly long) delay in the bookworm-proposed-updates queue, because it depends on a team that has a lot to do already, but eventually it will get into stable.</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Le jeu. 20 févr. 2025 à 06:58, Naaz, Syeda Shagufta <<a href="mailto:syedashagufta.naaz@siemens.com">syedashagufta.naaz@siemens.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg6560221114955491672">
<div lang="EN-IN" style="overflow-wrap: break-word;">
<div class="m_-7285353823935257504WordSection1">
<p class="MsoNormal">Hi Jeremy Lal,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If I have understood your previous communication correctly, it appears that<u></u><u></u></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="m_-7285353823935257504MsoListParagraph" style="margin-left:0cm">The tests for the following two packages are failing due to the OpenSSL
<a href="https://security-tracker.debian.org/tracker/CVE-2023-46809" target="_blank">CVE-2023-46809</a> fix. However, upon reviewing the patch changes, it seems that this behaviour is expected. The error encountered is a warning to the user about the deprecation of RSA_PKCS1_PADDING
for private decryption, with an option to revert the fix if necessary:<u></u><u></u></li></ol>
<ul style="margin-top:0cm" type="disc">
<li class="m_-7285353823935257504MsoListParagraph">node-node-rsa_1.1.1-4<u></u><u></u></li><li class="m_-7285353823935257504MsoListParagraph">node-public-encrypt_4.0.3-1<u></u><u></u></li></ul>
<p class="MsoNormal" style="margin-left:36pt">Will it be appropriate to comment out this test?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0cm" start="2" type="1">
<li class="m_-7285353823935257504MsoListParagraph" style="margin-left:0cm">This is part of the Math Team’s work, as seen here:
<a href="https://salsa.debian.org/math-team/macaulay2" target="_blank">Macaulay2</a>. Considering this, do we really need to address this issue, like how you mentioned the case of
<b>dask.distributed_2022.12.1+ds.1-3</b>?<u></u><u></u></li></ol>
<ul style="margin-top:0cm" type="disc">
<li class="m_-7285353823935257504MsoListParagraph">macaulay2_1.21+ds-3<u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0cm" start="3" type="1">
<li class="m_-7285353823935257504MsoListParagraph" style="margin-left:0cm">These two packages are failing due to issues with pkg-javascript, as mentioned for
<b>node-minipass_3.3.6+~cs9.4.19-1.</b><u></u><u></u></li></ol>
<ul style="margin-top:0cm" type="disc">
<li class="m_-7285353823935257504MsoListParagraph">node-rollup-plugin-sass_1.12.16-1 (dh_auto_test: error: /bin/sh -ex debian/tests/pkg-js/test)<u></u><u></u></li><li class="m_-7285353823935257504MsoListParagraph">node-mutate-fs_2.1.1-2 (dh_auto_test: error: /bin/sh -ex debian/tests/pkg-js/test)<u></u><u></u></li></ul>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Your input will be valuable in helping clarify the next steps for these issues.<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Best Regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black">Syeda Shagufta Naaz<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:"Times New Roman",serif;color:black">Senior Software Developer<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="FR" style="font-family:Calibri,sans-serif;color:teal">SIEMENS</span></b><span lang="FR" style="font-family:Calibri,sans-serif;color:black"> </span><b><span lang="EN-US" style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(1,95,191)">FT
FDS (Foundational Services)</span></b><span lang="EN-US" style="color:rgb(33,33,33)"><u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> Jérémy Lal <<a href="mailto:kapouer@melix.org" target="_blank">kapouer@melix.org</a>>
<br>
<b>Sent:</b> 18 February 2025 05:32<br>
<b>To:</b> Naaz, Syeda Shagufta (FT FDS CES LX PBU 1) <<a href="mailto:syedashagufta.naaz@siemens.com" target="_blank">syedashagufta.naaz@siemens.com</a>><br>
<b>Cc:</b> <a href="mailto:pkg-javascript-devel@alioth-lists.debian.net" target="_blank">pkg-javascript-devel@alioth-lists.debian.net</a>; Hombourger, Cedric (FT FDS CES LX) <<a href="mailto:cedric.hombourger@siemens.com" target="_blank">cedric.hombourger@siemens.com</a>>; Kumar, Ritesh (FT FDS CES LX PBU RSOL) <<a href="mailto:ritesh-kumar@siemens.com" target="_blank">ritesh-kumar@siemens.com</a>>; Koturappa, Hemanth (FT FDS CES LX PBU 2) <<a href="mailto:hemanth.koturappa@siemens.com" target="_blank">hemanth.koturappa@siemens.com</a>>;
Prusty, Badrikesh (FT FDS CES LX PBU 2) <<a href="mailto:badrikesh.prusty@siemens.com" target="_blank">badrikesh.prusty@siemens.com</a>><br>
<b>Subject:</b> Re: Discrepancy in nodejs version in Debian Bookworm vs. Salsa Debian repository<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Update:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Done: node-rollup_3.15.0-1<br>
Done: node-redis_4.5.1+~1.1.2-1<br>
Not a regression of nodejs, but is a pkg-javascript problem so it's Done: node-minipass_3.3.6+~cs9.4.19-1<br>
Not a regression of nodejs, not my problem at all: dask.distributed_2022.12.1+ds.1-3<br>
Not part of bookworm - just ignore: jquery_3.3.1~dfsg-3<br>
Done: node-csstype_3.1.1-1<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">"Done" means there is a FTBFS bug for that package,<u></u><u></u></p>
<div>
<p class="MsoNormal">and I opened a <a href="http://release.debian.org/" target="_blank">release.debian.org</a> bug containing a diff that fixes the FTBFS bug for that package.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">Le lun. 17 févr. 2025 à 12:04, Jérémy Lal <<a href="mailto:kapouer@melix.org" target="_blank">kapouer@melix.org</a>> a écrit :<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<p class="MsoNormal">Thank you for this helpful work.<u></u><u></u></p>
<div>
<p class="MsoNormal">Yes, since the latest nodejs update to bookworm has been somewhat catastrophic,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">it is our duty to ensure the next one goes very smoothly for it to be accepted.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">To sum up, we have this:<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Those packages fail with nodejs_18.19.0+dfsg-6~deb12u1 and nodejs_18.20.4+dfsg-1~deb12u1<br>
node-rollup_3.15.0-1<br>
node-redis_4.5.1+~1.1.2-1<br>
node-minipass_3.3.6+~cs9.4.19-1<br>
dask.distributed_2022.12.1+ds.1-3<br>
jquery_3.3.1~dfsg-3<br>
node-csstype_3.1.1-1<br>
node-recast_0.21.1-1<br>
node-js-sdsl_4.1.4-2<br>
node-wikibase-cli_15.15.4-4<br>
node-regexpp_3.2.0-4<br>
science.js_1.9.3+dfsg-3<br>
moment-timezone.js_0.5.40+dfsg-1+2023c<br>
node-resolve_1.22.1+~cs5.31.10-1<br>
node-jest_29.3.1~ds1+~cs70.48.25-2<br>
node-jschardet_3.0.0+dfsg+~1.4.0-2<br>
node-lib0_0.2.58-1<br>
<br>
1 package builds with nodejs_18.20.4+dfsg-1~deb12u1<br>
PASSED: firefox-esr_128.5.0esr-1~deb12u1<br>
<br>
5 new failures with nodejs_18.20.4+dfsg-1~deb12u1:<br>
node-node-rsa_1.1.1-4<br>
node-rollup-plugin-sass_1.12.16-1<br>
macaulay2_1.21+ds-3<br>
node-public-encrypt_4.0.3-1<br>
node-mutate-fs_2.1.1-2<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The goal is to fix them (ensure they build, and their autopkgtest pass for node 18.20.4), then do a reportbug
<a href="http://release.debian.org/" target="_blank">release.debian.org</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">to bookworm-pu for each of them, finishing with a bookworm-pu for nodejs 18.20.4.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Attention: some of them might already have bookworm-pu bugs opened.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Le lun. 17 févr. 2025 à 11:36, Naaz, Syeda Shagufta <<a href="mailto:syedashagufta.naaz@siemens.com" target="_blank">syedashagufta.naaz@siemens.com</a>> a écrit :<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<div>
<div>
<p class="MsoNormal">Hi Jeremy Lal,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Thank you for your earlier email.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">As per your suggestion, I have attached the RATT test results for Node.js versions 18.19.0 and 18.20.4, covering a total of 1707 packages, along with the build logs for the failed
packages.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Upon reviewing the results, I noticed the following:<u></u><u></u></p>
<ul type="disc">
<li class="MsoNormal">
Version 18.19.0 has failures in <b>18</b> packages.<u></u><u></u></li></ul>
<ul type="disc">
<ol start="1" type="1">
<li class="MsoNormal">
firefox-esr_128.5.0esr-1~deb12u1: this package failed in version 18.19.0 but passed in version 18.20.4.<u></u><u></u></li></ol>
</ul>
<ul type="disc">
<li class="MsoNormal">
Version 18.20.4 has failures in <b>22</b> packages, of which 5 are additional compared to v18.19.0:<u></u><u></u></li></ul>
<ul type="disc">
<ol start="1" type="1">
<li class="MsoNormal">
node-public-encrypt_4.0.3-1 (failure in dh_auto_test)<u></u><u></u></li><li class="MsoNormal">
node-node-rsa_1.1.1-4 (failure in dh_auto_test)<u></u><u></u></li><li class="MsoNormal">
node-rollup-plugin-sass_1.12.16-1 (failure in dh_auto_test)<u></u><u></u></li><li class="MsoNormal">
macaulay2_1.21+ds-3 (failure in dh_auto_build)<u></u><u></u></li><li class="MsoNormal">
node-mutate-fs_2.1.1-2 (failure in dh_auto_test)<u></u><u></u></li></ol>
</ul>
<p class="MsoNormal">I also noticed that the first two packages are failing due to the Openssl CVE fix for
<a href="https://salsa.debian.org/js-team/nodejs/-/blob/debian/bookworm/debian/changelog?ref_type=heads#L20" target="_blank">
CVE-2023-46809</a> .<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Could the additional failures in version 18.20.4 be the reason the update has not yet been implemented?<u></u><u></u></p>
<p class="MsoNormal">I would appreciate your insights on this matter. Please let me know your thoughts.<u></u><u></u></p>
<p class="MsoNormal">Best Regards,<u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black">Syeda Shagufta Naaz</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:"Times New Roman",serif;color:black">Senior Software Developer</span><u></u><u></u></p>
<p class="MsoNormal"><b><span lang="FR" style="font-family:Calibri,sans-serif;color:teal">SIEMENS</span></b><span lang="FR" style="font-family:Calibri,sans-serif;color:black"> </span><b><span lang="EN-US" style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(1,95,191)">FT
FDS (Foundational Services)</span></b><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8pt;font-family:"Times New Roman",serif;color:rgb(127,127,127)"> </span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> Jérémy
Lal <</span><a href="mailto:kapouer@melix.org" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">kapouer@melix.org</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">>
<br>
<b>Sent:</b> 07 February 2025 16:31<br>
<b>To:</b> Naaz, Syeda Shagufta (FT FDS CES LX PBU 1) <</span><a href="mailto:syedashagufta.naaz@siemens.com" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">syedashagufta.naaz@siemens.com</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">><br>
<b>Cc:</b> </span><a href="mailto:pkg-javascript-devel@alioth-lists.debian.net" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">pkg-javascript-devel@alioth-lists.debian.net</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">;
Hombourger, Cedric (FT FDS CES LX) <</span><a href="mailto:cedric.hombourger@siemens.com" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">cedric.hombourger@siemens.com</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">>;
Kumar, Ritesh (FT FDS CES LX PBU RSOL) <</span><a href="mailto:ritesh-kumar@siemens.com" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">ritesh-kumar@siemens.com</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">>;
Koturappa, Hemanth (FT FDS CES LX PBU 2) <</span><a href="mailto:hemanth.koturappa@siemens.com" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">hemanth.koturappa@siemens.com</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">>;
Prusty, Badrikesh (FT FDS CES LX PBU 2) <</span><a href="mailto:badrikesh.prusty@siemens.com" target="_blank"><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">badrikesh.prusty@siemens.com</span></a><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">><br>
<b>Subject:</b> Re: Discrepancy in nodejs version in Debian Bookworm vs. Salsa Debian repository</span><u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">Also note that debian/trixie will have a version of nodejs that uses even more external dependencies,<u></u><u></u></p>
<div>
<p class="MsoNormal">with a source tarball excluding the externalized dependencies, which will make the process of doing security uploads easier for everyone.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Le ven. 7 févr. 2025 à 11:59, Jérémy Lal <<a href="mailto:kapouer@melix.org" target="_blank">kapouer@melix.org</a>> a écrit :<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<p class="MsoNormal">Security uploads take a lot of work to ensure all reverse (build-)dependencies of a package build and pass their test suite successfully.<u></u><u></u></p>
<div>
<p class="MsoNormal">For that last upload, I in particular, lost track of time.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">To help me, one can redo those verifications, and then, once several packages failing to rebuild have been identified,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">they must be fixed, proposed to bookworm, and once they are all accepted, that version of nodejs can be proposed to bookworm too.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">Le ven. 7 févr. 2025 à 11:04, Naaz, Syeda Shagufta <<a href="mailto:syedashagufta.naaz@siemens.com" target="_blank">syedashagufta.naaz@siemens.com</a>> a écrit :<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<div>
<div>
<p class="MsoNormal">Package: nodejs<u></u><u></u></p>
<p class="MsoNormal">Version: 18.19.0+dfsg-6~deb12u2<u></u><u></u></p>
<p class="MsoNormal">Severity: critical<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Dear Debian Community,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">We are currently working with the
<a href="https://packages.debian.org/bookworm/nodejs" target="_blank">Debian Bookworm</a> 12.9 release for our project and observed that the nodejs version is
<b>18.19.0+dfsg-6~deb12u2</b>. <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">However, upon reviewing the
<a href="https://salsa.debian.org/js-team/nodejs/-/blob/debian/bookworm/debian/changelog?ref_type=heads" target="_blank">
salsa-debian/bookworm</a> branch, we noticed that version <b>18.20.4+dfsg-1~deb12u1
</b>is available, which includes fixes for multiple CVE issues, such as, <u></u><u></u></p>
<ul type="disc">
<li class="MsoNormal">
<a href="https://security-tracker.debian.org/tracker/CVE-2024-27983" target="_blank">CVE-2024-27983</a> (<b>8.2 HIGH</b>)<u></u><u></u></li><li class="MsoNormal">
<a href="https://security-tracker.debian.org/tracker/CVE-2024-21892" target="_blank">CVE-2024-21892</a> (<b>7.5 HIGH</b>)<u></u><u></u></li><li class="MsoNormal">
<a href="https://security-tracker.debian.org/tracker/CVE-2024-22019" target="_blank">CVE-2024-22019</a> (<b>7.5 HIGH</b>)
<u></u><u></u></li></ul>
<p class="MsoNormal">These fixes are not included in the current Bookworm release. Having the severity of some of these vulnerabilities as High, we are eager for these fixes to be available.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Could you please help clarify why there is a discrepancy between the version in the Bookworm release and the one on salsa? Is there a any specific reason for the delay and, is there
any fixed timeline for resolving this? <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I appreciate your time and guidance on this matter.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Best Regards,<u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Times New Roman",serif;color:black">Syeda Shagufta Naaz</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt;font-family:"Times New Roman",serif;color:black">Senior Software Developer</span><u></u><u></u></p>
<p class="MsoNormal"><b><span lang="FR" style="font-family:Calibri,sans-serif;color:teal">SIEMENS</span></b><span lang="FR" style="font-family:Calibri,sans-serif;color:black"> </span><b><span lang="EN-US" style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(1,95,191)">FT
FDS (Foundational Services)</span></b><u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div>