Update latest versions for security release

[mhdawson]

No description provided.

[nodejs-github-bot]

@mhdawson sadly an error occured when I tried to trigger a build :(

[mhdawson]

Had talked to @SimenB earlier in context of security release going to manually land.

[nschonni]

Might want to use the update.sh since it will also fix the Yarn version too

[mhdawson]

@nschonni I was specifically asked to exclude that as its a security release
Can you approve?, seems I cannot land without an approval.

[nschonni]

Sorry, I can't but I sent @LaurentGoderre a text to see if he's around

[mhdawson]

@nschonni thanks, I think @SimenB is probably in bed by now.

[LaurentGoderre]

I aporoved them but i was wondering why not use the update script? The images would get a bump in alpine version and yarn version as well.

Is the rationale that we don't want anything else in the release?

[mhdawson]

@LaurentGoderre yes, I had asked @SimenB and he confirmed that the docker team asks that we only update the node.js versions in a security release so that there is as small a delta as possible.

I used the update script to generate and removed the non-node updates.

[LaurentGoderre]

Ok great!

[LaurentGoderre]

Only waiting on the alpine builds

[SimenB]

Yup! 😀

Awesome that it got released as soon as possible.

the docker team asks that we only update the node.js versions in a security release so that there is as small a delta as possible.

Yup, says so in their readme: https://github.com/docker-library/official-images/blob/master/README.md#security-releases

[LaurentGoderre]

The change detection failed :( https://travis-ci.org/nodejs/docker-node/jobs/391532321#L432

[SimenB]

It was probably merged to docker hub before the build finished on master? They merged 20 minutes after this PR was merged

[LaurentGoderre]

OOOOOOOh!!! I didn't think of that!!!

[LaurentGoderre]

I have a lead on how to make this even easier!

[orjan]

Thanks for building great images!

I hope it's not off-topic but I tried to find when yarn is updated (1.7 in this case)? It looks like it's supposed to be updated together with node PATCH updates. Should it have been part of this PR or how does it work?

UPDATE: I'll guess it's not part of security upgrades, regarding to #784?

[SimenB]

#783 (comment)