Re: 100MB of Node.js modules shipped in the Boost release tarball

Sam Darwin via Boost <[email protected]> Wed, 17 Jun 2026 12:58:39 -0600

Newsgroups	gmane.comp.lib.boost.devel
Message-ID	<CANEqPjGyianjCXN+s4jm-H=bAhR-Mp=_TeyGe-=4VN+Ni0j67Q@mail.gmail.com>

> fixed known good versions

The nodejs installations use package-lock.json files to lock the versions.

At the time of a boost release, a completely new archive isn't generated,
suddenly introducing a problem. Rather, a previous snapshot is renamed. If
a vulnerability appeared during the lock-down period, we would at least
have some chance to react.
_______________________________________________
Boost mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.boost.org/mailman3/lists/boost.lists.boost.org/
Archived at: https://lists.boost.org/archives/list/[email protected]/message/PMEJFZB6M3DW6Q2J6HXDCB5BA4KRQBHR/