-
Notifications
You must be signed in to change notification settings - Fork 122
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
doc: add 2024-06-06 meeting notes (#1328)
- Loading branch information
1 parent
8dc8c77
commit db0d86b
Showing
1 changed file
with
46 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,46 @@ | ||
# Node.js Security team Meeting 2024-06-06 | ||
|
||
## Links | ||
|
||
* **Recording**: https://www.youtube.com/watch?v=30pO2bXGxhk | ||
* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1322 | ||
* **Minutes Google Doc**: https://docs.google.com/document/d/1PSyaM70E_abF_9Ya35JB0cvamM0sALxZwjD_P0T0N0I/edit | ||
|
||
## Present | ||
|
||
* Ulises Gascon (@UlisesGascon) | ||
* Marco Ippolito (@marco-ippolito) | ||
* Thomas GENTILHOMME (@fraxken) | ||
* Michael Dawson (@mhdawson) | ||
|
||
## Agenda | ||
|
||
## Announcements | ||
|
||
*Extracted from **security-wg-agenda** labeled issues and pull requests from the **nodejs org** prior to the meeting. | ||
|
||
* No announcements this week | ||
|
||
- [x] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues | ||
- Seems like some OpenSSL low level vulnerabilities are not detected by the automation, probably as they are not yet registered in NIST | ||
|
||
- [x] OpenSSF Scorecard Monitor Review - | ||
- Report updated in https://github.com/nodejs/security-wg/pull/1327, seems like we decreased in Node.js due vulnerabilities (more details: https://github.com/nodejs/security-wg/pull/1327#issuecomment-2151671450). This might be an error as it is the first time that is reported and the CVEs are from 2022 | ||
|
||
### nodejs/security-wg | ||
|
||
* Audit build process for dependencies [#1037](https://github.com/nodejs/security-wg/issues/1037) | ||
* Michael | ||
* has action to PR in approach into core repo (from last meeting) | ||
* still have on my list more experimentation with building WASM, documenting possible | ||
implementation | ||
|
||
|
||
## Q&A, Other | ||
|
||
## Upcoming Meetings | ||
|
||
* **Node.js Project Calendar**: <https://nodejs.org/calendar> | ||
|
||
Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. | ||
|