Centos – nodejs version on EPEL repository

centosnode.jsyum

Current stable node.js version is v0.12.2. I just run yum update on my machine and it updated node to v0.10.36.

Why is my EPEL repo version so old compared to current stable one? Can I update node to latest version through yum or do I have to compile it myself?

I have CentOS 6.6

Best Answer

RHEL 6 was released in 2010 and one of the consequences of choosing an enterprise distribution with long term support cycles is you'll end up with seeming old versions of software, a trade-off for stability and better support for third-party software.

(Note: an old version do not equate to insecure, read up on backporting of security updates.)

Typically if you need something more recent you should look for a the next major release i.e. RHEL 7.

You might get more recent supported versions of certain software in older Red Hat Enterprise Linux releases by subscribing to the Software Collections channel.

Node.js is part of the SC channel currently supported as release 0.10 so that seems about correct.

Related Solutions

Centos – install php-mcrypt on Centos 6

Package php-mcrypt.x86_64 0:5.1.6-5.el5 will be installed

Pay attention to the el5, it means that this package is pulling from the EL5 repo. Make sure that the epel-release-6-5.noarch.rpm has been installed successfully:

$ rpm -qa | grep epel
epel-release-6-5.noarch

and the mirrorlist (in /etc/yum.repos.d/epel.repo) point to the right path:

[epel]
name=Extra Packages for Enterprise Linux 6 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/6/$basearch
mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6

(epel-6 instead of epel-5)

Centos – Updating OpenSSH to latest stable version via yum

As far as security fixes are concerned, you're all set; your compliance scanner is the one that's wrong.

A lot of those scanners do their vulnerability detection via a check of the version string (in this case, a check of the string that OpenSSH sends to connecting clients including its version), which often leads to false positives when those scanners assume "issue X was fixed in OpenSSH version 5.whatever). Try changing an Apache server to ServerTokens Major and watch the scanner light up with a bunch of 2.0 vulnerabilities, regardless of what version you're actually on.

Figure out exactly what vulnerabilities the scan thinks you have, find them in the RPM's changelog, and send your scan vendor the version that you're on as proof that the scan's detection is a false positive. And this link, for good measure.

Best Answer

Related Solutions

Centos – install php-mcrypt on Centos 6

Centos – Updating OpenSSH to latest stable version via yum

Related Topic