Re: 100MB of Node.js modules shipped in the Boost release tarball

On Wed, Jun 17, 2026 at 1:53 PM Andrey Semashev via Boost <
[email protected]> wrote:

> On 17 Jun 2026 21:17, Sam Darwin via Boost wrote:
> >>  Node.js modules included in the boost
> >
> > Hi Jonathan,
> >
> > I believe this is solved, going forward, with boost 1.92.0.
> >
> > Download the latest boost 1.92.0 snapshot:
> > https://archives.boost.io/develop/
> > https://archives.boost.io/develop/boost_1_92_0-snapshot.tar.bz2
> >
> > No node_modules in the archive, right?
>
> Given that these modules are downloaded during Boost build and have
> known vulnerabilities, this may pose a security thread to Boost building
> infrastructure. Is it possible to remove this dependency download or at
> the very least change the building process to rely only on the fixed,
> known good versions, with checksum/signature verification?
>

Which code is downloading them?


-- 
-- René Ferdinand Rivera Morell
-- Don't Assume Anything  -- No Supongas Nada
-- Robot Dreams - http://robot-dreams.net
_______________________________________________
Boost mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.boost.org/mailman3/lists/boost.lists.boost.org/
Archived at: https://lists.boost.org/archives/list/[email protected]/message/LDP5OGQI7ZWNVU2KX5CMOWASLZPE7J45/