cloudfoundry / cloudfoundry/nodejs-buildpack
BDSA-2025-12492 CVE-2025-8869
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 174
- Forks
- 389
- PR merge metrics
- No merged PRs in 30d
Description
Affected Components pypi:pip/24.0
The vulnerable pip version 24.0 IS present in Python Version 3.11.15
Option 1: Wait for Python 3.11.16 (Recommended)
- Python 3.11.16 will likely bundle a patched pip version
- Python 3.11.x is in maintenance mode, so updates come periodically
- Track https://www.python.org/downloads/ for 3.11.16 release
Option 2: Document Workaround
Since most users won't directly use pip from the nodejs-buildpack's Python:
- Document that users should upgrade pip after installation:
python -m pip install --upgrade pip - This is already a best practice
Option 3: Consider Deprecation
- Python 3.11.x reaches EOL on 2027-10-24 (per manifest.yml)
- Consider if Python 3.11.x is still needed in the nodejs-buildpack
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by checking manifest.yml for the Python 3.11 lifecycle and the packaged pip version. Review the BDSA-2025-12492 and CVE-2025-8869 details, then determine whether the issue's intended outcome is a pip upgrade, documented workaround, or Python-version deprecation; completion criteria are not yet specified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100