membersheep / 4bot Goto Github PK

You are receiving this email because you run at least one Node.js application on Heroku.

The Node.js team has announced that a high severity remote Denial of Service (DoS) Constant Hashtable Seeds vulnerability in Node.js versions 4.x through 8.x has been patched in the following versions:

4.8.4
6.11.1
7.10.1
8.1.4

Detecting if you're vulnerable from the Heroku CLI
$ heroku run node -v -a APPNAME

If your version is less than what's listed above, you will need to upgrade.

Upgrading
If your application specifies a Node.js version in the engines section of your package.json, you will first need to update it to the appropriate version listed above. See this devcenter article on specifying a Node.js version for details.

To upgrade, you'll need to push a new commit to your app, which will cause a deploy. If you don't want to push any actual changes, this commit can be empty:

$ git commit --allow-empty -m "upgrade Node.js version"
$ git push heroku master

Verifying that you're running a fixed version of Node.js
After your application has been deployed, you can verify that the new version is installed by running:

$ heroku run node -v -a APPNAME

This will show one of the version strings from above.

Hello,

Earlier today, we notified you that you had one or more Node.js applications affected by a recent vulnerability. We sincerely apologize if the email you received did not include the list of affected applications.

The following Heroku app(s) are affected:

4bot, mumblebot

Note: Apps that have already been upgraded will appear in this list.

Upgrading

1. Review your package.json file. You need to assure your engines section specifies a version that is not vulnerable: 4.8.4, 6.11.1, 7.10.1, or 8.1.4. If you do not specify a version, 6.11.1 will be used automatically. Please see Specifying a Node.js version for details.

2. Push a new commit to your app, which will cause a deploy. For example:

$ heroku git:clone -a APPNAME
# review your package.json and edit if necessary (see above)
$ git add package.json
$ git commit --allow-empty -m "Upgrade Node.js version"
$ git push heroku master

If you have any additional questions, please view our detailed FAQ.