Re: 100MB of Node.js modules shipped in the Boost release tarball

> Presumably the limited uses of those packages within the doc
> generation aren't actually affected by most of the CVEs, e.g. I doubt
> anybody is concerned about information leakage or a proxy bypass when
> Axios is used to fetch some files during the doc generation step. But
> again, the scanners don't understand such nuances.

I get that. We had also trouble with test certificates that were used
in CI to verify the TLS integration. They were flagged as if we had
committed our .env to the repo ;). We've eventually got rid of these
too.

>
> Thanks for everybody's prompt responses to this (and to Sam for
> pointing me to the release tools change that removed them from the
> snapshots).

Thank you for reporting the issue.
_______________________________________________
Boost mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.boost.org/mailman3/lists/boost.lists.boost.org/
Archived at: https://lists.boost.org/archives/list/[email protected]/message/5FJ7RDGPIGXBD36AC4EEA3VDGJ2TTP3X/