Skip to content

Commit bddd37b

Browse files
ejarocki-cloudlinuxejarocki-cloudlinux
authored
Merge pull request #366 from ejarocki-cloudlinux/master
add loopback page
2 parents 28e2d51 + 2dc6b8d commit bddd37b

File tree

3 files changed

+205
-0
lines changed

3 files changed

+205
-0
lines changed

‎docs/.vuepress/components/ELSTechnology.vue‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,11 @@ const techData = [
495495
versions: "4.5.0 | 4.17.x",
496496
link: "./lodash/",
497497
},
498+
{
499+
name: "LoopBack",
500+
versions: "2.42.0",
501+
link: "./loopback/",
502+
},
498503
{
499504
name: "marked",
500505
versions: "4.0.9",

‎docs/.vuepress/config-client/sidebar.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,10 @@ export default {
287287
path: '/els-for-libraries/lodash/',
288288
icon: '/images/lodash-logo.webp',
289289
},
290+
{
291+
path: '/els-for-libraries/loopback/',
292+
icon: '/images/loopback-logo.webp',
293+
},
290294
{
291295
path: '/els-for-libraries/mongodb-driver/',
292296
icon: '/images/mongodb-logo.webp',

‎docs/els-for-libraries/loopback/README.md‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
# LoopBack
2+
3+
Endless Lifecycle Support (ELS) for LoopBack from TuxCare provides security fixes for LoopBack versions that have reached their end of life. This allows you to continue running LoopBack applications without vulnerability concerns, even after official support has ended.
4+
5+
## Supported LoopBack Versions
6+
7+
* LoopBack 2.42.0
8+
9+
## Connection to ELS for LoopBack Library
10+
11+
This guide outlines the steps needed to integrate the TuxCare ELS for the LoopBack library.
12+
13+
## Step 1: Get Token
14+
15+
You need a token in order to use TuxCare ELS LoopBack library. Anonymous access is disabled. To receive the token, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
16+
17+
## Step 2: Set Up ELS for LoopBack
18+
19+
TuxCare provides ELS for LoopBack as an NPM package, hosted on a secure internal registry. Follow the steps below to add it to your project and get started.
20+
21+
1. Navigate to the root directory of your LoopBack project.
22+
2. Create a `.npmrc` file or update it if it already exists.
23+
24+
**Example:**
25+
26+
```text
27+
my-loopback-project/
28+
├── node_modules/
29+
├── package.json
30+
├── .npmrc ⚠️ ← Create it here
31+
└── package-lock.json
32+
```
33+
34+
3. Use an editor of your choice (e.g., VS Code) to add the following registry address line:
35+
36+
<CodeWithCopy>
37+
38+
```text
39+
registry=https://registry.npmjs.org/
40+
@els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/
41+
//nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN}
42+
```
43+
44+
</CodeWithCopy>
45+
46+
:::warning
47+
Replace ${TOKEN} with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com).
48+
:::
49+
50+
4. Update your `package.json` file to replace your LoopBack dependencies with the TuxCare packages. You can do this in two ways:
51+
52+
* **Option 1: TuxCare Patcher (Automated)**
53+
54+
Install the Patcher globally and run it. The TuxCare Patcher automatically detects the LoopBack version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages.
55+
56+
<CodeWithCopy>
57+
58+
```text
59+
npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc
60+
tuxcare-patch-js
61+
```
62+
63+
</CodeWithCopy>
64+
65+
The patcher will update your `package.json`, for example, from:
66+
67+
```text
68+
"dependencies": {
69+
"loopback": "^2.42.0"
70+
}
71+
```
72+
73+
to:
74+
75+
```text
76+
"dependencies": {
77+
"loopback": "npm:@els-js/loopback@2.42.0-tuxcare.1"
78+
},
79+
"overrides": {
80+
"loopback@2.42.0": "npm:@els-js/loopback@2.42.0-tuxcare.1"
81+
}
82+
```
83+
84+
* **Option 2: Manual Update**
85+
86+
Manually update your `package.json` file by replacing your LoopBack dependencies with the TuxCare packages. This method gives you full control over which packages to update.
87+
88+
<CodeWithCopy>
89+
90+
```text
91+
"dependencies": {
92+
"loopback": "npm:@els-js/loopback@2.42.0-tuxcare.1"
93+
}
94+
```
95+
96+
</CodeWithCopy>
97+
98+
5. You need to remove the `node_modules` directory and the `package-lock.json` file, and also clear the `npm cache` before installing the patched packages. Use the following commands:
99+
100+
<CodeWithCopy>
101+
102+
```text
103+
rm -rf node_modules package-lock.json && npm cache clean --force
104+
```
105+
106+
</CodeWithCopy>
107+
108+
6. Run the following command to install the ELS version of the LoopBack library (token for the TuxCare repository will be automatically picked up from your `.npmrc` file):
109+
110+
<CodeWithCopy>
111+
112+
```text
113+
npm install
114+
```
115+
116+
</CodeWithCopy>
117+
118+
## Step 3: Verify Installation
119+
120+
1. To confirm the TuxCare LoopBack library is set up correctly, use npm to list the project's dependencies:
121+
122+
<CodeWithCopy>
123+
124+
```text
125+
npm list
126+
```
127+
128+
</CodeWithCopy>
129+
130+
2. After reviewing the dependencies, run your application to ensure everything works correctly.
131+
132+
The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for LoopBack repository.
133+
134+
## Vulnerability Exploitability eXchange (VEX)
135+
136+
VEX is a machine-readable format that tells you if a known vulnerability and is actually exploitable in your product. It reduces false positives, helps prioritize real risks.
137+
138+
TuxCare provides VEX for LoopBack ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_javascript/loopback/](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/loopback/).
139+
140+
## How to Upgrade to a Newer Version of TuxCare Packages
141+
142+
If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), you can use one of the following methods:
143+
144+
* **Option 1: TuxCare Patcher (Automated). Recommended for projects with multiple TuxCare dependencies.**
145+
146+
The TuxCare Patcher automatically detects all TuxCare dependencies in your `package.json` and updates them to the latest available versions.
147+
148+
<CodeWithCopy>
149+
150+
```text
151+
tuxcare-patch-js --upgrade
152+
```
153+
154+
</CodeWithCopy>
155+
156+
* **Option 2: Manual Update via CLI (Single Dependency)**
157+
158+
If you want to update a single TuxCare dependency, use the npm install command with the specific version. This automatically updates both `package.json` and `package-lock.json`:
159+
160+
<CodeWithCopy>
161+
162+
```text
163+
npm install loopback@npm:@els-js/loopback@2.42.0-tuxcare.1
164+
```
165+
166+
</CodeWithCopy>
167+
168+
* **Option 3: Manual Update via package.json (Multiple Dependencies)**
169+
170+
If you want to update several TuxCare dependencies, manually update the version strings in your `package.json`, then remove installed files and clear npm cache to avoid conflicts:
171+
172+
<CodeWithCopy>
173+
174+
```text
175+
rm -rf node_modules package-lock.json && npm cache clean --force
176+
npm install
177+
```
178+
179+
</CodeWithCopy>
180+
181+
## Resolved CVEs
182+
183+
Fixes for the following vulnerabilities are available in ELS for LoopBack from TuxCare versions:
184+
185+
| CVE ID | CVE Type | Severity | Affected Libraries | Vulnerable Versions |
186+
|:-------------:|:---------:|:--------:|:------------------:|:-------------------:|
187+
| CVE-2022-29078 | Transitive | Critical | ejs | 3.1.6 |
188+
| CVE-2021-23400 | Transitive | High | nodemailer | < 6.6.1 |
189+
| CVE-2020-7769 | Transitive | Critical | nodemailer | < 6.4.16 |
190+
| GHSA-9h6g-pr28-7cqp | Transitive | Moderate | nodemailer | <= 6.9.8 |
191+
| CVE-2025-13033 | Transitive | High | nodemailer | - |
192+
| CVE-2025-14874 | Transitive | Medium | nodemailer | - |
193+
| GHSA-rcmh-qjqh-p98v | Transitive | Low | nodemailer | <= 7.0.10 |
194+
195+
If you are interested in the TuxCare Endless Lifecycle Support, contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
196+

0 commit comments

Comments
 (0)