From db0d86b4284aac7c247078fd58694d8847204dd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Fri, 7 Jun 2024 18:56:54 +0200 Subject: [PATCH] doc: add 2024-06-06 meeting notes (#1328) --- meetings/2024-06-06.md | 46 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 meetings/2024-06-06.md diff --git a/meetings/2024-06-06.md b/meetings/2024-06-06.md new file mode 100644 index 00000000..b2e7f4aa --- /dev/null +++ b/meetings/2024-06-06.md @@ -0,0 +1,46 @@ +# Node.js Security team Meeting 2024-06-06 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=30pO2bXGxhk +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1322 +* **Minutes Google Doc**: https://docs.google.com/document/d/1PSyaM70E_abF_9Ya35JB0cvamM0sALxZwjD_P0T0N0I/edit + +## Present + +* Ulises Gascon (@UlisesGascon) +* Marco Ippolito (@marco-ippolito) +* Thomas GENTILHOMME (@fraxken) +* Michael Dawson (@mhdawson) + +## Agenda + +## Announcements + +*Extracted from **security-wg-agenda** labeled issues and pull requests from the **nodejs org** prior to the meeting. + +* No announcements this week + +- [x] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues + - Seems like some OpenSSL low level vulnerabilities are not detected by the automation, probably as they are not yet registered in NIST + +- [x] OpenSSF Scorecard Monitor Review - + - Report updated in https://github.com/nodejs/security-wg/pull/1327, seems like we decreased in Node.js due vulnerabilities (more details: https://github.com/nodejs/security-wg/pull/1327#issuecomment-2151671450). This might be an error as it is the first time that is reported and the CVEs are from 2022 + +### nodejs/security-wg + +* Audit build process for dependencies [#1037](https://github.com/nodejs/security-wg/issues/1037) + * Michael + * has action to PR in approach into core repo (from last meeting) + * still have on my list more experimentation with building WASM, documenting possible + implementation + + +## Q&A, Other + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. +