Repository navigation
Upgrade nodejs to latest npm version 10.9.1 #193
Description
Node.js Version
22.11.0
NPM Version
10.9.0
Operating System
windows
Subsystem
Other
Description
npm fixed a critical security vulnerability in version 10.9.1. The current LTS of nodejs and the next version 23.3.0 are in npm version 10.9.0.
Usually when nodejs will update the npm version. Also in the meantime the upgrade is done, is there any solution to handle this issue, like we need to manually upgrade to latest npm or upgrade just that library(cross-spawn) in nodejs.
npm/cli#7902
https://nvd.nist.gov/vuln/detail/CVE-2024-21538
Minimal Reproduction
No response
Output
No response
Before You Submit
- I have looked for issues that already exist before submitting this
- My issue follows the guidelines in the README file, and follows the 'How to ask a good question' guide at https://stackoverflow.com/help/how-to-ask #194
Activity
kl4072 commentedon Dec 3, 2024
When do we anticipate this change implemented in the latest images? this causes issues with cross-spawn 7.0.3 vulnerability
RafaelGSS commentedon Dec 5, 2024
This should solve nodejs/node#56135.
RafaelGSS commentedon Dec 5, 2024
Does it affect 10.8.x too @nodejs/npm ? In case, Node.js 18.x.
How it affects Node.js? Should we issue a release for Node.js 20 and 18?
mhdawson commentedon Dec 5, 2024
10.9.1 was pulled in nodejs/node#55951
It should be in the next 23.x
nodejs/node#56119
after which it would be backported to 22.x
richardlau commentedon Dec 5, 2024
But currently blocked on 20 and 18: nodejs/node#55951 (comment)
lukekarrys commentedon Dec 5, 2024
@aduh95 Do you have more info or some links about Python 3.8 support blocking npm backports (ref nodejs/node#55951 (comment))?
node-gypandgyp-nextare both tested on 3.8 so any breaking change there should be unintentional and I can try and fix in node-gyp.richardlau commentedon Dec 5, 2024
IIRC it's not that support for Python 3.8 was broken, it's that Python 3.8 is now the minimum (see nodejs/node#54358 for the breaking syntax) whereas earlier node-gyp (e.g. in npm@10.8.2) allowed earlier Python 3 (e.g. Python 3.7 which is what is on the current CI macOS 10.15 VMs).
There's two points:
python3on many OSes may be older Python 3 (e.g. IIRC the default Python 3 on RHEL 8 is 3.6 (later Python 3 is available but not installed by default)).mcollina commentedon Dec 10, 2024
The vuln is a false positive and all this work is to appease security scanners and overly rigid processes.
There is no way to attack this given node.js threat model.
Given that npm does not really maintain previous lines, I think we would need to patch cross-spawn in our tree in our maintenance lines.
mjramer commentedon Jan 9, 2025
I'm currently blocked by the cross-spawn vuln in node:20/node:18 image distros. Any update on patching cross-spawn in node 18 and 20 to appease the vuln scans?
RafaelGSS commentedon Sep 22, 2026
This is fixed in the
v22.xbranch reported in this issue. The bundled npm now includes cross-spawn 7.0.6, which is outside the affected range for CVE-2024-21538.Closing as resolved.