diff --git a/meetings/2025-06-05.md b/meetings/2025-06-05.md new file mode 100644 index 000000000..a19e778b7 --- /dev/null +++ b/meetings/2025-06-05.md @@ -0,0 +1,62 @@ +# Node.js Security team Meeting 2025-06-05 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=x0KMcmXM42k +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1487 +* **Minutes Google Doc**: https://docs.google.com/document/d/1mKs0C0bE9nLbzsOI7b0Mg4ZoZgdPSPxlYW83MddZ6yk/edit?tab=t.0 + +## Present + +* Security wg team: @nodejs/security-wg + +* Rafael Gonzaga: @RafaelGSS +* Ulises Gascón: @UlisesGascon +* Michael Dawson: @mhdawson +* Marco Ippolito: @marco-ippolito +* Richard Lau: @richardlau +* Elves Viera +* Jean Pierre + +## Agenda + +## Announcements + +*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. + +- [X] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues + * No new issues + +- [X] OpenSSF Scorecard Monitor Review + - No additional work is required from the team (1m period) https://github.com/nodejs/security-wg/pull/1489#pullrequestreview-2900462698 + + +### nodejs/node + +* src: add WDAC integration (Windows) [#54364](https://github.com/nodejs/node/pull/54364) + * LGTM from code perspective + * Asking for a review from Yagiz and James, who previously requested changes on this PR. + * Rafael will see this in action on a Windows machine, setting some WDAC policies + * Michael will take a look at the PR as well + +### nodejs/security-wg + +* Wrong CVE Creation - May 14th Security Releases https://github.com/nodejs/security-wg/issues/1483 + * Thanks to H1 for their help; all CVEs were resolved + * We need to align with them to see if the recent changes in their UI also reflect in the API. + +* Review Code Scanning Alerts #1453 + * We have reviewed some alerts and wrote a set of rules: https://github.com/nodejs/security-wg/issues/1453#issuecomment-2944902765 + +* Update on CVEs for EOL Release Lines – MITRE Removal & Next Steps [#1443](https://github.com/nodejs/security-wg/issues/1443) +* Node.js maintainers: Threat Model [#1333](https://github.com/nodejs/security-wg/issues/1333) +* Audit build process for dependencies [#1037](https://github.com/nodejs/security-wg/issues/1037) + +## Q&A, Other + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. +