Proposal: Centralized CVE Tracking for Our Packages #116
Description
I’ve just created a PoC to pull in all the CVEs we have across all our packages. Here’s the script (https://gist.github.com/bjohansebas/91c1056fbad6968b4bd739d53ab53d57). It can still be improved and even turned into a GitHub Action, but before moving forward, what do you think about tracking our packages’ CVEs here?
With this, we could also remove the page https://expressjs.com/en/advanced/security-updates.html and redirect it to the file generated by the script, so we wouldn’t have to maintain that page anymore (which we sometimes forget to update). Alternatively, we could keep maintaining that page but update the reference in https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md#examples-of-vulnerabilities to point to this new document, which is more specific to vulnerabilities.
result:
Security Advisories
Total: 33
expressjs
Total: 18
| Repository Name | Advisories |
|---|---|
| express | |
| body-parser | |
| basic-auth-connect | |
| multer | |
| morgan | |
| method-override | |
| serve-index | |
| serve-static |
pillarjs
Total: 10
| Repository Name | Advisories |
|---|---|
| hbs | |
| send | |
| path-to-regexp | |
| resolve-path | |
| request |
jshttp
Total: 5
| Repository Name | Advisories |
|---|---|
| negotiator | |
| cookie | |
| fresh | |
| on-headers | |
| forwarded |