Skip to content

Commit 367f90a

Browse files
ejarocki-cloudlinuxejarocki-cloudlinux
authored
Merge pull request #359 from ejarocki-cloudlinux/master
Add cross-spawn and bootstrap-sass
2 parents b842128 + 9c50ded commit 367f90a

File tree

5 files changed

+206
-0
lines changed

5 files changed

+206
-0
lines changed

‎docs/.vuepress/components/ELSTechnology.vue‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,11 @@ const techData = [
290290
versions: "3.4.1 | 4.6.2",
291291
link: "./bootstrap/",
292292
},
293+
{
294+
name: "bootstrap-sass",
295+
versions: "3.4.0-tuxcare.1",
296+
link: "./bootstrap-sass/",
297+
},
293298
{
294299
name: "braces",
295300
versions: "2.3.2",
@@ -310,6 +315,11 @@ const techData = [
310315
versions: "2.0.6",
311316
link: "./javascript-libraries/",
312317
},
318+
{
319+
name: "cross-spawn",
320+
versions: "5.1.0",
321+
link: "./javascript-libraries/",
322+
},
313323
{
314324
name: "CryptoJS",
315325
versions: "3.3.0",

‎docs/.vuepress/config-client/sidebar.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,10 @@ export default {
247247
path: '/els-for-libraries/bootstrap/',
248248
icon: '/images/bootstrap-logo.webp',
249249
},
250+
{
251+
path: '/els-for-libraries/bootstrap-sass/',
252+
icon: '/images/bootstrap-sass-logo.webp',
253+
},
250254
{
251255
path: '/els-for-libraries/express/',
252256
icon: '/images/express-logo.webp',

‎docs/.vuepress/public/images/bootstrap-sass-logo.webp‎

794 Bytes
Loading

‎docs/els-for-libraries/bootstrap-sass/README.md‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
# bootstrap-sass
2+
3+
Endless Lifecycle Support (ELS) for bootstrap-sass from TuxCare provides security fixes for bootstrap-sass versions that have reached their end of life. This allows you to continue running bootstrap-sass applications without vulnerability concerns, even after official support has ended.
4+
5+
## Supported bootstrap-sass Versions
6+
7+
* bootstrap-sass 3.4.0-tuxcare.1
8+
9+
## Connection to ELS for bootstrap-sass Library
10+
11+
This guide outlines the steps needed to integrate the TuxCare ELS for the bootstrap-sass library.
12+
13+
## Step 1: Get Token
14+
15+
You need a token in order to use TuxCare ELS bootstrap-sass library. Anonymous access is disabled. To receive the token, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
16+
17+
## Step 2: Set Up ELS for bootstrap-sass
18+
19+
TuxCare provides ELS for bootstrap-sass as an NPM package, hosted on a secure internal registry. Follow the steps below to add it to your project and get started.
20+
21+
1. Navigate to the root directory of your bootstrap-sass project.
22+
2. Create a `.npmrc` file or update it if it already exists.
23+
24+
**Example:**
25+
26+
```text
27+
my-bootstrap-sass-project/
28+
├── node_modules/
29+
├── package.json
30+
├── .npmrc ⚠️ ← Create it here
31+
└── package-lock.json
32+
```
33+
34+
3. Use an editor of your choice (e.g., VS Code) to add the following registry address line:
35+
36+
<CodeWithCopy>
37+
38+
```text
39+
registry=https://registry.npmjs.org/
40+
@els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/
41+
//nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN}
42+
```
43+
44+
</CodeWithCopy>
45+
46+
:::warning
47+
Replace ${TOKEN} with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com).
48+
:::
49+
50+
4. Update your `package.json` file to replace your bootstrap-sass dependencies with the TuxCare packages. You can do this in two ways:
51+
52+
* **Option 1: TuxCare Patcher (Automated)**
53+
54+
Install the Patcher globally and run it. The TuxCare Patcher automatically detects the bootstrap-sass version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages.
55+
56+
<CodeWithCopy>
57+
58+
```text
59+
npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc
60+
tuxcare-patch-js
61+
```
62+
63+
</CodeWithCopy>
64+
65+
The patcher will update your `package.json`, for example, from:
66+
67+
```text
68+
"dependencies": {
69+
"bootstrap-sass": "^3.4.0"
70+
}
71+
```
72+
73+
to:
74+
75+
```text
76+
"dependencies": {
77+
"bootstrap-sass": "npm:@els-js/bootstrap-sass@3.4.0-tuxcare.1"
78+
},
79+
"overrides": {
80+
"bootstrap-sass@3.4.0": "npm:@els-js/bootstrap-sass@3.4.0-tuxcare.1"
81+
}
82+
```
83+
84+
* **Option 2: Manual Update**
85+
86+
Manually update your `package.json` file by replacing your bootstrap-sass dependencies with the TuxCare packages. This method gives you full control over which packages to update.
87+
88+
<CodeWithCopy>
89+
90+
```text
91+
"dependencies": {
92+
"bootstrap-sass": "npm:@els-js/bootstrap-sass@3.4.0-tuxcare.1"
93+
}
94+
```
95+
96+
</CodeWithCopy>
97+
98+
5. You need to remove the `node_modules` directory and the `package-lock.json` file, and also clear the `npm cache` before installing the patched packages. Use the following commands:
99+
100+
<CodeWithCopy>
101+
102+
```text
103+
rm -rf node_modules package-lock.json && npm cache clean --force
104+
```
105+
106+
</CodeWithCopy>
107+
108+
6. Run the following command to install the ELS version of the bootstrap-sass library (token for the TuxCare repository will be automatically picked up from your `.npmrc` file):
109+
110+
<CodeWithCopy>
111+
112+
```text
113+
npm install
114+
```
115+
116+
</CodeWithCopy>
117+
118+
## Step 3: Verify Installation
119+
120+
1. To confirm the TuxCare bootstrap-sass library is set up correctly, use npm to list the project's dependencies:
121+
122+
<CodeWithCopy>
123+
124+
```text
125+
npm list
126+
```
127+
128+
</CodeWithCopy>
129+
130+
2. After reviewing the dependencies, run your application to ensure everything works correctly.
131+
132+
The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for bootstrap-sass repository.
133+
134+
## Vulnerability Exploitability eXchange (VEX)
135+
136+
VEX is a machine-readable format that tells you if a known vulnerability and is actually exploitable in your product. It reduces false positives, helps prioritize real risks.
137+
138+
TuxCare provides VEX for bootstrap-sass ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_javascript/bootstrap-sass/](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/bootstrap-sass/).
139+
140+
## How to Upgrade to a Newer Version of TuxCare Packages
141+
142+
If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you can use one of the following methods:
143+
144+
* **Option 1: TuxCare Patcher (Automated). Recommended for projects with multiple TuxCare dependencies.**
145+
146+
The TuxCare Patcher automatically detects all TuxCare dependencies in your `package.json` and updates them to the latest available versions.
147+
148+
<CodeWithCopy>
149+
150+
```text
151+
tuxcare-patch-js --upgrade
152+
```
153+
154+
</CodeWithCopy>
155+
156+
* **Option 2: Manual Update via CLI (Single Dependency)**
157+
158+
If you want to update a single TuxCare dependency, use the npm install command with the specific version. This automatically updates both `package.json` and `package-lock.json`:
159+
160+
<CodeWithCopy>
161+
162+
```text
163+
npm install bootstrap-sass@npm:@els-js/bootstrap-sass@3.4.0-tuxcare.1
164+
```
165+
166+
</CodeWithCopy>
167+
168+
* **Option 3: Manual Update via package.json (Multiple Dependencies)**
169+
170+
If you want to update several TuxCare dependencies, manually update the version strings in your `package.json`, then remove installed files and clear npm cache to avoid conflicts:
171+
172+
<CodeWithCopy>
173+
174+
```text
175+
rm -rf node_modules package-lock.json && npm cache clean --force
176+
npm install
177+
```
178+
179+
</CodeWithCopy>
180+
181+
## Resolved CVEs
182+
183+
Fixes for the following vulnerabilities are available in ELS for bootstrap-sass from TuxCare versions:
184+
185+
| CVE ID | CVE Type | Severity | Affected Libraries | Vulnerable Versions |
186+
|:-------------:|:--------:|:--------:|:------------------:|:-------------------:|
187+
| CVE-2019-8331 | Direct | Medium | bootstrap-sass | < 3.4.1, >= 4.3.0 < 4.3.1 |
188+
189+
If you are interested in the TuxCare Endless Lifecycle Support, contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
190+

‎docs/els-for-libraries/javascript-libraries/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fix
1010
* **braces** 2.3.2
1111
* **copy-anything** 2.0.6
1212
* **cookie** 0.4.2
13+
* **cross-spawn** 5.1.0
1314
* **crypto-js** 3.3.0
1415
* **debug** 4.1.1
1516
* **dompurify** 2.3.0, 2.4.3
@@ -248,6 +249,7 @@ Fixes for the following vulnerabilities are available in ELS for JavaScript Libr
248249
| CVE-2022-25883 | Direct | High | semver | < 5.7.2, >= 6.0.0 < 6.3.1, >= 7.0.0 < 7.5.3 |
249250
| CVE-2022-3517 | Direct | High | minimatch | <= 3.0.5 |
250251
| CVE-2024-21536 | Direct | High | http-proxy-middleware | < 2.0.7, >= 3.0.0, < 3.0.3 |
252+
| CVE-2024-21538 | Direct | High | cross-spawn | - |
251253
| CVE-2024-29415 | Direct | High | ip | <= 2.0.1 |
252254
| CVE-2024-4068 | Direct | High | braces | < 3.0.3 |
253255
| AIKIDO-2024-10543 | Direct | High | i18next | 17.0.2 - 24.1.1 |

0 commit comments

Comments
 (0)