Re: 100MB of Node.js modules shipped in the Boost release tarball
Andrey Semashev via Boost <[email protected]> Wed, 17 Jun 2026 21:51:47 +0300
| Newsgroups | gmane.comp.lib.boost.devel |
|---|---|
| Message-ID | <[email protected]> |
On 17 Jun 2026 21:17, Sam Darwin via Boost wrote: >> Node.js modules included in the boost > > Hi Jonathan, > > I believe this is solved, going forward, with boost 1.92.0. > > Download the latest boost 1.92.0 snapshot: > https://archives.boost.io/develop/ > https://archives.boost.io/develop/boost_1_92_0-snapshot.tar.bz2 > > No node_modules in the archive, right? Given that these modules are downloaded during Boost build and have known vulnerabilities, this may pose a security thread to Boost building infrastructure. Is it possible to remove this dependency download or at the very least change the building process to rely only on the fixed, known good versions, with checksum/signature verification? _______________________________________________ Boost mailing list -- [email protected] To unsubscribe send an email to [email protected] https://lists.boost.org/mailman3/lists/boost.lists.boost.org/ Archived at: https://lists.boost.org/archives/list/[email protected]/message/PWMKDQIL5SOVYJFUIZ34Z7CMFVVFXO4D/