diff --git a/meetings/2025-05-08.md b/meetings/2025-05-08.md new file mode 100644 index 000000000..edfc16ff1 --- /dev/null +++ b/meetings/2025-05-08.md @@ -0,0 +1,60 @@ +# Node.js Security team Meeting 2025-05-08 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=XIoC0l7QOeA +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1475 + +## Present + +* Rafael Gonzaga (@RafaelGSS) +* Michael Dawson (@mhdawson) +* Marco Ippolito (@marco-ippolito) +* Robert W + +## Agenda + +## Announcements + +*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. + +- [X] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues + * nothing new this week + +- [X] OpenSSF Scorecard Monitor Review - https://github.com/nodejs/security-wg/issues?q=is%3Aissue+OpenSSF+Scorecard+Report+Updated%21+ + * No update this week + +### nodejs/node + +* src: add WDAC integration (Windows) [#54364](https://github.com/nodejs/node/pull/54364) + * some discussion, nearing ready to get reviewers to re-review after addressing comments. + +### nodejs/security-wg + +* Review Code Scanning Alerts [#1453](https://github.com/nodejs/security-wg/issues/1453) + * We spent some time to go through the report to decide what to do with some of them + +* Update on CVEs for EOL Release Lines – MITRE Removal & Next Steps #1443 + * We are waiting for the HackerOne team to update the list of CVEs + +* OpenJS Security Compliance Checker #1440 + * Defer this discussion to talk with Ulises so he can propagate our thoughts to OpenSSF. + +* Node.js maintainers: Threat Model [#1333](https://github.com/nodejs/security-wg/issues/1333) + * Most of the table has been migrated to https://github.com/nodejs/security-wg/blob/main/MAINTAINERS_THREAT_MODEL.md + * Discussed next step which we will do in the next meeting + +* Audit build process for dependencies [#1037](https://github.com/nodejs/security-wg/issues/1037) + * [MD] updating Amaro build is still on my list, just not at the top yet + +* Automate security release process [#860](https://github.com/nodejs/security-wg/issues/860) + * Closing as completed + +## Q&A, Other + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. +