100MB of Node.js modules shipped in the Boost release tarball
Jonathan Wakely via Boost <[email protected]> Wed, 17 Jun 2026 19:06:11 +0100
| Newsgroups | gmane.comp.lib.boost.devel |
|---|---|
| Message-ID | <CAJcCCPMpwANjdMRd+weg8irA7jfcuOsHQy7BjXFjwK_Q8wqwSA@mail.gmail.com> |
There are 482 Node.js modules included in the boost-1_91_0.tar.bz2 tarball, totalling more than 100MB, which is nearly 10% of the size of the entire tarball. Some of these node modules contain known CVEs, e.g. Boost.Redis bundles axios-1.10.0 which is affected by several denial of service and information disclosure CVEs. This causes Boost to be flagged when scanning for software supply chain problems. Do these modules really need to be shipped in the release, or are they only used to generate the HTML docs and could be omitted from the release tarball? I tried removing libs/redis/doc/node_modules/* and building from the release tarball, and everything succeeded. That suggests they're not needed. _______________________________________________ Boost mailing list -- [email protected] To unsubscribe send an email to [email protected] https://lists.boost.org/mailman3/lists/boost.lists.boost.org/ Archived at: https://lists.boost.org/archives/list/[email protected]/message/APKJIASXU2DLQMGYIQR4JOMJE5CB56KB/