# TuxCare Documentation — Full Text > Full text of the TuxCare product documentation (docs.tuxcare.com), concatenated for LLM consumption. Each section below is one documentation page, preceded by its source URL. Interactive/tabbed content has been flattened; visit the source URL for the rendered page. ================================================================================ Source: https://docs.tuxcare.com/ ================================================================================ # TuxCare Product Documentation ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/ ================================================================================ # Endless Lifecycle Support for Open-Source Applications ## Vulnerability Coverage and Target Response Times TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system integrates both NVD scoring and vendor scoring (when available); when the vendor's score is lower than the NVD score, we prioritize the NVD score. Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements. * **Vulnerability coverage.** TuxCare shall provide security patches for critical- and high-risk (CVSS 7.0 and above), medium-risk (CVSS 4.0 to 6.9), and low-risk (CVSS 0.1 to 3.9) vulnerabilities. TuxCare reserves the right to offer a mitigation strategy as an alternative to a direct code fix. * **Response time.** TuxCare will make commercially reasonable efforts to adhere to the following guidelines when addressing vulnerabilities: * **High- and critical-risk vulnerabilities (CVSS 7.0 and above):** Patches are provided within 14 days from the date the vulnerabilities are publicly disclosed. * **Medium-risk vulnerabilities (CVSS 4.0 to 6.9):** Patches are provided within 60 days from the date the vulnerabilities are publicly disclosed. * **Low-risk vulnerabilities (CVSS 0.1 to 3.9):** Patches are provided within 90 days from the date the vulnerabilities are publicly disclosed. ## Incident Reporting and Response Timeframe Customers can report vulnerabilities by submitting a ticket through the [TuxCare Support Portal](https://tuxcare.com/support-portal/). TuxCare commits to providing an initial response to any reported issue within 3 days. Requests for customer-directed security patches for CVEs that are outside of the ELS for Open-Source Applications scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 60 days. Handling Multiple Vulnerabilities: In cases where several CVEs are reported simultaneously for fixing, TuxCare will discuss and agree upon resolution timelines separately with the customer. ## Enhanced Transparency & Visibility TuxCare's commitment to transparency and visibility is foundational to our ELS for Open-Source Applications offering. We provide comprehensive details about how each package is built, verified, and distributed, ensuring complete trust in the software supply chain. * **Software Bill of Materials (SBOM)**: Machine-readable SBOMs provide visibility into package composition and dependencies, supporting software supply chain transparency and accountability. Depending on the package, SBOMs are provided in industry-standard formats — SPDX and CycloneDX. See [Machine-Readable Security Data](./machine-readable-security-data/) for current availability. Note: SBOM availability for certain components is still expanding and may vary by package. Contact [sales@tuxcare.com](mailto:sales@tuxcare.com) for current availability details. * **Vulnerability Exploitability eXchange (VEX)**: Machine-readable VEX documents provide contextual vulnerability information, helping teams understand which known CVEs affect specific package versions and reduce remediation noise. VEX is published in standard formats, including CycloneDX VEX. See [Machine-Readable Security Data](./machine-readable-security-data/) for per-ecosystem feeds and details. * **Verifiable Integrity and Provenance**: Our packages and metadata provide comprehensive end-to-end provenance, detailing how each package was constructed and tested, ensuring that all components in your software stack are trustworthy. Note: This feature is under consideration for future development and may be available at a later date. If you are interested, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). * **Secure Distribution**: Signed versions of the packages and their metadata are distributed from a registry managed, secured, and protected by TuxCare, guaranteeing that your software updates are authentic and untampered. ## Support Duration TuxCare provides continuous security patching for all supported end-of-life (EOL) technologies for as long as your organization requires them, eliminating the need for rushed or disruptive upgrades. All updates are delivered at a fixed price for the full term of your contract, ensuring predictable costs and uninterrupted protection. ## Technical Support TuxCare provides technical support according to the [support policy](https://tuxcare.com/TuxCare-support-policy.pdf?_gl=1*9hjdum*_up*MQ..*_ga*MTQ0MTM0NTI4OC4xNjk5Mzk2ODYy*_ga_Z539WTSZ80*MTY5OTM5Njg2MC4xLjAuMTY5OTM5Njg2MC4wLjAuMA..*_ga_1790YFKF4F*MTY5OTM5Njg2MC4xLjAuMTY5OTM5Njg2MC4wLjAuMA..*_ga_64QBSWJJGS*MTY5OTM5Njg2MC4xLjAuMTY5OTM5Njg2MC4wLjAuMA..). It delivers 24/7/365 access to TuxCare’s support team through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to TuxCare’s online knowledge base. ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/apache-hadoop/ ================================================================================ # Apache Hadoop TuxCare's Endless Lifecycle Support (ELS) for Apache Hadoop provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of Apache Hadoop core components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Apache Hadoop service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Hadoop applications. ## Supported Versions * Apache Hadoop 2.7.1, 2.7.3 ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Hadoop repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Hadoop repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. * [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) * [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) 4. **Update dependencies** Replace Apache Hadoop dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.hadoop hadoop-project 2.7.3.tuxcare.1 pom import org.apache.hadoop hadoop-common ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.hadoop:hadoop-common:2.7.1.tuxcare.1") } ``` 5. **Verify the setup** Use your build tool to list the project's dependencies and confirm TuxCare packages are resolved correctly. Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` 6. **Build the project** Include any library from the repository and run a build. Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Hadoop repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Hadoop) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Hadoop) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Hadoop) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.hadoop/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](https://nexus.repo.tuxcare.com/repository/els_java/org/apache/hadoop/hadoop-common/2.7.3.tuxcare.1/hadoop-common-2.7.3.tuxcare.1-sources.jar) — Nexus repository (credentials required) * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/apache-hive/ ================================================================================ # Apache Hive TuxCare's Endless Lifecycle Support (ELS) for Apache Hive provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of Apache Hive. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Apache Hive service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Hive applications. ## Supported Versions * Apache Hive 2.3.9 ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Hive repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Hive repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example Maven and Gradle projects are available on GitHub. Remember to set the required environment variables. * [Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven) * [Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle) 4. **Update dependencies** Replace Apache Hive dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.hive hive 2.3.9.tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.hive:hive:2.3.9.tuxcare.1") } ``` 5. **Verify the setup** Use your build tool to list the project's dependencies and confirm TuxCare packages are resolved correctly. Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` 6. **Build the project** Include any library from the repository and run a build. Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool you're using should be able to identify and resolve dependencies from the TuxCare ELS for Apache Hive repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Hive) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Hive) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Hive) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.hive/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](https://nexus.repo.tuxcare.com/repository/els_java/) — Nexus repository (credentials required) * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/apache-tomcat/ ================================================================================ # Apache Tomcat® Apache® and Apache Tomcat® are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Tomcat® provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of Apache Tomcat® core components such as Coyote, Catalina, Jasper, etc. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Apache Tomcat® service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Tomcat® applications. This guide outlines the steps needed for Apache Tomcat® server setup and configuration. Apache Tomcat® is also available for installation as a library for Maven and Gradle projects. You can find the corresponding instructions [here](/els-for-libraries/apache-tomcat/). ## Supported Versions * Apache Tomcat® 7.0.109, 8.5.100, 9.0.46, 9.0.50, 9.0.75, 9.0.83, 9.0.87, 9.0.90, 9.0.100, 10.1.18, 10.1.42 ## Installation * Java Development Kit (JDK) 7 or later installed (verify with `java -version`) * `JAVA_HOME` set to your JDK installation directory * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. ## Linux Installation 1. **Prepare a `tomcat` group** Create a `tomcat` group: ```text sudo groupadd tomcat ``` 2. **Create a `tomcat` user** Create a new user as a member of the `tomcat` group, with a home directory of `/opt/tomcat` and the login shell set to `/bin/false`. ```text sudo useradd -s /bin/false -g tomcat -d /opt/tomcat tomcat ``` 3. **Download the TuxCare build** Download from TuxCare using your credentials. For example, Apache Tomcat® 8.5.100: ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els_java/org/apache/tomcat/tomcat/8.5.100-tuxcare.3/tomcat-8.5.100-tuxcare.3.tar.gz ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). 4. **Create the installation directory and extract the archive** * Create the `/opt/tomcat` directory: ```text sudo mkdir -p /opt/tomcat ``` * Extract the archive into it: ```text sudo tar -xvzf tomcat-8.5.100-tuxcare.3.tar.gz -C /opt/tomcat --strip-components=1 ``` 5. **Configure ownership and permissions** * Change to the installation directory: ```text cd /opt/tomcat ``` * Change ownership of the installation to the `tomcat` group: ```text sudo chgrp -R tomcat /opt/tomcat ``` * Give the `tomcat` group read access to `conf` and its contents, and execute access to the `conf` directory: ```text sudo chmod -R g+r conf sudo chmod g+x conf ``` * Give the `tomcat` user write access to `webapps`, `work`, `temp`, and `logs`: ```text sudo chown -R tomcat webapps/ work/ temp/ logs/ ``` 6. **Set `CATALINA_HOME` and reload the shell** * Add the following line at the end of your `~/.bashrc` file, updating the path if needed. ```text export CATALINA_HOME=/opt/tomcat ``` If you're using a different shell, you may need to edit `~/.bash_profile` instead. * Reload the shell configuration: ```text source ~/.bashrc ``` * Confirm the variable is set: ```text echo $CATALINA_HOME ``` 7. **Start Apache Tomcat®** ```text sudo -u tomcat /opt/tomcat/bin/startup.sh ``` 8. **Verify installation** * Go to [http://localhost:8080/](http://localhost:8080/). You should see the default Apache Tomcat® homepage. * Or check from the terminal (successful output is HTML from Tomcat®): ```text curl http://localhost:8080 ``` 9. **Stop Apache Tomcat®** ```text sudo -u tomcat /opt/tomcat/bin/shutdown.sh ``` ## Windows Installation 1. **Download Apache Tomcat®** Download the .zip archive from [https://nexus.repo.tuxcare.com/repository/els_java/](https://nexus.repo.tuxcare.com/repository/els_java/) using your credentials. 2. **Extract the archive** Extract, for example, `apache-tomcat-8.5.100-tuxcare.3.zip` to the installation directory, e.g., `C:\Tomcat`. 3. **Open Environment Variables** Right-click *This PC* → *Properties* → *Advanced system settings* → *Environment Variables*. 4. **Set `CATALINA_HOME`** Add a new system variable with the value `C:\Tomcat\apache-tomcat-8.5.100-tuxcare.3` (or your installation path). 5. **Start Apache Tomcat®** Double-click `C:\Tomcat\apache-tomcat-8.5.100-tuxcare.3\bin\startup.bat`. 6. **Verify installation** Go to [http://localhost:8080/](http://localhost:8080/) in your browser. You should see the default Apache Tomcat® homepage. 7. **Stop Apache Tomcat®** Double-click `C:\Tomcat\apache-tomcat-8.5.100-tuxcare.3\bin\shutdown.bat`. ## Logs Location Check logs for detailed error information: * **Linux:** ```text /opt/tomcat/logs/catalina.out ``` * **Windows:** ```text C:\Tomcat\logs\catalina.[date].log ``` ## What's next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Tomcat) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Tomcat) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Tomcat) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/gradle/ ================================================================================ # Gradle TuxCare's Endless Lifecycle Support (ELS) for Gradle provides security patches for versions of Gradle that have reached End of Life (EOL) or are no longer maintained by the upstream vendor. Our ELS for Gradle service is designed for organizations that are not yet ready to migrate to newer Gradle versions and that are seeking long-term stability for their build infrastructure. ## Supported Versions * Gradle 6.9.4, 7.6.6 ## Installation * Java Development Kit (JDK) 8 or later installed (verify with `java -version`) * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. ## Linux Installation 1. **Download Gradle** Download from TuxCare via the terminal using your credentials. For example, Gradle 6.9.4: ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els_java/org/gradle/gradle/6.9.4-tuxcare.1/gradle-6.9.4-tuxcare.1-bin.zip ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). Adjust the version as needed. 2. **Extract the archive** ```text sudo mkdir -p /opt/gradle sudo unzip gradle-6.9.4-tuxcare.1-bin.zip -d /opt/gradle ``` 3. **Verify the installation** Run the Gradle binary from the extracted directory. ```text /opt/gradle/gradle-6.9.4-tuxcare.1/bin/gradle --version ``` The output should display the Gradle version and build details. ## Windows Installation 1. **Download Gradle** Download the .zip archive from TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) using your credentials 2. **Extract the archive** Extract, for example, `gradle-6.9.4-tuxcare.1-bin.zip` to a directory of your choice, e.g., `C:\Gradle` 3. **Verify the installation** Open a Command Prompt or PowerShell window and run the following command. ```text C:\Gradle\gradle-6.9.4-tuxcare.1\bin\gradle --version ``` The output should display the Gradle version and build details. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Gradle) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Gradle) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Gradle) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.gradle/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/grafana/ ================================================================================ # Grafana Endless Lifecycle Support (ELS) for Grafana from TuxCare provides security fixes for Grafana versions that have reached their end of life. This allows you to continue running Grafana without vulnerability concerns, even after official support has ended. ## Supported Grafana Versions * Grafana 10.4.1, 11.2.0, 11.3.0, 11.4.0, 11.5.0 ## Supported Operating Systems TuxCare provides ELS for Grafana as pre-built binaries for the following distributions: * Alpine Linux 3.22 * Debian 12 * Debian 13 ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-golang) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. 1. **Browse and download from Nexus** Visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-golang) and sign in with your credentials. Navigate to the `grafana` folder, choose the directory for your operating system, and download the appropriate archive. 2. **Or download from the command line** ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/grafana/debian13/grafana-10.4.1-tuxcare.1.tar.gz ``` For other Grafana versions, replace `10.4.1` in the path with `11.2.0`, `11.3.0`, `11.4.0`, or `11.5.0` as needed. ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/grafana/debian12/grafana-10.4.1-tuxcare.1.tar.gz ``` For other Grafana versions, replace `10.4.1` in the path with `11.2.0`, `11.3.0`, `11.4.0`, or `11.5.0` as needed. ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/grafana/alpine3_22/grafana-10.4.1-tuxcare.1.tar.gz ``` For other Grafana versions, replace `10.4.1` in the path with `11.2.0`, `11.3.0`, `11.4.0`, or `11.5.0` as needed. Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). Choose the URL that matches your OS and Grafana version. 3. **Extract the archive** Create an installation directory (for example `/opt/grafana`) and extract. ```text sudo mkdir -p /opt/grafana sudo tar -xzf grafana-10.4.1-tuxcare.1.tar.gz -C /opt/grafana --strip-components=1 ``` Adjust the archive filename if you downloaded a different version. 4. **Verify the installation** Change to the installation directory and run the binary to confirm the TuxCare ELS build. ```text cd /opt/grafana ./bin/grafana-server --version ``` 5. **Start Grafana** Use your deployment method (systemd, Docker, or manual) and verify that the application runs correctly. ## What's Next? * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/loki/ ================================================================================ # Loki Endless Lifecycle Support (ELS) for Loki from TuxCare provides security fixes for Loki versions that have reached their end of life. This allows you to continue running Loki without vulnerability concerns, even after official support has ended. ## Supported Loki Versions * Loki 3.1.0, 3.2.0, 3.3.0 ## Supported Operating Systems TuxCare provides ELS for Loki as pre-built binaries for the following distributions: * Alpine Linux 3.22 * Debian 12 * Debian 13 ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-golang) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. 1. **Browse and download from Nexus** Visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-golang) and sign in with your credentials. Navigate to the `loki` folder, choose the directory for your operating system, and download the appropriate archive 2. **Or download from the command line** ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/loki/debian13/loki-3.1.0-tuxcare.1.tar.gz ``` For other Loki versions, replace `3.1.0` in the path with `3.2.0` or `3.3.0` as needed. ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/loki/debian12/loki-3.1.0-tuxcare.1.tar.gz ``` For other Loki versions, replace `3.1.0` in the path with `3.2.0` or `3.3.0` as needed. ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/loki/alpine3_22/loki-3.1.0-tuxcare.1.tar.gz ``` For other Loki versions, replace `3.1.0` in the path with `3.2.0` or `3.3.0` as needed. Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). Choose the URL that matches your OS and Loki version. 3. **Extract the archive** Create an installation directory (for example `/opt/loki`) and extract. ```text sudo mkdir -p /opt/loki sudo tar -xzf loki-3.1.0-tuxcare.1.tar.gz -C /opt/loki --strip-components=1 ``` Adjust the archive filename if you downloaded a different version. 4. **Verify the installation** Change to the installation directory and run the binary to confirm the TuxCare ELS build. ```text cd /opt/loki ./loki --version ``` 5. **Start Loki** Use your configuration and verify that the application runs correctly. ## What's Next? * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/machine-readable-security-data/ ================================================================================ # Machine-Readable Security Data (SBOM, VEX) TuxCare provides machine-readable security data for ELS for Open-Source Applications in the following formats: * **SBOM (Software Bill of Materials)** - package composition and dependency inventory in SPDX and CycloneDX formats * **VEX (Vulnerability Exploitability eXchange)** - exploitability status for known CVEs in CycloneDX VEX format Released fixes are available via [tuxcare.com/cve-tracker](https://tuxcare.com/cve-tracker/) and [security.tuxcare.com](https://security.tuxcare.com/). ## Software Bill of Materials (SBOM) Each application package built by TuxCare ships with an SBOM that lists its components, versions, and dependency relationships. SBOMs are provided in industry-standard formats — SPDX and CycloneDX — so they can be consumed by any SBOM-aware scanner or supply-chain tool. To check whether an SBOM is available for a specific application or to request a copy, reach out to [sales@tuxcare.com](mailto:sales@tuxcare.com). ## Vulnerability Exploitability eXchange (VEX) TuxCare publishes VEX as CycloneDX VEX documents, distributed alongside each package version and updated with every release. The feed is available at [security.tuxcare.com/vex/cyclonedx](https://security.tuxcare.com/vex/cyclonedx/). A VEX document tells you which known CVEs actually affect a given artifact version and which don't, so scanner results stay focused on real exposure. Each entry links one CVE to one artifact version and carries a status: * **exploitable** - the CVE affects this artifact version and has not yet been patched in this release. * **resolved** - the CVE has been patched through a TuxCare release. The feed covers every supported base version, every released `-tuxcare.N` iteration, and transitive dependencies, so the entry count reflects all of these combinations rather than the number of unique CVEs. When checking coverage, filter to the artifact versions you actually use — usually the latest `-tuxcare.N` iteration of your chosen base version. Earlier iterations remain in the feed for historical completeness but aren't relevant once you've adopted a newer release. ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/managing-els-repository/ ================================================================================ # Managing the ELS repository This page provides instructions for upgrading to newer TuxCare-patched application versions. ## Upgrading to a newer TuxCare version 1. **Log in to the Nexus repository** Log in to [nexus.repo.tuxcare.com](https://nexus.repo.tuxcare.com) using your credentials. 2. **Download the new version** Find and download the latest TuxCare version. 3. **Install the update** Follow the [installation instructions](/els-for-applications/) for your application. 4. **Verify and start using** Confirm the new version is installed correctly and run your application as usual. If you encounter any issues, please contact [TuxCare support](https://tuxcare.com/support-portal/). ## Source code TuxCare provides source code for patched applications in the [Nexus repository](https://nexus.repo.tuxcare.com). Source archives and JARs follow the standard naming conventions with a `-sources` classifier or suffix. If a source archive is not available for a specific package, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/mariadb/ ================================================================================ # MariaDB Endless Lifecycle Support (ELS) for MariaDB from TuxCare provides security fixes for versions that have reached end-of-life. This allows you to continue running your deployments without vulnerability concerns, even after official support has ended. ## Supported OS and MariaDB versions | OS | Package Type | OS Version | MariaDB version | | :--------------------------------------------: | :----------: | :--------: | :-------------: | | EL 7 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 7.x | 10.6 | | EL 8 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 8.x | 10.6 | | EL 9 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 9.x | 10.6 | **Supported architecture:** x86_64 (64-bit) ## Installation * A valid TuxCare ELS license key - contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server 1. Download the installer script ```text wget https://repo.tuxcare.com/mariadb-els/install-mariadb-els-repo.sh ``` 2. Run the installer script with your license key ```text sh install-mariadb-els-repo.sh --license-key XXXXXXXX ``` 3. Verify the repository is enabled ```text yum info els-mariadb-release ``` ## Removing the repository To remove the MariaDB ELS repository: ```text sh install-mariadb-els-repo.sh --delete ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/maven/ ================================================================================ # Apache Maven TuxCare's Endless Lifecycle Support (ELS) for Apache Maven provides security patches for versions of Apache Maven that have reached End of Life (EOL) or are no longer maintained by the upstream vendor. Our ELS for Apache Maven service is designed for organizations that are not yet ready to migrate to newer Maven versions and that are seeking long-term stability for their build infrastructure. ## Supported Versions * Apache Maven 3.8.1 * Apache Maven Shared Utils 3.2.1 ## Installation * Java Development Kit (JDK) 7 or later installed (verify with `java -version`) * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. ## Linux Installation 1. **Download Apache Maven** Download from TuxCare via the terminal using your credentials. For example, Maven 3.8.1: ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els_java/org/apache/maven/apache-maven/3.8.1-tuxcare.1/apache-maven-3.8.1-tuxcare.1-bin.tar.gz ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). Adjust the version as needed. 2. **Extract the archive** ```text sudo mkdir -p /opt/maven sudo tar -xvzf apache-maven-3.8.1-tuxcare.1-bin.tar.gz -C /opt/maven ``` 3. **Verify the installation** Run the Maven binary from the extracted directory. ```text /opt/maven/apache-maven-3.8.1-tuxcare.1/bin/mvn --version ``` The output should display the Maven version and build details. ## Windows Installation 1. **Download Apache Maven** Download the .zip archive from TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) using your credentials 2. **Extract the archive** Extract, for example, `apache-maven-3.8.1-tuxcare.1-bin.zip` to a directory of your choice, e.g., `C:\Maven` 3. **Verify the installation** Open a Command Prompt or PowerShell window and run the following command. ```text C:\Maven\apache-maven-3.8.1-tuxcare.1\bin\mvn --version ``` The output should display the Maven version and build details. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Maven) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Maven) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Maven) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/minio/ ================================================================================ # MinIO Endless Lifecycle Support (ELS) for MinIO from TuxCare provides security fixes for MinIO versions that have reached their end of life. This allows you to continue running MinIO without vulnerability concerns, even after official support has ended. ## Supported MinIO Versions * MinIO RELEASE.2025-10-15T17-29-55Z ## Supported Architectures TuxCare provides ELS for MinIO as pre-built Linux binaries for the following architectures: * amd64 * arm64 ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-golang) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. 1. **Browse and download from Nexus** Visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-golang) and sign in with your credentials. Navigate to the `minio` folder and download the archive that matches your architecture. 2. **Or download from the command line** ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/minio/minio_linux_amd64-2025.10.15T17.29.55Z-tuxcare.5.tar.gz ``` ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els-golang/minio/minio_linux_arm64-2025.10.15T17.29.55Z-tuxcare.5.tar.gz ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#installation) above). Choose the URL that matches your architecture. 3. **Extract the archive** Create an installation directory (for example `/opt/minio`) and extract. ```text sudo mkdir -p /opt/minio sudo tar -xzf minio_linux_amd64-2025.10.15T17.29.55Z-tuxcare.5.tar.gz -C /opt/minio --strip-components=1 ``` Adjust the archive filename for your architecture. 4. **Verify the installation** Change to the installation directory and run the binary to confirm the TuxCare ELS build. ```text cd /opt/minio ./minio --version ``` 5. **Start MinIO** Start the MinIO server with your configuration and verify that it runs correctly. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=minio) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=minio) — Patched versions and changelogs * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/mysql-and-percona-server/ ================================================================================ # MySQL and Percona Server Endless Lifecycle Support (ELS) for MySQL and Percona Server from TuxCare provides security fixes for versions that have reached end-of-life. This allows you to continue running your deployments without vulnerability concerns, even after official support has ended. ## Supported OS and MySQL versions | OS | Package Type | OS Version | MySQL version | | :-----------------------------------------------------: | :----------: | :--------: | :-----------: | | EL 7 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 7.x | 8.0 | | EL 8 (CentOS, CloudLinux, AlmaLinux, Oracle Linux, etc.) | RPM | 8.x | 8.0 | | EL 9 (CentOS, CloudLinux, AlmaLinux, Oracle Linux, etc.) | RPM | 9.x | 8.0 | ## Supported OS and Percona Server versions | OS | Package Type | OS Version | Percona Server version | | :-------------------------------------: | :----------: | :--------: | :--------------------: | | EL 7 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 7.x | 8.0 | **Supported architecture:** x86_64 (64-bit) ## Installation * A valid TuxCare ELS license key - contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server 1. Download the installer script ```text wget https://repo.tuxcare.com/mysql-els/install-mysql-els-repo.sh ``` 2. Run the installer script with your license key ```text sh install-mysql-els-repo.sh --license-key XXXXXXXX ``` 3. Verify the repository is enabled ```text yum info els-mysql-release ``` ## Removing the repository To remove the MySQL ELS repository: ```text sh install-mysql-els-repo.sh --delete ``` ## What's Next? * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-applications/wildfly/ ================================================================================ # WildFly® WildFly is a registered trademark of the Commonhaus Foundation.
TuxCare's Endless Lifecycle Support (ELS) for WildFly provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of WildFly. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for WildFly service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy WildFly applications. This guide outlines the steps needed for WildFly server setup and configuration. ## Supported Versions * WildFly 27.0.1.Final ## Installation * Java Development Kit (JDK) 11 or later installed (verify with `java -version`) * `JAVA_HOME` set to your JDK installation directory * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click **Sign in** in the top right corner. You may need to refresh the page after logging in. ## Linux Installation 1. **Download the TuxCare build** Download from TuxCare using your credentials. For example, WildFly 27.0.1.Final: ```text curl -u USERNAME:PASSWORD -O https://nexus.repo.tuxcare.com/repository/els_java/org/wildfly/wildfly-ee-dist/27.0.1.Final-tuxcare.1/wildfly-ee-dist-27.0.1.Final-tuxcare.1.tar.gz ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 2. **Extract the archive** Create an installation directory in your home folder and extract the archive into it: ```text mkdir -p ~/wildfly tar -xzf wildfly-ee-dist-27.0.1.Final-tuxcare.1.tar.gz -C ~/wildfly --strip-components=1 ``` 3. **Verify the installation** ```text ~/wildfly/bin/standalone.sh --version ``` The output should display the WildFly version and build details. 4. **Start WildFly** ```text ~/wildfly/bin/standalone.sh ``` This command runs in the foreground and keeps the terminal busy. Use a second terminal to verify and stop the server. 5. **Verify the server is running** * Go to [http://localhost:8080/](http://localhost:8080/). You should see the default WildFly welcome page. * Or check from the terminal (successful output is HTML from WildFly): ```text curl http://localhost:8080 ``` 6. **Stop WildFly** ```text ~/wildfly/bin/jboss-cli.sh --connect command=:shutdown ``` ## Windows Installation 1. **Download WildFly** Download the `.zip` archive from [Nexus](https://nexus.repo.tuxcare.com/repository/els_java/org/wildfly/wildfly-ee-dist/27.0.1.Final-tuxcare.1/) using your credentials, for example `wildfly-ee-dist-27.0.1.Final-tuxcare.1.zip`. 2. **Extract the archive** Extract it to the installation directory, e.g., `C:\WildFly`. The archive contains a top-level folder, so this produces `C:\WildFly\wildfly-27.0.1.Final-tuxcare.1` — that folder is your WildFly directory. 3. **Start WildFly** Run `C:\WildFly\wildfly-27.0.1.Final-tuxcare.1\bin\standalone.bat`. This window stays open while the server runs. Use your browser (next step) to verify it, and a second window to stop it. 4. **Verify the server is running** Go to [http://localhost:8080/](http://localhost:8080/) in your browser. You should see the default WildFly welcome page. 5. **Stop WildFly** Run `C:\WildFly\wildfly-27.0.1.Final-tuxcare.1\bin\jboss-cli.bat --connect command=:shutdown` from a second window. ## Use Case: Production Setup Linux 1. **Create a `wildfly` group** ```text sudo groupadd wildfly ``` 2. **Create a `wildfly` user** Create a new user as a member of the `wildfly` group, with a home directory of `/opt/wildfly` and the login shell set to `/bin/false`: ```text sudo useradd -s /bin/false -g wildfly -d /opt/wildfly wildfly ``` 3. **Install into `/opt/wildfly` and set ownership** ```text sudo mkdir -p /opt/wildfly sudo tar -xzf wildfly-ee-dist-27.0.1.Final-tuxcare.1.tar.gz -C /opt/wildfly --strip-components=1 sudo chown -R wildfly:wildfly /opt/wildfly ``` 4. **Start WildFly as the `wildfly` user** ```text sudo -u wildfly JAVA_HOME=/path/to/your/jdk /opt/wildfly/bin/standalone.sh ``` `sudo` does not pass your environment to the target user, so set `JAVA_HOME` explicitly (or configure it for the `wildfly` user). Otherwise the server fails with `java: command not found`. Stop it from a second terminal with `/opt/wildfly/bin/jboss-cli.sh --connect command=:shutdown`. ## Logs Location Check logs for detailed error information: * **Linux:** ```text ~/wildfly/standalone/log/server.log ``` (or `/opt/wildfly/standalone/log/server.log` if you installed under a dedicated user) * **Windows:** ```text C:\WildFly\wildfly-27.0.1.Final-tuxcare.1\standalone\log\server.log ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Wildfly) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Wildfly) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Wildfly) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.wildfly.core/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-applications/managing-els-repository/) — Update to newer versions ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/ ================================================================================ # Endless Lifecycle Support for Libraries ## Vulnerability Coverage and Target Response Times TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system integrates both NVD scoring and vendor scoring (when available); when the vendor's score is lower than the NVD score, we prioritize the NVD score. Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements. * **Vulnerability coverage.** TuxCare shall provide security patches for critical- and high-risk (CVSS 7.0 and above), medium-risk (CVSS 4.0 to 6.9), and low-risk (CVSS 0.1 to 3.9) vulnerabilities. TuxCare reserves the right to offer a mitigation strategy as an alternative to a direct code fix. * **Response time.** TuxCare will make commercially reasonable efforts to adhere to the following guidelines when addressing vulnerabilities: * **High- and critical-risk vulnerabilities (CVSS 7.0 and above):** Patches are provided within 14 days from the date the vulnerabilities are publicly disclosed. * **Medium-risk vulnerabilities (CVSS 4.0 to 6.9):** Patches are provided within 60 days from the date the vulnerabilities are publicly disclosed. * **Low-risk vulnerabilities (CVSS 0.1 to 3.9):** Patches are provided within 90 days from the date the vulnerabilities are publicly disclosed. ## Incident Reporting and Response Timeframe Customers can report vulnerabilities by submitting a ticket through the [TuxCare Support Portal](https://tuxcare.com/support-portal/). TuxCare commits to providing an initial response to any reported issue within 3 days. Requests for customer-directed security patches for CVEs that are outside of the ELS for Libraries scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 60 days. Handling Multiple Vulnerabilities: In cases where several CVEs are reported simultaneously for fixing, TuxCare will discuss and agree upon resolution timelines separately with the customer. ## Enhanced Transparency & Visibility TuxCare's commitment to transparency and visibility is foundational to our ELS for Libraries offering. We aim to provide comprehensive details about how each package is built, verified, and distributed, ensuring complete trust in the software supply chain. * **Software Bill of Materials (SBOM)**: Machine-readable SBOMs provide visibility into package composition and dependencies, supporting software supply chain transparency and accountability. Depending on the package, SBOMs are provided in industry-standard formats — SPDX and CycloneDX. See [Machine-Readable Security Data](./machine-readable-security-data/) for per-ecosystem links. Note: SBOM availability for certain components is still expanding and may vary by package. Contact [sales@tuxcare.com](mailto:sales@tuxcare.com) for current availability details. * **Vulnerability Exploitability eXchange (VEX)**: Machine-readable VEX documents provide contextual vulnerability information, helping teams understand which known CVEs affect specific package versions and reduce remediation noise. VEX is published in standard formats, including CycloneDX VEX. See [Machine-Readable Security Data](./machine-readable-security-data/) for per-ecosystem feeds and details. * **Verifiable Integrity and Provenance**: Our packages and metadata provide comprehensive end-to-end provenance, detailing how each package was constructed and tested, ensuring that all components in your software stack are trustworthy. Note: This feature is under consideration for future development and may be available at a later date. If you are interested, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). * **Secure Distribution**: Signed versions of the packages and their metadata are distributed from a registry managed, secured, and protected by TuxCare, guaranteeing that your software updates are authentic and untampered. ## Support Duration TuxCare provides continuous security patching for all supported end-of-life (EOL) technologies for as long as your organization requires them, eliminating the need for rushed or disruptive upgrades. All updates are delivered at a fixed price for the full term of your contract, ensuring predictable costs and uninterrupted protection. ## Technical Support TuxCare provides technical support according to the standard [support policy](https://tuxcare.com/TuxCare-support-policy.pdf). It delivers 24/7/365 access to TuxCare’s support team through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to TuxCare’s online knowledge base. * ![](/images/shield-alert.webp) [Machine-Readable Security Data](./machine-readable-security-data/) — SBOM and VEX feeds, formats, and consumption guidance * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/angular/ ================================================================================ # Angular Endless Lifecycle Support (ELS) for Angular from TuxCare provides security fixes for Angular versions that have reached their end of life. This allows you to continue running Angular applications without vulnerability concerns, even after official support has ended. ## Supported Angular Versions Angular versions from 4 to 19 are supported. ## Installation Docker compatible * **npm** version 9.6.3 or later *Check current version:* `npm --version` *Update npm:* `npm install -g npm@latest` * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_angular) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Angular project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-angular-project/ ├── src/ ├── angular.json ├── package.json ├── .npmrc ⚠️ ← Create it here └── tsconfig.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-angular:registry=https://nexus.repo.tuxcare.com/repository/els_angular/ //nexus.repo.tuxcare.com/repository/els_angular/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Manually update your `package.json` file by replacing Angular dependencies with TuxCare-maintained packages. Use "SSR ON" if your project is configured with Server-Side Rendering, otherwise use "SSR OFF". To check whether your Angular project is configured with Server-Side Rendering, look for `@angular/ssr` listed in your original `package.json` file before replacing dependencies. If you see `@angular/ssr` listed, **SSR is ON**, otherwise **SSR is OFF**. SSR ON: ``` "dependencies": { "@angular/common": "npm:@els-angular/angular-common@>=19.2.23-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=19.2.23-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=19.2.23-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=19.2.23-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=19.2.23-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=19.2.23-tuxcare.1", "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=19.2.23-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=19.2.23-tuxcare.1", "@angular/ssr": "npm:@els-angular/angular-ssr@>=19.2.25-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "19.2.23", "@angular/cli": "npm:@els-angular/angular-cli@>=19.2.25-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=19.2.23-tuxcare.1" }, "overrides": { "@angular/common": "npm:@els-angular/angular-common@>=19.2.23-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=19.2.23-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=19.2.23-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=19.2.23-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=19.2.23-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=19.2.23-tuxcare.1", "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=19.2.23-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=19.2.23-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=19.2.23-tuxcare.1", "@angular/localize": "npm:@els-angular/angular-localize@>=19.2.23-tuxcare.1", "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=19.2.23-tuxcare.1", "@angular/ssr": "npm:@els-angular/angular-ssr@>=19.2.25-tuxcare.1", "@angular/cli": "npm:@els-angular/angular-cli@>=19.2.25-tuxcare.1" } ``` SSR OFF: ``` "dependencies": { "@angular/common": "npm:@els-angular/angular-common@>=19.2.23-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=19.2.23-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=19.2.23-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=19.2.23-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=19.2.23-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=19.2.23-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=19.2.23-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "19.2.23", "@angular/cli": "npm:@els-angular/angular-cli@>=19.2.25-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=19.2.23-tuxcare.1" }, "overrides": { "@angular/common": "npm:@els-angular/angular-common@>=19.2.23-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=19.2.23-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=19.2.23-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=19.2.23-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=19.2.23-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=19.2.23-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=19.2.23-tuxcare.1", "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=19.2.23-tuxcare.1", "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=19.2.23-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=19.2.23-tuxcare.1", "@angular/cli": "npm:@els-angular/angular-cli@>=19.2.25-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/animations": "npm:@els-angular/angular-animations@>=19.2.23-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=19.2.23-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=19.2.23-tuxcare.1", * "@angular/elements": "npm:@els-angular/angular-elements@>=19.2.23-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=19.2.23-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. Use "SSR ON" if your project is configured with Server-Side Rendering, otherwise use "SSR OFF". To check whether your Angular project is configured with Server-Side Rendering, look for `@angular/ssr` listed in your original `package.json` file before replacing dependencies. If you see `@angular/ssr` listed, **SSR is ON**, otherwise **SSR is OFF**. SSR ON: ``` "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=18.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=18.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=18.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=18.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=18.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=18.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=18.2.14-tuxcare.1", "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=18.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=18.2.14-tuxcare.1", "@angular/ssr": "npm:@els-angular/angular-ssr@>=18.2.21-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "18.2.21", "@angular/cli": "npm:@els-angular/angular-cli@>=18.2.21-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=18.2.14-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=18.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=18.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=18.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=18.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=18.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=18.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=18.2.14-tuxcare.1", "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=18.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=18.2.14-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=18.2.14-tuxcare.1", "@angular/ssr": "npm:@els-angular/angular-ssr@>=18.2.21-tuxcare.1", "@angular/cli": "npm:@els-angular/angular-cli@>=18.2.21-tuxcare.1", "ajv@8.17.1": "npm:@els-angular/ajv@>=8.17.1-tuxcare.1", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "webpack@5.94.0": "npm:@els-angular/webpack@>=5.94.0-tuxcare.1" } ``` SSR OFF: ``` "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=18.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=18.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=18.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=18.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=18.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=18.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=18.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=18.2.14-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "18.2.21", "@angular/cli": "npm:@els-angular/angular-cli@>=18.2.21-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=18.2.14-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=18.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=18.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=18.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=18.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=18.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=18.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=18.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=18.2.14-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=18.2.14-tuxcare.1", "@angular/cli": "npm:@els-angular/angular-cli@>=18.2.21-tuxcare.1", "ajv@8.17.1": "npm:@els-angular/ajv@>=8.17.1-tuxcare.1", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "webpack@5.94.0": "npm:@els-angular/webpack@>=5.94.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/language-service": "npm:@els-angular/angular-language-service@>=18.2.14-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=18.2.14-tuxcare.1", * "@angular/elements": "npm:@els-angular/angular-elements@>=18.2.14-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=18.2.14-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. Use "SSR ON" if your project is configured with Server-Side Rendering, otherwise use "SSR OFF". To check whether your Angular project is configured with Server-Side Rendering, look for `@angular/ssr` listed in your original `package.json` file before replacing dependencies. If you see `@angular/ssr` listed, **SSR is ON**, otherwise **SSR is OFF**. SSR ON: ``` "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=17.3.12-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=17.3.12-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=17.3.12-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=17.3.12-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=17.3.12-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=17.3.12-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=17.3.12-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=17.3.12-tuxcare.1", "@angular/ssr": "npm:@els-angular/angular-ssr@>=17.3.17-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "17.3.12", "@angular/cli": "npm:@els-angular/angular-cli@>=17.3.17-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=17.3.12-tuxcare.1" }, "overrides": { "@angular-devkit/architect": "0.1703.17", "@angular-devkit/core": "17.3.17", "@angular-devkit/schematics": "17.3.17", "@schematics/angular": "17.3.17", "@angular/animations": "npm:@els-angular/angular-animations@>=17.3.12-tuxcare.1", "@angular/cli": "npm:@els-angular/angular-cli@>=17.3.17-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=17.3.12-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=17.3.12-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=17.3.12-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=17.3.12-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=17.3.12-tuxcare.1", "@angular/localize": "npm:@els-angular/angular-localize@>=17.3.12-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=17.3.12-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=17.3.12-tuxcare.1", "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=17.3.12-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=17.3.12-tuxcare.1", "@angular/ssr": "npm:@els-angular/angular-ssr@>=17.3.17-tuxcare.1", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "http-proxy-middleware@2.0.7": "npm:@els-angular/http-proxy-middleware@>=2.0.8-tuxcare.1", "webpack-dev-server@4.15.1": "npm:@els-angular/webpack-dev-server@>=4.15.1-tuxcare.1", "webpack@5.94.0": "npm:@els-angular/webpack@>=5.94.0-tuxcare.1" } ``` SSR OFF: ``` "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=17.3.12-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=17.3.12-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=17.3.12-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=17.3.12-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=17.3.12-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=17.3.12-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=17.3.12-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=17.3.12-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "17.3.12", "@angular/cli": "npm:@els-angular/angular-cli@>=17.3.17-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=17.3.12-tuxcare.1" }, "overrides": { "@angular-devkit/architect": "0.1703.17", "@angular-devkit/core": "17.3.17", "@angular-devkit/schematics": "17.3.17", "@schematics/angular": "17.3.17", "@angular/animations": "npm:@els-angular/angular-animations@>=17.3.12-tuxcare.1", "@angular/cli": "npm:@els-angular/angular-cli@>=17.3.17-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=17.3.12-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=17.3.12-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=17.3.12-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=17.3.12-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=17.3.12-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=17.3.12-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=17.3.12-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=17.3.12-tuxcare.1", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "http-proxy-middleware@2.0.7": "npm:@els-angular/http-proxy-middleware@>=2.0.8-tuxcare.1", "webpack-dev-server@4.15.1": "npm:@els-angular/webpack-dev-server@>=4.15.1-tuxcare.1", "webpack@5.94.0": "npm:@els-angular/webpack@>=5.94.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/animations": "npm:@els-angular/angular-animations@>=17.3.12-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=17.3.12-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=17.3.12-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=17.3.12-tuxcare.1" After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=16.2.12-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=16.2.12-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=16.2.12-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=16.2.12-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=16.2.12-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=16.2.12-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=16.2.12-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=16.2.12-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "16.2.12", "@angular/cli": "16.2.12", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=16.2.12-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=16.2.12-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=16.2.12-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=16.2.12-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=16.2.12-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=16.2.12-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=16.2.12-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=16.2.12-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=16.2.12-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=16.2.12-tuxcare.1", "@babel/runtime@7.22.6": "7.26.10", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "vite@4.5.5": "npm:@els-angular/vite@>=4.5.5-tuxcare.1", "webpack-dev-server@4.15.1": "npm:@els-angular/webpack-dev-server@>=4.15.1-tuxcare.1", "webpack@5.94.0": "npm:@els-angular/webpack@>=5.94.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/animations": "npm:@els-angular/angular-animations@>=16.2.12-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=16.2.12-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=16.2.12-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=16.2.12-tuxcare.1" After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=15.2.10-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=15.2.10-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=15.2.10-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=15.2.10-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=15.2.10-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=15.2.10-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=15.2.10-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=15.2.10-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "15.2.11", "@angular/cli": "15.2.11", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=15.2.10-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=15.2.10-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=15.2.10-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=15.2.10-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=15.2.10-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=15.2.10-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=15.2.10-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=15.2.10-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=15.2.10-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=15.2.10-tuxcare.1", "@babel/runtime@7.20.13": "7.26.10", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "webpack@5.76.1": "npm:@els-angular/webpack@>=5.76.1-tuxcare.1", "webpack-dev-server@4.11.1": "npm:@els-angular/webpack-dev-server@>=4.15.1-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=15.2.10-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=15.2.10-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=15.2.10-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=15.2.10-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=15.2.10-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=15.2.10-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=14.3.0-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=14.3.0-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=14.3.0-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=14.3.0-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=14.3.0-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=14.3.0-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=14.3.0-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=14.3.0-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "14.2.13", "@angular/cli": "14.2.13", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=14.3.0-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=14.3.0-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=14.3.0-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=14.3.0-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=14.3.0-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=14.3.0-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=14.3.0-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=14.3.0-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=14.3.0-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=14.3.0-tuxcare.1", "@babel/runtime@7.18.9": "7.26.10", "esbuild": "0.25.0", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "webpack@5.76.1": "npm:@els-angular/webpack@>=5.76.1-tuxcare.1", "webpack-dev-server@4.11.0": "npm:@els-angular/webpack-dev-server@>=4.15.1-tuxcare.1", "webpack-dev-middleware@5.3.3": "npm:@els-angular/webpack-dev-middleware@>=5.3.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=14.3.0-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=14.3.0-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=14.3.0-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=14.3.0-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=14.3.0-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=14.3.0-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=13.4.0-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=13.4.0-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=13.4.0-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=13.4.0-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=13.4.0-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=13.4.0-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=13.4.0-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=13.4.0-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "13.3.11", "@angular/cli": "13.3.11", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=13.4.0-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=13.4.0-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=13.4.0-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=13.4.0-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=13.4.0-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=13.4.0-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=13.4.0-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=13.4.0-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=13.4.0-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=13.4.0-tuxcare.1", "ip@1.1.9": "npm:@els-angular/ip@>=1.1.5-tuxcare.1", "postcss@8.4.5": "npm:@els-angular/postcss@>=8.3.6-tuxcare.1", "semver@7.3.5": "npm:@els-angular/semver@>=7.3.2-tuxcare.1", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "webpack@5.76.1": "npm:@els-angular/webpack@>=5.76.1-tuxcare.1", "webpack-dev-middleware@5.3.0": "npm:@els-angular/webpack-dev-middleware@>=5.3.0-tuxcare.1", "webpack-dev-server@4.7.3": "npm:@els-angular/webpack-dev-server@>=4.7.3-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=13.4.0-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=13.4.0-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=13.4.0-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=13.4.0-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=13.4.0-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=13.4.0-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=12.2.17-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=12.2.17-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=12.2.17-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=12.2.17-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=12.2.17-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=12.2.17-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=12.2.17-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=12.2.17-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "12.2.18", "@angular/cli": "12.2.18", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=12.2.17-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=12.2.17-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=12.2.17-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=12.2.17-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=12.2.17-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=12.2.17-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=12.2.17-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=12.2.17-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=12.2.17-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=12.2.17-tuxcare.1", "ansi-html@0.0.7": "npm:@els-angular/ansi-html@>=0.0.7-tuxcare.1", "braces@2.3.2": "npm:@els-angular/braces@>=2.3.2-tuxcare.1", "http-proxy-middleware@0.19.1": "npm:@els-angular/http-proxy-middleware@>=0.19.1-tuxcare.1", "ip@1.1.5": "npm:@els-angular/ip@>=1.1.5-tuxcare.1", "loader-utils@2.0.0": "npm:@els-angular/loader-utils@>=2.0.0-tuxcare.1", "micromatch@3.1.10": "npm:@els-angular/micromatch@>=3.1.10-tuxcare.1", "minimatch@3.0.4": "npm:@els-angular/minimatch@>=3.0.4-tuxcare.1", "node-forge@0.10.0": "npm:@els-angular/node-forge@>=0.10.0-tuxcare.1", "postcss@7.0.39": "npm:@els-angular/postcss@>=7.0.39-tuxcare.1", "postcss@8.3.6": "npm:@els-angular/postcss@>=8.3.6-tuxcare.1", "semver@7.3.5": "npm:@els-angular/semver@>=7.3.2-tuxcare.1", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "terser@5.7.1": "npm:@els-angular/terser@>=5.5.1-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.5": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "webpack@5.50.0": "npm:@els-angular/webpack@>=5.50.0-tuxcare.1", "webpack-dev-middleware@3.7.3": "npm:@els-angular/webpack-dev-middleware@>=3.7.2-tuxcare.1", "webpack-dev-middleware@5.0.0": "npm:@els-angular/webpack-dev-middleware@>=5.0.0-tuxcare.1", "webpack-dev-server@3.11.3": "npm:@els-angular/webpack-dev-server@>=3.11.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=12.2.17-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=12.2.17-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=12.2.17-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=12.2.17-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=12.2.17-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=12.2.17-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=11.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=11.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=11.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=11.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=11.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=11.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=11.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=11.2.14-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "0.1102.14", "@angular/cli": "11.2.19", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=11.2.14-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=11.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=11.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=11.2.14-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=11.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=11.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=11.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=11.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=11.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=11.2.14-tuxcare.1", "ansi-html@0.0.7": "npm:@els-angular/ansi-html@>=0.0.7-tuxcare.1", "braces@2.3.2": "npm:@els-angular/braces@>=2.3.2-tuxcare.1", "form-data@2.3.3": "@els-angular/form-data@>=2.3.3-tuxcare.1", "http-cache-semantics@4.2.0": "npm:@els-angular/http-cache-semantics@>=3.8.1-tuxcare.1", "http-proxy-middleware@0.19.1": "npm:@els-angular/http-proxy-middleware@>=0.19.1-tuxcare.1", "ip@1.1.9": "npm:@els-angular/ip@>=1.1.5-tuxcare.1", "loader-utils@2.0.0": "npm:@els-angular/loader-utils@>=2.0.0-tuxcare.1", "micromatch@3.1.10": "npm:@els-angular/micromatch@>=3.1.10-tuxcare.1", "minimatch@3.0.4": "npm:@els-angular/minimatch@>=3.0.4-tuxcare.1", "node-forge@0.10.0": "npm:@els-angular/node-forge@>=0.10.0-tuxcare.1", "request@2.88.2": "npm:@els-angular/request@>=2.88.2-tuxcare.1", "rollup@2.38.4": "npm:@els-angular/rollup@>=2.38.4-tuxcare.1", "postcss@7.0.39": "npm:@els-angular/postcss@>=7.0.39-tuxcare.1", "postcss@8.2.15": "npm:@els-angular/postcss@>=8.3.6-tuxcare.1", "semver@7.3.4": "npm:@els-angular/semver@>=7.3.2-tuxcare.1", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "terser@4.8.1": "npm:@els-angular/terser@>=4.8.1-tuxcare.1", "terser@5.5.1": "npm:@els-angular/terser@>=5.3.0-tuxcare.1", "tough-cookie@2.5.0": "npm:@els-angular/tough-cookie@>=2.5.0-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "webpack-dev-middleware@3.7.2": "npm:@els-angular/webpack-dev-middleware@>=3.7.2-tuxcare.1", "webpack-dev-server@3.11.2": "npm:@els-angular/webpack-dev-server@>=3.11.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=11.2.14-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=11.2.14-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=11.2.14-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=11.2.14-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=11.2.14-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=11.2.14-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=10.2.5-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=10.2.5-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=10.2.5-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=10.2.5-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=10.2.5-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=10.2.5-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=10.2.5-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=10.2.5-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "0.1002.4", "@angular/cli": "10.2.4", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=10.2.5-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=10.2.5-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=10.2.5-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=10.2.5-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=10.2.5-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=10.2.5-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=10.2.5-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=10.2.5-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=10.2.5-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=10.2.5-tuxcare.1", "ansi-html@0.0.7": "npm:@els-angular/ansi-html@>=0.0.7-tuxcare.1", "braces@2.3.2": "npm:@els-angular/braces@>=2.3.2-tuxcare.1", "cookie@0.4.2": "npm:@els-angular/cookie@>=0.4.2-tuxcare.1", "debug@4.1.1": "npm:@els-angular/debug@>=4.1.1-tuxcare.1", "form-data@2.3.3": "npm:@els-angular/form-data@>=2.3.3-tuxcare.1", "http-cache-semantics@3.8.1": "npm:@els-angular/http-cache-semantics@>=3.8.1-tuxcare.1", "http-proxy-middleware@0.19.1": "npm:@els-angular/http-proxy-middleware@>=0.19.1-tuxcare.1", "ip@1.1.5": "npm:@els-angular/ip@>=1.1.5-tuxcare.1", "karma@5.0.9": "npm:@els-angular/karma@>=5.0.9-tuxcare.1", "loader-utils@1.2.3": "npm:@els-angular/loader-utils@>=1.2.3-tuxcare.1", "loader-utils@2.0.0": "npm:@els-angular/loader-utils@>=2.0.0-tuxcare.1", "micromatch@3.1.10": "npm:@els-angular/micromatch@>=3.1.10-tuxcare.1", "minimatch@3.0.4": "npm:@els-angular/minimatch@>=3.0.4-tuxcare.1", "nth-check@1.0.2": "npm:@els-angular/nth-check@>=1.0.2-tuxcare.1", "node-forge@0.10.0": "npm:@els-angular/node-forge@>=0.10.0-tuxcare.1", "parseuri@0.0.6": "npm:@els-angular/parseuri@>=0.0.6-tuxcare.1", "postcss@7.0.21": "npm:@els-angular/postcss@>=7.0.39-tuxcare.1", "postcss@7.0.32": "npm:@els-angular/postcss@>=7.0.39-tuxcare.1", "request@2.88.2": "npm:@els-angular/request@>=2.88.2-tuxcare.1", "rollup@2.26.5": "npm:@els-angular/rollup@>=2.26.5-tuxcare.1", "semver@7.3.2": "npm:@els-angular/semver@>=7.3.2-tuxcare.1", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tar@4.4.19": "npm:@els-angular/tar@>=4.4.19-tuxcare.1", "terser@4.8.1": "npm:@els-angular/terser@>=4.8.1-tuxcare.1", "terser@5.3.0": "npm:@els-angular/terser@>=5.3.0-tuxcare.1", "tough-cookie@2.5.0": "npm:@els-angular/tough-cookie@>=2.5.0-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.1": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "ua-parser-js@0.7.21": "npm:@els-angular/ua-parser-js@>=0.7.21-tuxcare.1", "webpack-dev-middleware@3.7.2": "npm:@els-angular/webpack-dev-middleware@>=3.7.2-tuxcare.1", "webpack-dev-server@3.11.0": "npm:@els-angular/webpack-dev-server@>=3.11.0-tuxcare.1", "webpack-subresource-integrity@1.4.1": "npm:@els-angular/webpack-subresource-integrity@>=1.4.0-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=10.2.5-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=10.2.5-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=10.2.5-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=10.2.5-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=10.2.5-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=10.2.5-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=9.1.13-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=9.1.13-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=9.1.13-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=9.1.13-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=9.1.13-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=9.1.13-tuxcare.1", "@angular/platform-browser-dynamic": "9.1.13", "@angular/router": "npm:@els-angular/angular-router@>=9.1.13-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "~0.901.15", "@angular/cli": "9.1.15", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=9.1.13-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=9.1.13-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=9.1.13-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=9.1.13-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=9.1.13-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=9.1.13-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=9.1.13-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=9.1.13-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=9.1.13-tuxcare.1", "ansi-html@0.0.7": "npm:@els-angular/ansi-html@>=0.0.7-tuxcare.1", "braces@2.3.2": "npm:@els-angular/braces@>=2.3.2-tuxcare.1", "cookie@0.4.2": "npm:@els-angular/cookie@>=0.4.2-tuxcare.1", "debug@4.1.1": "npm:@els-angular/debug@>=4.1.1-tuxcare.1", "form-data@2.3.3": "npm:@els-angular/form-data@>=2.3.3-tuxcare.1", "http-cache-semantics@3.8.1": "npm:@els-angular/http-cache-semantics@>=3.8.1-tuxcare.1", "http-proxy-middleware@0.19.1": "npm:@els-angular/http-proxy-middleware@>=0.19.1-tuxcare.1", "ip@1.1.5": "npm:@els-angular/ip@>=1.1.5-tuxcare.1", "loader-utils@2.0.0": "npm:@els-angular/loader-utils@>=2.0.0-tuxcare.1", "karma@5.0.9": "npm:@els-angular/karma@>=5.0.9-tuxcare.1", "micromatch@3.1.10": "npm:@els-angular/micromatch@>=3.1.10-tuxcare.1", "minimatch@3.0.4": "npm:@els-angular/minimatch@>=3.0.4-tuxcare.1", "nth-check@1.0.2": "npm:@els-angular/nth-check@>=1.0.2-tuxcare.1", "node-forge@0.10.0": "npm:@els-angular/node-forge@>=0.10.0-tuxcare.1", "parseuri@0.0.6": "npm:@els-angular/parseuri@>=0.0.6-tuxcare.1", "postcss@7.0.27": "npm:@els-angular/postcss@>=7.0.39-tuxcare.1", "postcss@7.0.39": "npm:@els-angular/postcss@>=7.0.39-tuxcare.1", "request@2.88.2": "npm:@els-angular/request@>=2.88.2-tuxcare.1", "rollup@2.1.0": "npm:@els-angular/rollup@>=2.1.0-tuxcare.1", "semver@7.1.3": "npm:@els-angular/semver@>=7.1.3-tuxcare.1", "tar@6.2.1": "npm:@els-angular/tar@>=6.2.1-tuxcare.1", "tar@4.4.19": "npm:@els-angular/tar@>=4.4.19-tuxcare.1", "terser@4.6.10": "npm:@els-angular/terser@>=4.6.10-tuxcare.1", "tough-cookie@2.5.0": "npm:@els-angular/tough-cookie@>=2.5.0-tuxcare.1", "tmp@0.0.30": "npm:@els-angular/tmp@>=0.0.30-tuxcare.1", "tmp@0.0.33": "npm:@els-angular/tmp@>=0.0.33-tuxcare.1", "tmp@0.2.1": "npm:@els-angular/tmp@>=0.2.1-tuxcare.1", "ua-parser-js@0.7.21": "npm:@els-angular/ua-parser-js@>=0.7.21-tuxcare.1", "webpack-dev-middleware@3.7.2": "npm:@els-angular/webpack-dev-middleware@>=3.7.2-tuxcare.1", "webpack-dev-server@3.11.0": "npm:@els-angular/webpack-dev-server@>=3.11.0-tuxcare.1", "webpack-subresource-integrity@1.4.0": "npm:@els-angular/webpack-subresource-integrity@>=1.4.0-tuxcare.1", "xml2js@0.4.23": "npm:@els-angular/xml2js@>=0.4.23-tuxcare.1", "yargs-parser@11.1.1": "npm:@els-angular/yargs-parser@>=11.1.1-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=9.1.13-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=9.1.13-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=9.1.13-tuxcare.1", * "@angular/localize": "npm:@els-angular/angular-localize@>=9.1.13-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=9.1.13-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=9.1.13-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=8.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=8.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=8.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=8.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=8.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=8.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=8.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=8.2.14-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "~0.803.29", "@angular/cli": "8.3.29", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=8.2.14-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=8.2.14-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=8.2.14-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=8.2.14-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=8.2.14-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=8.2.14-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=8.2.14-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=8.2.14-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=8.2.14-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=8.2.14-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=8.2.14-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=8.2.14-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=8.2.14-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=8.2.14-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=8.2.14-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=7.2.16-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=7.2.16-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=7.2.16-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=7.2.16-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=7.2.16-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=7.2.16-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=7.2.16-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=7.2.16-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "~0.13.9", "@angular/cli": "7.3.10", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=7.2.16-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=7.2.16-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=7.2.16-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=7.2.16-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=7.2.16-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=7.2.16-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=7.2.16-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=7.2.16-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=7.2.16-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=7.2.16-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=7.2.16-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=7.2.16-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=7.2.16-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=7.2.16-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=7.2.16-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=6.1.10-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=6.1.10-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=6.1.10-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=6.1.10-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=6.1.10-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=6.1.10-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=6.1.10-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=6.1.10-tuxcare.1" }, "devDependencies": { "@angular-devkit/build-angular": "~0.8.9", "@angular/cli": "6.2.9", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=6.1.10-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=6.1.10-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=6.1.10-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=6.1.10-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=6.1.10-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=6.1.10-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=6.1.10-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=6.1.10-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=6.1.10-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=6.1.10-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/elements": "npm:@els-angular/angular-elements@>=6.1.10-tuxcare.1", * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=6.1.10-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=6.1.10-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=6.1.10-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=6.1.10-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=5.2.11-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=5.2.11-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=5.2.11-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=5.2.11-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=5.2.11-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=5.2.11-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=5.2.11-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=5.2.11-tuxcare.1" }, "devDependencies": { "@angular/cli": "1.7.4", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=5.2.11-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=5.2.11-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=5.2.11-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=5.2.11-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=5.2.11-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=5.2.11-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=5.2.11-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=5.2.11-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=5.2.11-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=5.2.11-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=5.2.11-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=5.2.11-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=5.2.11-tuxcare.1", * "@angular/service-worker": "npm:@els-angular/angular-service-worker@>=5.2.11-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. ```text "dependencies": { "@angular/animations": "npm:@els-angular/angular-animations@>=4.4.7-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=4.4.7-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=4.4.7-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=4.4.7-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=4.4.7-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=4.4.7-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=4.4.7-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=4.4.7-tuxcare.1" }, "devDependencies": { "@angular/cli": "1.4.10", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=4.4.7-tuxcare.1", "@angular/tsc-wrapped": "npm:@els-angular/angular-tsc-wrapped@>=4.4.7-tuxcare.1" }, "overrides": { "@angular/animations": "npm:@els-angular/angular-animations@>=4.4.7-tuxcare.1", "@angular/common": "npm:@els-angular/angular-common@>=4.4.7-tuxcare.1", "@angular/compiler": "npm:@els-angular/angular-compiler@>=4.4.7-tuxcare.1", "@angular/compiler-cli": "npm:@els-angular/angular-compiler-cli@>=4.4.7-tuxcare.1", "@angular/core": "npm:@els-angular/angular-core@>=4.4.7-tuxcare.1", "@angular/forms": "npm:@els-angular/angular-forms@>=4.4.7-tuxcare.1", "@angular/platform-browser": "npm:@els-angular/angular-platform-browser@>=4.4.7-tuxcare.1", "@angular/platform-browser-dynamic": "npm:@els-angular/angular-platform-browser-dynamic@>=4.4.7-tuxcare.1", "@angular/router": "npm:@els-angular/angular-router@>=4.4.7-tuxcare.1", "@angular/tsc-wrapped": "npm:@els-angular/angular-tsc-wrapped@>=4.4.7-tuxcare.1" } ``` If you use any of the following **non-default Angular modules**, update their versions as shown below: * "@angular/upgrade": "npm:@els-angular/angular-upgrade@>=4.4.7-tuxcare.1", * "@angular/platform-server": "npm:@els-angular/angular-platform-server@>=4.4.7-tuxcare.1", * "@angular/language-service": "npm:@els-angular/angular-language-service@>=4.4.7-tuxcare.1", After adding these aliases, make sure the same modules are also listed in the `overrides` section, just like the default ones. 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Angular repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Angular) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Angular) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Angular) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:angular) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/angularjs/ ================================================================================ # AngularJS Endless Lifecycle Support (ELS) for AngularJS from TuxCare provides security fixes for AngularJS versions that have reached their end of life. This allows you to continue running AngularJS applications without vulnerability concerns, even after official support has ended. ## Supported AngularJS Versions * AngularJS 1.4.4, 1.5.11, 1.6.10, 1.7.9, 1.8.2, 1.8.3 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_angularjs) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your AngularJS project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-angularjs-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-angularjs:registry=https://nexus.repo.tuxcare.com/repository/els_angularjs/ //nexus.repo.tuxcare.com/repository/els_angularjs/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Manually update your `package.json` file by replacing AngularJS dependencies with TuxCare-maintained packages. ```text "dependencies": { "angular": "npm:@els-angularjs/angular@>=1.4.4-tuxcare.1" }, "overrides": { "angular@1.4.4": "npm:@els-angularjs/angular@>=1.4.4-tuxcare.1" } ``` ```text "dependencies": { "angular": "npm:@els-angularjs/angular@>=1.5.11-tuxcare.1" }, "overrides": { "angular@1.5.11": "npm:@els-angularjs/angular@>=1.5.11-tuxcare.1" } ``` ```text "dependencies": { "angular": "npm:@els-angularjs/angular@>=1.6.10-tuxcare.1" }, "overrides": { "angular@1.6.10": "npm:@els-angularjs/angular@>=1.6.10-tuxcare.1" } ``` ```text "dependencies": { "angular": "npm:@els-angularjs/angular@>=1.7.9-tuxcare.1" }, "overrides": { "angular@1.7.9": "npm:@els-angularjs/angular@>=1.7.9-tuxcare.1" } ``` ```text "dependencies": { "angular": "npm:@els-angularjs/angular@>=1.8.2-tuxcare.1" }, "overrides": { "angular@1.8.2": "npm:@els-angularjs/angular@>=1.8.2-tuxcare.1" } ``` ```text "dependencies": { "angular": "npm:@els-angularjs/angular@>=1.8.3-tuxcare.1" }, "overrides": { "angular@1.8.3": "npm:@els-angularjs/angular@>=1.8.3-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for AngularJS repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Angular) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Angular) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Angular) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/angular/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:angularjs) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-commons-lang/ ================================================================================ # Apache Commons Lang TuxCare's Endless Lifecycle Support (ELS) for Apache Commons Lang provides security patches and selected bug fixes that are integral to the stable operation of applications using Commons Lang. ## Supported Versions * Apache Commons Lang 2.4, 2.6 * Apache Commons Lang3 3.4, 3.8.1, 3.10, 3.11, 3.12.0, 3.14.0, 3.17.0 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Commons Lang repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Commons Lang repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Commons Lang dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` commons-lang commons-lang 2.6-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("commons-lang:commons-lang:2.6-tuxcare.1") } ``` Maven (pom.xml): ``` org.apache.commons commons-lang3 3.4-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation 'org.apache.commons:commons-lang3:3.4-tuxcare.1' } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Commons Lang repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Commons+Lang) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Commons+Lang) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Commons+Lang) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/commons-lang/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-cxf/ ================================================================================ # Apache CXF TuxCare's Endless Lifecycle Support (ELS) for Apache CXF provides security patches and selected bug fixes that are integral to the stable operation of applications running on Apache CXF. ## Supported Versions * Apache CXF 3.5.9, 3.5.11 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache CXF repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache CXF repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache CXF dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.cxf cxf-bom 3.5.9-tuxcare.2 pom import org.apache.cxf cxf-core ``` Gradle (build.gradle): ``` plugins { id 'java' } dependencyManagement { imports { mavenBom 'org.apache.cxf:cxf-bom:3.5.9-tuxcare.2' } } dependencies { implementation "org.apache.cxf:cxf-core" } ``` Maven (pom.xml): ``` org.apache.cxf cxf-bom 3.5.11-tuxcare.1 pom import org.apache.cxf cxf-core ``` Gradle (build.gradle): ``` plugins { id 'java' } dependencyManagement { imports { mavenBom 'org.apache.cxf:cxf-bom:3.5.11-tuxcare.1' } } dependencies { implementation "org.apache.cxf:cxf-core" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache CXF repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+CXF) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+CXF) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+CXF) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.cxf/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-kafka/ ================================================================================ # Apache Kafka® Apache®, Apache Kafka®, are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Kafka® provides security patches and selected bug fixes that are integral to the stable operation of applications running on Apache Kafka®. ## Supported Versions * Apache Kafka® 3.2.3, 3.7.1 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Kafka® repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Kafka® repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Kafka® dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.kafka kafka-clients 3.2.3.tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.kafka:kafka-clients:3.2.3.tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Kafka® repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Kafka) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Kafka) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Kafka) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.kafka/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-log4j/ ================================================================================ # Apache Log4j TuxCare's Endless Lifecycle Support (ELS) for Apache Log4j provides security patches and selected bug fixes that are integral to the stable operation of applications running on Apache Log4j. ## Supported Versions * Apache Log4j 1.2.16, 1.2.17, 2.17.1, 2.22.1 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Log4j repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Log4j repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Log4j dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` log4j log4j 1.2.17.tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("log4j:log4j:1.2.17.tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Log4j repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Log4j) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Log4j) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Log4j) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/log4j/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-lucene-and-solr/ ================================================================================ # Apache Lucene® & Solr Apache®, Apache Lucene®, are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Lucene® and Apache Solr provides security patches and selected bug fixes that are integral to the stable operation of applications running on these libraries. ## Supported Versions * Apache Lucene® 5.5.5 * Apache Solr 5.5.5 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Lucene® / Apache Solr repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Lucene® or Apache Solr dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.lucene lucene-core 5.5.5-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.lucene:lucene-core:5.5.5-tuxcare.1") } ``` Maven (pom.xml): ``` org.apache.solr solr-core 5.5.5-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.solr:solr-core:5.5.5-tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Lucene® / Apache Solr repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Lucene&product=Apache+Solr) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Lucene&product=Apache+Solr) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Lucene&product=Apache+Solr) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.lucene/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-spark/ ================================================================================ # Apache Spark™ Apache®, Apache Spark™, are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Spark™ provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of Apache Spark™ core components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Apache Spark™ service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Spark™ applications. ## Supported Versions * Apache Spark™ 2.4.8 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Spark™ repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Spark™ repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Spark™ dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.spark spark-core_2.12 2.4.8-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation "org.apache.spark:spark-core_2.12:2.4.8-tuxcare.1" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Spark™ repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Spark) — Track vulnerability fixes and updates * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Spark) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.spark/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-struts/ ================================================================================ # Apache Struts™ Apache®, Apache Struts™, are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Struts™ provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of Apache Struts™ core components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Apache Struts™ service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Struts™ applications. ## Supported Versions * Apache Struts™ 1.3.5, 2.5.33 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Struts™ repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Struts™ repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Struts™ dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.struts struts-core 1.3.5-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.struts:struts-core:1.3.5-tuxcare.1") } ``` Maven (pom.xml): ``` org.apache.struts struts2-bom 2.5.33-tuxcare.1 pom import org.apache.struts struts2-core ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.struts:struts2-core:2.5.33-tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Struts™ repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Struts) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Struts) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Struts) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.struts/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-tomcat/ ================================================================================ # Apache Tomcat® Apache®, Apache Tomcat®, are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Tomcat® provides security patches and selected bug fixes that are integral to the stable operation of applications running on these versions of Apache Tomcat® core components such as Coyote, Catalina, Jasper, etc. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Apache Tomcat® service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Apache Tomcat® applications. Apache Tomcat® is also available for installation as a standalone server. You can find the corresponding instructions [here](/els-for-applications/apache-tomcat/). ## Supported Versions * Apache Tomcat® 7.0.109, 8.5.100, 9.0.46, 9.0.50, 9.0.75, 9.0.83, 9.0.87, 9.0.90, 9.0.100, 10.1.18, 10.1.42 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-tomcat-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-tomcat-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Tomcat® repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-tomcat-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Tomcat® repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Tomcat® dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.tomcat tomcat-catalina 9.0.75-tuxcare.1 org.apache.tomcat tomcat-coyote 9.0.75-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation "org.apache.tomcat:tomcat-catalina:9.0.75-tuxcare.1" implementation "org.apache.tomcat:tomcat-coyote:9.0.75-tuxcare.1" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Tomcat® repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Tomcat) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Tomcat) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Tomcat) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/apache-velocity-engine/ ================================================================================ # Apache Velocity Engine™ Apache®, Apache Velocity Engine™, are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries.
TuxCare's Endless Lifecycle Support (ELS) for Apache Velocity Engine™ provides security patches and selected bug fixes that are integral to the stable operation of applications using Apache Velocity Engine™. ## Supported Versions * Apache Velocity Engine™ 1.7 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Apache Velocity Engine™ repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Apache Velocity Engine™ repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Apache Velocity Engine™ dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.apache.velocity velocity 1.7.tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.apache.velocity:velocity:1.7.tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Apache Velocity Engine™ repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Apache+Velocity) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Apache+Velocity) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Apache+Velocity) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.apache.velocity/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/astro/ ================================================================================ # Astro Endless Lifecycle Support (ELS) for Astro from TuxCare provides security fixes for Astro versions that have reached their end of life. This allows you to continue running Astro applications without vulnerability concerns, even after official support has ended. ## Supported Astro Versions * Astro 0.26.1, 1.9.2, 2.10.15, 3.6.5, 4.16.19, 5.18.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Astro project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-astro-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Astro dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Astro dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "astro": "npm:@els-js/astro@>=0.26.1-tuxcare.1" }, "overrides": { "astro@0.26.1": "npm:@els-js/astro@>=0.26.1-tuxcare.1" } ``` ```text "dependencies": { "astro": "npm:@els-js/astro@>=1.9.2-tuxcare.1" }, "overrides": { "astro@1.9.2": "npm:@els-js/astro@>=1.9.2-tuxcare.1" } ``` ```text "dependencies": { "astro": "npm:@els-js/astro@>=2.10.15-tuxcare.1" }, "overrides": { "astro@2.10.15": "npm:@els-js/astro@>=2.10.15-tuxcare.1" } ``` ```text "dependencies": { "astro": "npm:@els-js/astro@>=3.6.5-tuxcare.1" }, "overrides": { "astro@3.6.5": "npm:@els-js/astro@>=3.6.5-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Astro version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "astro": "^2.10.15" } ``` to: ```text "dependencies": { "astro": "npm:@els-js/astro@>=2.10.15-tuxcare.1" }, "overrides": { "astro@2.10.15": "npm:@els-js/astro@>=2.10.15-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Astro repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=astro) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=astro) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/astro/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:astro) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/aws-sdk-php/ ================================================================================ # AWS SDK for PHP Endless Lifecycle Support (ELS) for AWS SDK for PHP from TuxCare provides security fixes for AWS SDK for PHP library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **AWS SDK for PHP** 3.263.4 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install AWS SDK for PHP Install the TuxCare-maintained AWS SDK for PHP release that matches your project: Composer CLI: ``` composer require aws/aws-sdk-php:3.263.4-p2+tuxcare ``` composer.json: ``` { "require": { "aws/aws-sdk-php": "3.263.4-p2+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=aws%2Faws-sdk-php) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=aws%2Faws-sdk-php) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/aws/aws-sdk-php/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/bootstrap-sass/ ================================================================================ # bootstrap-sass Endless Lifecycle Support (ELS) for bootstrap-sass from TuxCare provides security fixes for bootstrap-sass versions that have reached their end of life. This allows you to continue running bootstrap-sass applications without vulnerability concerns, even after official support has ended. ## Supported bootstrap-sass Versions * bootstrap-sass 3.4.0 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your bootstrap-sass project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-bootstrap-sass-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace bootstrap-sass dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your bootstrap-sass dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "bootstrap-sass": "npm:@els-js/bootstrap-sass@>=3.4.0-tuxcare.1" }, "overrides": { "bootstrap-sass@3.4.0": "npm:@els-js/bootstrap-sass@>=3.4.0-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the bootstrap-sass version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "bootstrap-sass": "^3.4.0" } ``` to: ```text "dependencies": { "bootstrap-sass": "npm:@els-js/bootstrap-sass@>=3.4.0-tuxcare.1" }, "overrides": { "bootstrap-sass@3.4.0": "npm:@els-js/bootstrap-sass@>=3.4.0-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for bootstrap-sass repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=bootstrap-sass) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=bootstrap-sass) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?q=bootstrap-sass) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/bootstrap-sass/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:bootstrap-sass) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/bootstrap/ ================================================================================ # Bootstrap Endless Lifecycle Support (ELS) for Bootstrap from TuxCare provides security fixes for Bootstrap versions that have reached their end of life. This allows you to continue running Bootstrap applications without vulnerability concerns, even after official support has ended. ## Supported Bootstrap Versions * Bootstrap 3.2.0, 3.3.6, 3.3.7, 3.4.1, 4.1.1, 4.1.3, 4.6.2 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Bootstrap project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-bootstrap-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Bootstrap dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Bootstrap dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "bootstrap": "npm:@els-js/bootstrap@>=3.2.0-tuxcare.1" }, "overrides": { "bootstrap@3.2.0": "npm:@els-js/bootstrap@>=3.2.0-tuxcare.1" } ``` ```text "dependencies": { "bootstrap": "npm:@els-js/bootstrap@>=3.4.1-tuxcare.1" }, "overrides": { "bootstrap@3.4.1": "npm:@els-js/bootstrap@>=3.4.1-tuxcare.1" } ``` ```text "dependencies": { "bootstrap": "npm:@els-js/bootstrap@>=4.1.1-tuxcare.1" }, "overrides": { "bootstrap@4.1.1": "npm:@els-js/bootstrap@>=4.1.1-tuxcare.1" } ``` ```text "dependencies": { "bootstrap": "npm:@els-js/bootstrap@>=4.6.2-tuxcare.1" }, "overrides": { "bootstrap@4.6.2": "npm:@els-js/bootstrap@>=4.6.2-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Bootstrap version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "bootstrap": "^4.6.2" } ``` to: ```text "dependencies": { "bootstrap": "npm:@els-js/bootstrap@>=4.6.2-tuxcare.1" }, "overrides": { "bootstrap@4.6.2": "npm:@els-js/bootstrap@>=4.6.2-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Bootstrap repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Bootstrap) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Bootstrap) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Bootstrap) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/bootstrap/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:bootstrap) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/browsershot/ ================================================================================ # Browsershot Endless Lifecycle Support (ELS) for Browsershot from TuxCare provides security fixes for Browsershot package versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **Browsershot** 3.61.0, 4.4.0 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Browsershot Install the TuxCare-maintained Browsershot release that matches your project: Composer CLI: ``` composer require spatie/browsershot:3.61.0-p2+tuxcare ``` composer.json: ``` { "require": { "spatie/browsershot": "3.61.0-p2+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=spatie%2Fbrowsershot) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=spatie%2Fbrowsershot) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/spatie/browsershot/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/cakephp/ ================================================================================ # CakePHP Endless Lifecycle Support (ELS) for CakePHP from TuxCare provides security fixes for CakePHP framework versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **CakePHP** 2.10.24 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install CakePHP Install the TuxCare-maintained CakePHP release that matches your project: Composer CLI: ``` composer require cakephp/cakephp:2.10.24-p1+tuxcare ``` composer.json: ``` { "require": { "cakephp/cakephp": "2.10.24-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=cakephp%2Fcakephp) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=cakephp%2Fcakephp) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/cakephp/cakephp/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/carbon/ ================================================================================ # Carbon Endless Lifecycle Support (ELS) for Carbon from TuxCare provides security fixes for Carbon library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Carbon** 1.26.6, 1.39.1 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Carbon Install the TuxCare-maintained Carbon release that matches your project: Composer CLI: ``` composer require nesbot/carbon:1.26.6-p1+tuxcare ``` composer.json: ``` { "require": { "nesbot/carbon": "1.26.6-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=nesbot%2Fcarbon) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=nesbot%2Fcarbon) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/nesbot/carbon/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/celery/ ================================================================================ # Celery Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for Celery. This allows you to continue running your Celery applications without vulnerability concerns, even after official support has ended. ## Supported Celery Versions * **Celery** 4.4.7, 5.1.2 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade \ -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple \ celery ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade celery ``` Or install a specific patched TuxCare version, for example: ```text pip install celery==5.1.2.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install celery==5.1.2.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Celery) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Celery) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Celery) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/celery/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:celery) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/craftcms-feed-me/ ================================================================================ # CraftCMS Feed Me Plugin Endless Lifecycle Support (ELS) for the CraftCMS Feed Me plugin from TuxCare provides security fixes for versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **CraftCMS Feed Me Plugin** 3.x Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install CraftCMS Feed Me Install the TuxCare-maintained CraftCMS Feed Me release that matches your project: Composer CLI: ``` composer require craftcms/feed-me:3.1.17-p1+tuxcare ``` composer.json: ``` { "require": { "craftcms/feed-me": "3.1.17-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=craftcms%2Ffeed-me) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=craftcms%2Ffeed-me) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/craftcms/feed-me/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/craftcms/ ================================================================================ # CraftCMS Endless Lifecycle Support (ELS) for CraftCMS from TuxCare provides security fixes for versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **CraftCMS** 3.x Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install CraftCMS Install the TuxCare-maintained CraftCMS release that matches your project: Composer CLI: ``` composer require craftcms/cms:3.9.15-p4+tuxcare ``` composer.json: ``` { "require": { "craftcms/cms": "3.9.15-p4+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=craftcms%2Fcms) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=craftcms%2Fcms) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/craftcms/cms/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/django/ ================================================================================ # Django Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for Django. This allows you to continue running your Django applications without vulnerability concerns, even after official support has ended. ## Supported Django Versions * **Django** 3.2.25, 4.0, 4.2, 5.0, 5.0.1, 5.0.2, 5.1, 5.1.4, 5.1.9 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple django ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade django ``` Or install a specific patched TuxCare version, for example: ```text pip install django==3.2.25.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install django==3.2.25.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Django) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Django) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Django) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/django/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:django) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/doctrine-orm/ ================================================================================ # Doctrine ORM Endless Lifecycle Support (ELS) for Doctrine ORM from TuxCare provides security fixes for Doctrine ORM versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Doctrine ORM** 2.8.3 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Doctrine ORM Install the TuxCare-maintained Doctrine ORM release that matches your project: Composer CLI: ``` composer require doctrine/orm:2.8.3-p1+tuxcare ``` composer.json: ``` { "require": { "doctrine/orm": "2.8.3-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=doctrine%2Form) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=doctrine%2Form) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/doctrine/orm/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/dompdf/ ================================================================================ # Dompdf Endless Lifecycle Support (ELS) for Dompdf from TuxCare provides security fixes for Dompdf versions that have reached their end-of-life. This allows you to continue running your Dompdf applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Dompdf** 0.8.6, 1.2.2, 3.1.0 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Dompdf Install the TuxCare-maintained Dompdf release that matches your project: Composer CLI: ``` composer require dompdf/dompdf:1.2.2-p1+tuxcare ``` composer.json: ``` { "require": { "dompdf/dompdf": "1.2.2-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=dompdf%2Fdompdf) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=dompdf%2Fdompdf) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/dompdf/dompdf/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/dotnet/ ================================================================================ # .NET Endless Lifecycle Support (ELS) for .NET from TuxCare delivers security fixes for .NET library, framework, and tool packages, distributed through NuGet packages. This allows you to continue running your .NET applications without vulnerability concerns, even after official support has ended. NuGet is the standard package manager for .NET, used to deliver the reusable components that applications depend on. ELS applies fixes at the package level, so your applications receive security updates without requiring changes to your own code. ## Supported NuGet packages * .NET 6, 8, 10 * AutoMapper 2.2.2, 3.3.2, 4.2.2, 5.2.1, 6.2.3, 7.0.2, 8.1.2, 9.0.1, 10.1.2, 11.0.2, 12.0.2, 13.0.2, 14.0.1 * jose-jwt 2.6.2 * log4net 1.2.15, 1.2.16 * Microsoft.Azure.Storage.DataMovement 1.2.0, 1.2.1 * Microsoft.Data.SqlClient 1.1.4, 1.1.5 * Microsoft.Owin 3.1.0, 3.1.1 * MimeKit 3.6.1, 3.6.2 * Newtonsoft.Json 4.5.11, 4.5.12, 6.0.8, 6.0.9, 8.0.3, 8.0.4, 9.0.1, 9.0.2, 10.0.3, 10.0.4, 11.0.2, 11.0.3, 12.0.3, 12.0.4, 13.0.5 * NHibernate 4.1.2.4001 * Refit 6.3.2, 6.3.3 * RestSharp 108.0.3, 108.0.4, 110.2.0, 110.2.1, 111.4.1, 111.4.2 * SharpZipLib 0.86.0, 0.86.1 * SixLabors.ImageSharp 1.0.5 * System.Formats.Asn1 5.0.1, 7.0.1 * System.Text.Json 7.0.5 Other versions upon request. ## Installation * .NET SDK installed — TuxCare also provides a supported [.NET SDK build](/els-for-runtimes/dotnet/) * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com). Anonymous access is disabled. * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/) and sign in. You may need to refresh the page after logging in. 1. Locate your project Ensure you are in a directory that contains a valid .NET project — the folder must include a `.csproj` file: ```text dir *.csproj ``` If a `.csproj` file is not found, create a new project: ```text dotnet new console -o MyProject cd MyProject ``` 2. Register the TuxCare NuGet repository Add the `els_dotnet` NuGet source either with the `dotnet` CLI or by editing `nuget.config`. Replace `` with your customer repository name provided by TuxCare. dotnet CLI: ``` dotnet nuget add source "https://nexus.repo.tuxcare.com/repository//index.json" --name TuxCare ``` nuget.config: ``` ``` 3. Add your TuxCare credentials Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). dotnet CLI: ``` dotnet nuget update source TuxCare --username USERNAME --password PASSWORD ``` nuget.config: ``` ``` Avoid committing credentials to version control. Consider using environment variables or a separate local configuration file for sensitive information. When using the CLI, the password is stored as a hash. When editing `nuget.config` manually, the password is stored in plain text — use `` only when a hashed password isn't practical. 4. Verify the source To verify that the source was added successfully, list all configured NuGet sources: ```text dotnet nuget list source ``` 5. Install the patched package Install the TuxCare-maintained release that matches your project: ```text dotnet add package --version ``` For example: ```text dotnet add package Newtonsoft.Json --version 12.0.4-tuxcare.1 ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `nuget.config` manually, run `dotnet restore` in your project directory to install packages and resolve dependencies against the TuxCare repository: ```text dotnet restore ``` ## Resolved CVEs | CVE ID | Severity | Affected Package | Affected Versions | Safe Versions | | :----: | :------: | :--------------: | :---------------: | :-----------: | | CVE-2026-32933 | High | AutoMapper | < 15.1.1; 16.0.0 ≤ v < 16.1.1 | See Nexus | | CVE-2018-1285 | Critical | log4net | < 2.0.10 | See Nexus | | CVE-2024-35252 | High | Microsoft.Azure.Storage.DataMovement | < 2.0.0 | See Nexus | | CVE-2024-0056 | High | Microsoft.Data.SqlClient | < 2.1.7 | See Nexus | | CVE-2020-1045 | High | Microsoft.Owin | ASP.NET Core 2.1 ≤ v ≤ 2.1.21; 3.1 ≤ v < 3.1.8 | See Nexus | | CVE-2022-29117 | High | Microsoft.Owin | .NET 5.0, 6.0.0; .NET Core 3.1 (specific releases) | See Nexus | | CVE-2024-38095 | High | MimeKit | >= 3.0.0, < 4.7.1 | See Nexus | | GHSA-gmc6-fwg3-75m5 | High | MimeKit | >= 3.0.0, < 4.7.1 | See Nexus | | CVE-2024-39677 | Medium | NHibernate | < 5.4.9 | See Nexus | | CVE-2024-21907 | High | Newtonsoft.Json | < 13.0.1 | See Nexus | | GHSA-5crp-9r3c-p9vr | High | Newtonsoft.Json | < 13.0.1 | See Nexus | | CVE-2024-51501 | Critical | Refit | < 7.2.22 | See Nexus | | CVE-2024-45302 | High | RestSharp | >= 107.0.0, < 112.0.0 | See Nexus | | GHSA-4rr6-2v9v-wcpc | Medium | RestSharp | >= 107.0.0-preview.1, < 112.0.0 | See Nexus | | CVE-2021-32840 | Critical | SharpZipLib | < 1.3.3 | See Nexus | | CVE-2021-32841 | Medium | SharpZipLib | >= 1.3.0, < 1.3.3 | See Nexus | | CVE-2021-32842 | Medium | SharpZipLib | >= 1.0.0, < 1.3.3 | See Nexus | | CVE-2024-27929 | High | SixLabors.ImageSharp | < 2.1.7; 3.1.0 ≤ v < 3.1.3 | See Nexus | | CVE-2025-27598 | High | SixLabors.ImageSharp | < 2.1.10; 3.0.0 ≤ v < 3.1.7 | See Nexus | | CVE-2025-54575 | Medium | SixLabors.ImageSharp | < 2.1.11; 3.0.0 ≤ v < 3.1.11 | See Nexus | | CVE-2024-38095 | High | System.Formats.Asn1 | 5.0.0-pre ≤ v < 6.0.1; 7.0.0-pre ≤ v < 8.0.1 | See Nexus | | CVE-2024-30105 | High | System.Text.Json | 7.0.0 ≤ v < 8.0.4 | See Nexus | ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=.NET) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=.NET) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=.NET) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_dotnet/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Managing NuGet sources](/els-for-libraries/managing-els-repository/#dotnetSources) — Add, update, and remove the TuxCare source * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#dotnet) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/drupal/ ================================================================================ # Drupal Endless Lifecycle Support (ELS) for Drupal from TuxCare provides security fixes for Drupal core versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **drupal/core** 9.5.x Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Drupal core Install the TuxCare-maintained Drupal core release that matches your project: Composer CLI: ``` composer require drupal/core:9.5.11-p1+tuxcare ``` composer.json: ``` { "require": { "drupal/core": "9.5.11-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## Customer Instructions ### For legacy-project customers No special steps are needed. The `^9.5` range matches `9.5.11-p1+tuxcare` directly: ``` { "repositories": [ {"type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/"}, {"type": "composer", "url": "https://packages.drupal.org/8"} ] } ``` Then run: ```text composer update drupal/core --with-all-dependencies ``` ### For recommended-project customers (needs an alias) Because `drupal/core-recommended:9.5.11` requires exactly `drupal/core:9.5.11`, customers need a Composer inline alias to tell Composer that `9.5.11-p1+tuxcare` should be treated as `9.5.11`: ``` { "repositories": [ {"type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/"}, {"type": "composer", "url": "https://packages.drupal.org/8"} ], "require": { "drupal/core": "9.5.11-p1+tuxcare as 9.5.11", "drupal/core-recommended": "^9.5" } } ``` Then run: ```text composer update "drupal/core-*" drupal/core --with-all-dependencies ``` The `"9.5.11-p1+tuxcare as 9.5.11"` alias is the key — it tells Composer to install the Satis version but pretend it's `9.5.11` for dependency resolution, satisfying `core-recommended`'s exact version constraint. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=drupal%2Fcore) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=drupal%2Fcore) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/drupal/core/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/duration-of-support/ ================================================================================ ## Supported Projects and Duration of Support TuxCare provides Endless Lifecycle Support (ELS) for the Spring project after it has reached End of Life (EOL) or no longer receives standard support. | Project | End of OSS Support | | ---------------------- | ----------------------------- | | Spring Framework 5.3 | 31 Aug 2024 | | Spring Boot 2.7 | 24 Nov 2023 | | Spring Security 5.8 | 31 Aug 2024 | | Spring Data 2.7 | 18 Nov 2023 | | Spring Integration 5.5 | 21 Nov 2023 | | Spring Batch 4.3 | 22 Nov 2024 | Support for additional libraries can be provided on request. ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/elasticsearch/ ================================================================================ # Elasticsearch TuxCare's Endless Lifecycle Support (ELS) for Elasticsearch provides security patches and selected bug fixes that are integral to the stable operation of applications running on the Elasticsearch Java client libraries. ## Supported Versions * Elasticsearch 7.16.3 Other versions upon request. ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Elasticsearch repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Elasticsearch repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Elasticsearch dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.elasticsearch.client elasticsearch-rest-high-level-client 7.16.3-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.elasticsearch.client:elasticsearch-rest-high-level-client:7.16.3-tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Elasticsearch repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Elasticsearch) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Elasticsearch) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Elasticsearch) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.elasticsearch/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/ember/ ================================================================================ # Ember.js Endless Lifecycle Support (ELS) for Ember.js from TuxCare provides security fixes for Ember.js versions that have reached their end of life. This allows you to continue running Ember.js applications without vulnerability concerns, even after official support has ended. ## Supported Ember.js Versions * Ember.js 0.2.7, 1.13.11, 2.18.2, 3.28.6, 4.12.13 ## Installation Docker compatible TuxCare publishes patched **transitive** dependencies for supported Ember.js versions as NPM packages on a secure internal registry. Choose your Ember.js version below for the exact package list and `overrides`. * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Ember.js project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-ember-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` so the transitive versions for your Ember.js version resolve to TuxCare packages. You can do this in two ways: ```text "dependencies": { "body-parser": "npm:@els-js/body-parser@>=1.8.4-tuxcare.1", "chownr": "npm:@els-js/chownr@>=0.0.2-tuxcare.1", "clean-css": "npm:@els-js/clean-css@>=2.2.23-tuxcare.1", "concat-stream": "npm:@els-js/concat-stream@>=1.4.8-tuxcare.1", "cross-spawn": "npm:@els-js/cross-spawn@>=0.2.9-tuxcare.1", "decompress-zip": "npm:@els-js/decompress-zip@>=0.1.0-tuxcare.1", "deep-extend": "npm:@els-js/deep-extend@>=0.2.11-tuxcare.1", "es5-ext": "npm:@els-js/es5-ext@>=0.10.7-tuxcare.1", "forwarded": "npm:@els-js/forwarded@>=0.1.0-tuxcare.1", "fresh": "npm:@els-js/fresh@>=0.2.4-tuxcare.1", "got": "npm:@els-js/got@>=2.9.2-tuxcare.1", "hoek": "npm:@els-js/hoek@>=2.14.0-tuxcare.1", "ini": "npm:@els-js/ini@>=1.3.3-tuxcare.1", "is-my-json-valid": "npm:@els-js/is-my-json-valid@>=2.10.1-tuxcare.1", "js-yaml": "npm:@els-js/js-yaml@>=3.3.1-tuxcare.1", "json5": "npm:@els-js/json5@>=0.5.1-tuxcare.1", "jsonpointer": "npm:@els-js/jsonpointer@>=1.1.0-tuxcare.1", "markdown-it": "npm:@els-js/markdown-it@>=4.0.3-tuxcare.1", "merge": "npm:@els-js/merge@>=1.2.1-tuxcare.1", "morgan": "npm:@els-js/morgan@>=1.5.3-tuxcare.1", "mout": "npm:@els-js/mout@>=0.11.0-tuxcare.1", "parsejson": "npm:@els-js/parsejson@>=0.0.3-tuxcare.1", "path-to-regexp": "npm:@els-js/path-to-regexp@>=0.1.3-tuxcare.1", "qs": "npm:@els-js/qs@>=2.4.2-tuxcare.1", "semver": "npm:@els-js/semver@>=2.3.2-tuxcare.1", "shell-quote": "npm:@els-js/shell-quote@>=1.4.3-tuxcare.1", "stringstream": "npm:@els-js/stringstream@>=0.0.4-tuxcare.1", "tar": "npm:@els-js/tar@>=2.1.1-tuxcare.1", "tar-fs": "npm:@els-js/tar-fs@>=1.5.1-tuxcare.1", "tough-cookie": "npm:@els-js/tough-cookie@>=1.2.0-tuxcare.1", "tunnel-agent": "npm:@els-js/tunnel-agent@>=0.4.0-tuxcare.1", "uglify-js": "npm:@els-js/uglify-js@>=1.1.1-tuxcare.1", "websocket-extensions": "npm:@els-js/websocket-extensions@>=0.1.1-tuxcare.1", "xmldom": "npm:@els-js/xmldom@>=0.1.31-tuxcare.1" }, "overrides": { "body-parser@1.8.4": "npm:@els-js/body-parser@>=1.8.4-tuxcare.1", "chownr@0.0.2": "npm:@els-js/chownr@>=0.0.2-tuxcare.1", "clean-css@2.2.23": "npm:@els-js/clean-css@>=2.2.23-tuxcare.1", "concat-stream@1.4.8": "npm:@els-js/concat-stream@>=1.4.8-tuxcare.1", "cross-spawn@0.2.9": "npm:@els-js/cross-spawn@>=0.2.9-tuxcare.1", "decompress-zip@0.1.0": "npm:@els-js/decompress-zip@>=0.1.0-tuxcare.1", "deep-extend@0.2.11": "npm:@els-js/deep-extend@>=0.2.11-tuxcare.1", "es5-ext@0.10.7": "npm:@els-js/es5-ext@>=0.10.7-tuxcare.1", "forwarded@0.1.0": "npm:@els-js/forwarded@>=0.1.0-tuxcare.1", "fresh@0.2.4": "npm:@els-js/fresh@>=0.2.4-tuxcare.1", "got@2.9.2": "npm:@els-js/got@>=2.9.2-tuxcare.1", "hoek@2.12.0": "npm:@els-js/hoek@>=2.12.0-tuxcare.1", "hoek@2.14.0": "npm:@els-js/hoek@>=2.14.0-tuxcare.1", "ini@1.3.3": "npm:@els-js/ini@>=1.3.3-tuxcare.1", "is-my-json-valid@2.10.1": "npm:@els-js/is-my-json-valid@>=2.10.1-tuxcare.1", "js-yaml@3.3.1": "npm:@els-js/js-yaml@>=3.3.1-tuxcare.1", "json5@0.5.1": "npm:@els-js/json5@>=0.5.1-tuxcare.1", "jsonpointer@1.1.0": "npm:@els-js/jsonpointer@>=1.1.0-tuxcare.1", "markdown-it@4.0.3": "npm:@els-js/markdown-it@>=4.0.3-tuxcare.1", "merge@1.2.1": "npm:@els-js/merge@>=1.2.1-tuxcare.1", "morgan@1.5.3": "npm:@els-js/morgan@>=1.5.3-tuxcare.1", "mout@0.11.0": "npm:@els-js/mout@>=0.11.0-tuxcare.1", "parsejson@0.0.3": "npm:@els-js/parsejson@>=0.0.3-tuxcare.1", "path-to-regexp@0.1.3": "npm:@els-js/path-to-regexp@>=0.1.3-tuxcare.1", "qs@2.2.5": "npm:@els-js/qs@>=2.2.5-tuxcare.1", "qs@2.4.2": "npm:@els-js/qs@>=2.4.2-tuxcare.1", "semver@2.3.2": "npm:@els-js/semver@>=2.3.2-tuxcare.1", "shell-quote@1.4.3": "npm:@els-js/shell-quote@>=1.4.3-tuxcare.1", "stringstream@0.0.4": "npm:@els-js/stringstream@>=0.0.4-tuxcare.1", "tar@2.1.1": "npm:@els-js/tar@>=2.1.1-tuxcare.1", "tar-fs@1.5.1": "npm:@els-js/tar-fs@>=1.5.1-tuxcare.1", "tough-cookie@1.2.0": "npm:@els-js/tough-cookie@>=1.2.0-tuxcare.1", "tunnel-agent@0.4.0": "npm:@els-js/tunnel-agent@>=0.4.0-tuxcare.1", "uglify-js@1.1.1": "npm:@els-js/uglify-js@>=1.1.1-tuxcare.1", "websocket-extensions@0.1.1": "npm:@els-js/websocket-extensions@>=0.1.1-tuxcare.1", "xmldom@0.1.31": "npm:@els-js/xmldom@>=0.1.31-tuxcare.1" } ``` * **Option 1: Manual update** ```text "dependencies": { "ember-cli": "npm:@els-js/ember-cli@>=1.13.11-tuxcare.1" }, "overrides": { "ember-cli@1.13.11": "npm:@els-js/ember-cli@>=1.13.11-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "ember-cli": "1.13.11" } ``` to: ```text "dependencies": { "ember-cli": "npm:@els-js/ember-cli@>=1.13.11-tuxcare.1" }, "overrides": { "ember-cli@1.13.11": "npm:@els-js/ember-cli@>=1.13.11-tuxcare.1" } ``` * **Option 1: Manual update** ```text "dependencies": { "terser": "npm:@els-js/terser@>=3.17.0-tuxcare.1", "rollup": "npm:@els-js/rollup@>=0.41.6-tuxcare.1", "printf": "npm:@els-js/printf@>=0.5.3-tuxcare.1", "markdown-it": "npm:@els-js/markdown-it@>=8.4.2-tuxcare.1", "clean-css": "npm:@els-js/clean-css@>=3.4.28-tuxcare.1" }, "overrides": { "terser@3.17.0": "npm:@els-js/terser@>=3.17.0-tuxcare.1", "rollup@0.41.6": "npm:@els-js/rollup@>=0.41.6-tuxcare.1", "printf@0.5.3": "npm:@els-js/printf@>=0.5.3-tuxcare.1", "markdown-it@8.4.2": "npm:@els-js/markdown-it@>=8.4.2-tuxcare.1", "clean-css@3.4.28": "npm:@els-js/clean-css@>=3.4.28-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "terser": "3.17.0", "rollup": "0.41.6", "printf": "0.5.3", "markdown-it": "8.4.2", "clean-css": "3.4.28" } ``` to: ```text "dependencies": { "terser": "npm:@els-js/terser@>=3.17.0-tuxcare.1", "rollup": "npm:@els-js/rollup@>=0.41.6-tuxcare.1", "printf": "npm:@els-js/printf@>=0.5.3-tuxcare.1", "markdown-it": "npm:@els-js/markdown-it@>=8.4.2-tuxcare.1", "clean-css": "npm:@els-js/clean-css@>=3.4.28-tuxcare.1" }, "overrides": { "terser@3.17.0": "npm:@els-js/terser@>=3.17.0-tuxcare.1", "rollup@0.41.6": "npm:@els-js/rollup@>=0.41.6-tuxcare.1", "printf@0.5.3": "npm:@els-js/printf@>=0.5.3-tuxcare.1", "markdown-it@8.4.2": "npm:@els-js/markdown-it@>=8.4.2-tuxcare.1", "clean-css@3.4.28": "npm:@els-js/clean-css@>=3.4.28-tuxcare.1" } ``` * **Option 1: Manual update** ```text "dependencies": { "rollup": "npm:@els-js/rollup@>=0.57.1-tuxcare.1", "markdown-it": "npm:@els-js/markdown-it@>=13.0.2-tuxcare.1", "diff": "npm:@els-js/diff@>=7.0.0-tuxcare.1" }, "overrides": { "rollup@0.57.1": "npm:@els-js/rollup@>=0.57.1-tuxcare.1", "markdown-it@13.0.2": "npm:@els-js/markdown-it@>=13.0.2-tuxcare.1", "diff@7.0.0": "npm:@els-js/diff@>=7.0.0-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher updates your `package.json` so these library versions use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "rollup": "0.57.1", "markdown-it": "13.0.2", "diff": "7.0.0" } ``` to: ```text "dependencies": { "rollup": "npm:@els-js/rollup@>=0.57.1-tuxcare.1", "markdown-it": "npm:@els-js/markdown-it@>=13.0.2-tuxcare.1", "diff": "npm:@els-js/diff@>=7.0.0-tuxcare.1" }, "overrides": { "rollup@0.57.1": "npm:@els-js/rollup@>=0.57.1-tuxcare.1", "markdown-it@13.0.2": "npm:@els-js/markdown-it@>=13.0.2-tuxcare.1", "diff@7.0.0": "npm:@els-js/diff@>=7.0.0-tuxcare.1" } ``` * **Option 1: Manual update** ```text "dependencies": { "@babel/runtime": "npm:@els-js/babel-runtime@>=7.12.18-tuxcare.1", "tmp": "npm:@els-js/tmp@>=0.0.28-tuxcare.1" }, "overrides": { "@babel/runtime@7.12.18": "npm:@els-js/babel-runtime@>=7.12.18-tuxcare.1", "tmp@0.0.28": "npm:@els-js/tmp@>=0.0.28-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "@babel/runtime": "7.12.18", "tmp": "0.0.28" } ``` to: ```text "dependencies": { "@babel/runtime": "npm:@els-js/babel-runtime@>=7.12.18-tuxcare.1", "tmp": "npm:@els-js/tmp@>=0.0.28-tuxcare.1" }, "overrides": { "@babel/runtime@7.12.18": "npm:@els-js/babel-runtime@>=7.12.18-tuxcare.1", "tmp@0.0.28": "npm:@els-js/tmp@>=0.0.28-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS registry. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/express/ ================================================================================ # express Endless Lifecycle Support (ELS) for express from TuxCare provides security fixes for express versions that have reached their end of life. This allows you to continue running express applications without vulnerability concerns, even after official support has ended. ## Supported express Versions * express 3.4.8, 3.21.2, 4.17.1, 4.18.1, 4.18.2, 4.18.3, 4.19.2 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your express project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-express-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace express dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your express dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "express": "npm:@els-js/express@>=3.21.2-tuxcare.1" }, "overrides": { "express@3.21.2": "npm:@els-js/express@>=3.21.2-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the express version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "express": "^3.21.2" } ``` to: ```text "dependencies": { "express": "npm:@els-js/express@>=3.21.2-tuxcare.1" }, "overrides": { "express@3.21.2": "npm:@els-js/express@>=3.21.2-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for express repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=express) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=express) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Express) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/express/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:express) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/fastapi/ ================================================================================ # FastAPI Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for FastAPI. This allows you to continue running your FastAPI applications without vulnerability concerns, even after official support has ended. ## Supported FastAPI Versions * **FastAPI** 0.63.0, 0.104.1 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple fastapi ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade fastapi ``` Or install a specific patched TuxCare version, for example: ```text pip install fastapi==0.63.0.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install fastapi==0.63.0.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=FastAPI) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=FastAPI) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=FastAPI) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/fastapi/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:fastapi) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/fastify/ ================================================================================ # fastify Endless Lifecycle Support (ELS) for fastify from TuxCare provides security fixes for fastify versions that have reached their end of life. This allows you to continue running fastify applications without vulnerability concerns, even after official support has ended. ## Supported fastify Versions * fastify 3.29.5, 4.29.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your fastify project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-fastify-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace fastify dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your fastify dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "fastify": "npm:@els-js/fastify@>=3.29.5-tuxcare.1" }, "overrides": { "fastify@3.29.5": "npm:@els-js/fastify@>=3.29.5-tuxcare.1" } ``` ```text "dependencies": { "fastify": "npm:@els-js/fastify@>=4.29.1-tuxcare.1" }, "overrides": { "fastify@4.29.1": "npm:@els-js/fastify@>=4.29.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the fastify version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "fastify": "^3.29.5" } ``` to: ```text "dependencies": { "fastify": "npm:@els-js/fastify@>=3.29.5-tuxcare.1" }, "overrides": { "fastify@3.29.5": "npm:@els-js/fastify@>=3.29.5-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for fastify repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=fastify) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=fastify) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Fastify) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/fastify/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:fastify) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/firebase-php-jwt/ ================================================================================ # Firebase PHP-JWT Endless Lifecycle Support (ELS) for Firebase PHP-JWT from TuxCare provides security fixes for Firebase PHP-JWT library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Firebase PHP-JWT** 6.11.1 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Firebase PHP-JWT Install the TuxCare-maintained Firebase PHP-JWT release that matches your project: Composer CLI: ``` composer require firebase/php-jwt:6.11.1-p2+tuxcare ``` composer.json: ``` { "require": { "firebase/php-jwt": "6.11.1-p2+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=firebase%2Fphp-jwt) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=firebase%2Fphp-jwt) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/firebase/php-jwt/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/flask/ ================================================================================ # Flask Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for Flask. This allows you to continue running your Flask applications without vulnerability concerns, even after official support has ended. ## Supported Flask Versions * **Flask** 0.12.5, 1.1.2, 1.1.4, 2.2.1 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple flask ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade flask ``` Or install a specific patched TuxCare version, for example: ```text pip install flask==0.12.5.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install flask==0.12.5.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Flask) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Flask) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Flask) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/flask/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:flask) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/google-protobuf/ ================================================================================ # Protobuf Endless Lifecycle Support (ELS) for Protobuf from TuxCare provides security fixes for Protobuf library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Protobuf** 3.24.4 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Protobuf Install the TuxCare-maintained Protobuf release that matches your project: Composer CLI: ``` composer require google/protobuf:3.24.4-p1+tuxcare ``` composer.json: ``` { "require": { "google/protobuf": "3.24.4-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=google%2Fprotobuf) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=google%2Fprotobuf) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/google/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/guzzle/ ================================================================================ # Guzzle Endless Lifecycle Support (ELS) for Guzzle from TuxCare provides security fixes for Guzzle HTTP client library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Guzzle** 6.0.2, 6.3.3, 6.5.8, 7.10.0 * **Guzzle PSR-7** 1.4.2, 1.9.1 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Guzzle Install the TuxCare-maintained Guzzle release that matches your project: Composer CLI: ``` composer require guzzlehttp/guzzle:6.3.3-p1+tuxcare ``` composer.json: ``` { "require": { "guzzlehttp/guzzle": "6.3.3-p1+tuxcare" } } ``` Composer CLI: ``` composer require guzzlehttp/guzzle:6.0.2-p1+tuxcare ``` composer.json: ``` { "require": { "guzzlehttp/guzzle": "6.0.2-p1+tuxcare" } } ``` Composer CLI: ``` composer require guzzlehttp/guzzle:6.5.8-p1+tuxcare ``` composer.json: ``` { "require": { "guzzlehttp/guzzle": "6.5.8-p1+tuxcare" } } ``` Composer CLI: ``` composer require guzzlehttp/guzzle:7.10.0-p1+tuxcare ``` composer.json: ``` { "require": { "guzzlehttp/guzzle": "7.10.0-p1+tuxcare" } } ``` Composer CLI: ``` composer require guzzlehttp/psr7:1.9.1-p1+tuxcare ``` composer.json: ``` { "require": { "guzzlehttp/psr7": "1.9.1-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=guzzlehttp%2Fguzzle) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=guzzlehttp%2Fguzzle) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/guzzlehttp/guzzle/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/hibernate/ ================================================================================ # Hibernate TuxCare's Endless Lifecycle Support (ELS) for Hibernate provides security patches and selected bug fixes that are integral to the stable operation of applications running on Hibernate. ## Supported Versions * Hibernate ORM 4.3.11.Final, 5.4.3.Final, 5.4.30.Final, 5.4.31.Final, 5.4.32.Final, 5.4.33.Final, 5.5.6.Final, 5.5.9.Final, 5.6.15.Final, 6.2.5.Final * Hibernate Search 5.11.10.Final ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Hibernate repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Hibernate repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Hibernate dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.hibernate hibernate-core 5.6.15.Final-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.hibernate:hibernate-core:5.6.15.Final-tuxcare.1") } ``` Maven (pom.xml): ``` org.hibernate hibernate-search-parent 5.11.10.Final-tuxcare.1 org.hibernate hibernate-core ``` Gradle (build.gradle): ``` dependencies { implementation platform("org.hibernate:hibernate-search-parent:5.11.10.Final") implementation "org.hibernate:hibernate-core" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Hibernate repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Hibernate) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Hibernate) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Hibernate) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.hibernate/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/httpful/ ================================================================================ # Httpful Endless Lifecycle Support (ELS) for Httpful from TuxCare provides security fixes for Httpful library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Httpful** 0.3.2 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Httpful Install the TuxCare-maintained Httpful release that matches your project: Composer CLI: ``` composer require nategood/httpful:0.3.2-p1+tuxcare ``` composer.json: ``` { "require": { "nategood/httpful": "0.3.2-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=nategood%2Fhttpful) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=nategood%2Fhttpful) — Patched versions and changelogs * ![](/images/box.webp) [Supported components](https://tuxcare.com/cve-tracker/products?q=nategood%2Fhttpful) — Components covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/nategood/httpful/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/jackson/ ================================================================================ # Jackson TuxCare's Endless Lifecycle Support (ELS) for Jackson provides security patches and selected bug fixes that are integral to the stable operation of applications running on Jackson. ## Supported Versions * Jackson 1.9.13, 2.14.2 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Jackson repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Jackson repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Jackson dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.codehaus.jackson jackson-mapper-asl 1.9.13-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation("org.codehaus.jackson:jackson-mapper-asl:1.9.13-tuxcare.1") } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Jackson repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Jackson) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Jackson) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Jackson) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.codehaus.jackson/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/java-libraries/ ================================================================================ # Java Libraries Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for a variety of Java Libraries. This allows you to continue running your Java applications without vulnerability concerns, even after official support has ended. ## Supported Java Libraries * **Apache ActiveMQ Artemis** 2.26.0 * **Apache Avro** 1.7.6, 1.7.7, 1.8.2, 1.10.2, 1.11.0, 1.11.3 * **Apache Axis** 1.4 * **Apache Commons BeanUtils** 1.6, 1.8.0, 1.8.3, 1.9.4, 1.10.1 * **Apache Commons Compress** 1.18, 1.19, 1.20, 1.21, 1.26.2 * **Apache Commons Digester** 2.0, 2.1 * **Apache Commons FileUpload** 1.2.1, 1.2.2 * **Apache Commons HttpClient** 3.1 * **Apache Commons IO** 2.4, 2.5, 2.6, 2.7, 2.8.0, 2.11.0 * **Apache Commons VFS** 2.0 * **Apache FOP** 1.0 * **Apache HttpComponents Client** 4.5.2 * **Apache Neethi** 3.1.1 * **Apache POI** 3.10-FINAL, 4.1.2 * **Apache Pulsar** 3.2.4 * **Apache Santuario XML Security For Java** 2.0.10, 2.3.1 * **Apache Thrift** 0.9.1, 0.9.3, 0.14.1 * **Apache Tika** 2.9.4 * **Apache XML Graphics Commons** 1.4, 2.1 * **Apache XMLBeans** 2.6.0 * **AssertJ** 2.9.0, 3.18.1, 3.25.3 * **Apereo CAS Client** 4.0.4 * **Bouncy Castle** 1.64, 1.76, 1.78.1 * **c3p0** 0.9.5.5 * **DNSJava** 2.1.7 * **docx4j** 3.3.6 * **Dom4j** 1.6.1 * **Eclipse JGit** 5.7.0, 5.13.3 * **Eclipse Parsson** 1.0.0 * **EdDSA** 0.3.0 * **el-spec** 3.0.0 * **excel-streaming-reader** 5.0.2 * **Google Gson** 2.4, 2.8.5, 2.8.9, 2.9.1, 2.10.1, 2.11.0 * **Google Guava** 16.0.1, 18.0, 20.0, 25.1-android, 25.1-jre, 27.1-android, 27.1-jre, 30.1-jre, 31.1-jre * **Google Guice** 4.2.1 * **Google OAuth Client** 1.25.0 * **Grails** 2.5.6, 6.2.3 * **H2 Database** 1.4.200 * **Hazelcast** 4.2.8 * **HornetQ** 2.4.9.Final * **HPPC** 0.8.1 * **HtmlUnit** 2.70.0 * **iText** 2.1.7 * **JasperReports** 3.7.4 * **JBoss XNIO** 3.8.0, 3.8.8 * **JDOM** 1.0, 1.1.3 * **Joda-Time** 1.3 * **JSON** 20090211, 20140107 * **JSON Assert** 1.2.3 * **JSON Smart v2** 2.4.8 * **JUnit** 4.13 * **Logback** 1.1.7, 1.2.13, 1.4.14, 1.5.18 * **LZ4** 1.8.1 * **mchange-commons-java** 0.2.15, 0.2.19, 0.2.20 * **Mozilla Rhino** 1.7.10, 1.7.15 * **MyBatis** 2.3.5 * **NekoHTML** 1.9.22 * **Netty** 4.1.115.Final, 4.1.48.Final, 4.1.49.Final, 4.1.52.Final, 4.1.58.Final, 4.1.60.Final, 4.1.63.Final, 4.1.73.Final, 4.1.75.Final, 4.1.82.Final, 4.1.92.Final, 4.1.93.Final, 4.1.112.Final, 4.1.117.Final, 4.1.130.Final * **Netty Incubator** 0.0.21.Final * **Nimbus JOSE + JWT** 8.23, 9.22, 9.23, 9.24.4, 9.37.3, 9.39.3 * **Nimbus OAuth2 OIDC SDK** 9.43.3, 9.43.6 * **OkHttp3** 3.14.9, 4.10.0 * **Okio** 2.8.0, 2.10.0 * **Plexus Utils** 1.4.5, 1.5.8 * **Querydsl** 5.1.0 * **Reactor BOM** 2020.0.23, 2020.0.32, 2020.0.38, 2022.0.15 * **Reactor Netty** 1.0.23, 1.0.32, 1.0.39, 1.1.15 * **RSocket** 1.1.3 * **SnakeYAML** 1.23, 1.26, 1.29, 1.30, 1.33 * **Snappy Java** 1.1.8.4 * **Sonatype Aether** 1.13.1 * **Thymeleaf** 3.0.15.RELEASE * **Undertow** 2.2.33.Final, 2.3.0.Final, 2.3.10.Final, 2.3.18.Final * **Woodstox** 5.0.3 * **Xerces** 2.11.0, 2.12.0 * **XMLUnit** 2.9.1, 2.9.0 * **XStream** 1.4.17 Other libraries upon request. ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Java Libraries repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Java Libraries repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace your dependencies (both direct and transitive, as needed) with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. If a BOM (Bill of Materials) is available, it's recommended to use it to manage versions. * Example of **BOM (Bill of Materials)** usage: Maven (pom.xml): ``` io.netty netty-bom 4.1.115.Final-tuxcare.2 pom import io.netty netty-handler ``` Gradle (build.gradle): ``` plugins { id 'java' } dependencyManagement { imports { mavenBom 'io.netty:netty-bom:4.1.115.Final-tuxcare.2' } } dependencies { implementation "io.netty:netty-handler" } ``` * If no BOM is provided, **update dependency versions directly** using the latest `.tuxcare` patches for your dependency versions. Maven (pom.xml): ``` io.netty netty-handler 4.1.115.Final-tuxcare.2 ``` Gradle (build.gradle): ``` dependencies { implementation "io.netty:netty-handler:4.1.115.Final-tuxcare.2" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Java Libraries repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/javascript-libraries/ ================================================================================ # JavaScript Libraries Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for a variety of JavaScript Libraries. This allows you to continue running your JavaScript applications without vulnerability concerns, even after official support has ended. ## Supported JavaScript Libraries * **acorn** 6.0.4, 6.2.0 * **adm-zip** 0.4.4 * **ag-grid** 16.0.1, 17.1.0, 17.1.1, 18.0.1, 18.1.2 * **ag-grid-community** 20.2.0, 21.0.0, 23.0.2, 23.2.1, 24.1.0, 25.0.0, 26.1.0, 26.2.0, 26.2.1, 28.1.0, 28.1.1, 28.2.0, 29.1.0, 30.1.0, 30.2.0, 31.1.1 * **ajv** 4.11.8, 5.5.2, 6.4.0, 6.12.3, 6.12.4, 6.12.6, 6.14.0, 8.6.2, 8.9.0, 8.11.0, 8.12.0, 8.17.1 * **animations** 6.0.1 * **ansi-html** 0.0.7 * **ansi-regex** 3.0.0 * **async** 2.6.1, 2.6.3 * **axios** 0.15.3, 0.18.1, 0.19.2, 0.21.1, 0.21.4, 0.24.0, 0.26.1, 0.27.2, 0.33.0, 1.6.2, 1.6.8, 1.7.5, 1.7.7 * **azure-identity** 4.0.1 * **babel-core** 7.18.9, 7.21.0 * **babel-helpers** 7.15.4, 7.18.9, 7.21.0, 7.24.0, 7.24.1, 7.25.6, 7.26.0 * **babel-plugin-transform-modules-systemjs** 7.15.4, 7.23.9, 7.24.1, 7.25.0 * **babel-runtime** 7.11.2, 7.12.5, 7.12.18, 7.14.8, 7.15.4, 7.16.7, 7.18.9, 7.21.0, 7.22.6, 7.22.15, 7.23.1, 7.23.2, 7.23.9, 7.24.0, 7.24.1, 7.24.4, 7.24.7, 7.25.7, 7.26.0 * **babel-runtime-corejs2** 7.18.9, 7.21.0 * **babel-runtime-corejs3** 7.15.3, 7.18.9, 7.21.0 * **babel-traverse** 6.26.0, 7.15.4 * **base64url** 0.0.6 * **basic-ftp** 5.0.5, 5.3.1 * **bn.js** 4.11.8, 4.12.0 * **body-parser** 1.8.4, 1.13.3, 1.14.2, 1.19.0, 1.20.1, 1.20.2 * **bower** 1.8.4 * **brace-expansion** 1.1.11, 2.0.1 * **braces** 0.1.5, 1.8.5, 2.3.1, 2.3.2, 3.0.2, 3.0.3 * **browserify-sign** 4.0.4, 4.2.1 * **browserslist** 4.10.0, 4.13.0, 4.27.0 * **bson** 0.5.7, 1.0.9 * **chownr** 0.0.2, 1.0.1 * **cipher-base** 1.0.4 * **ckeditor** 4.5.11 * **ckeditor4** 4.17.1 * **clean-css** 2.2.23, 3.4.28 * **concat-stream** 1.4.8, 1.4.10, 1.5.0 * **connect** 1.9.2, 2.6.0, 2.7.5 * **cookie** 0.0.5, 0.1.3, 0.3.1, 0.4.0, 0.4.2, 0.5.0, 0.6.0, 0.7.2 * **copy-anything** 2.0.6 * **cross-spawn** 0.2.9, 3.0.1, 5.1.0, 6.0.5, 7.0.3 * **crypto-js** 3.3.0 * **csvtojson** 2.0.8 * **datatables.net** 1.10.13 * **debug** 0.7.4, 1.0.5, 2.1.1, 2.2.0, 2.3.3, 2.6.9, 3.1.0, 3.2.6, 3.2.7, 4.1.1, 4.4.3 * **decode-uri-component** 0.2.0 * **defu** 6.1.2 * **devalue** 2.0.1, 4.3.3 * **diff** 1.0.2, 1.4.0, 3.5.0, 7.0.0 * **dns-packet** 1.3.1 * **dompurify** 2.3.0, 2.4.0, 2.4.3, 2.4.7, 2.5.8, 2.5.9, 3.0.3, 3.1.6, 3.2.3 * **dset** 3.1.3 * **ejs** 1.0.0, 2.7.4, 3.1.9 * **elliptic** 6.4.1, 6.5.4, 6.5.5, 6.6.0, 6.6.1 * **engine.io** 3.2.1 * **es5-ext** 0.10.7, 0.10.46 * **esbuild** 0.13.8, 0.14.22, 0.14.25, 0.14.54, 0.15.5, 0.15.18, 0.17.8, 0.17.15, 0.17.19, 0.18.17, 0.18.20, 0.19.8, 0.19.12, 0.20.1, 0.21.5, 0.23.1 * **eslint-plugin-kit** 0.2.7 * **eventsource** 0.1.6, 1.1.0 * **express-jwt** 0.1.3, 0.1.4 * **extend** 3.0.0 * **fast-uri** 3.0.1, 3.0.3 * **fast-xml-parser** 3.14.0, 3.17.5, 3.19.0, 4.2.7, 4.4.0, 4.5.3, 4.5.6 * **file-type** 17.1.6 * **flatted** 3.2.9, 3.3.3 * **follow-redirects** 0.0.3, 1.5.10, 1.15.2, 1.15.3, 1.15.5, 1.15.6, 1.15.9, 1.15.11 * **form-data** 0.0.8, 0.1.4, 0.2.0, 1.0.0-rc3, 1.0.1, 2.0.0, 2.1.4, 2.3.3, 4.0.0, 4.0.1 * **formidable** 2.1.2, 2.1.5 * **forwarded** 0.1.0 * **fresh** 0.2.4, 0.3.0, 0.5.2 * **fstream** 1.0.8 * **gh-pages** 0.12.0 * **glob** 10.2.6, 10.4.5 * **got** 2.9.2, 8.3.2, 9.6.0 * **growl** 1.7.0 * **handlebars** 1.0.12, 1.3.0, 2.0.0, 3.0.3, 4.7.7, 4.7.8 * **hapi-hoek** 6.2.4 * **happy-dom** 9.10.9, 14.12.3 * **hawk** 0.13.1, 1.0.0, 1.1.1, 2.3.1, 3.1.0 * **highcharts** 6.0.7, 6.1.0, 6.1.3, 6.2.0, 7.2.0, 7.2.2, 8.2.2 * **highlight.js** 9.18.5 * **hoek** 0.8.5, 0.9.1, 2.11.1, 2.12.0, 2.14.0, 2.16.3, 4.2.1 * **hosted-git-info** 2.1.4, 2.7.1 * **http-proxy-middleware** 0.0.5, 0.17.2, 0.17.3, 0.18.0, 0.19.1, 0.20.0, 1.0.0, 1.1.0, 2.0.6, 2.0.7, 2.0.8, 3.0.3 * **i18next** 23.16.8 * **i18next-http-backend** 1.4.4, 2.5.2 * **immutable** 3.8.1, 3.8.2, 4.3.5, 4.3.7, 5.0.3 * **ini** 1.3.5 * **ip** 1.1.5, 1.1.9, 2.0.0, 2.0.1 * **is-my-json-valid** 2.10.1, 2.12.2 * **jquery-validation** 1.19.0 * **js-cookie** 2.2.1 * **js-yaml** 3.3.1, 3.7.0, 3.14.1, 4.1.0 * **json5** 0.4.0, 0.5.1, 1.0.1, 1.0.2 * **jsoneditor** 5.19.0 * **jsonpath-plus** 5.1.0, 6.0.1, 7.2.0 * **jsonpointer** 1.1.0, 2.0.0, 4.1.0 * **jspdf** 1.4.1, 2.5.1, 2.5.2, 3.0.4 * **knex** 0.95.15 * **linkifyjs** 4.1.3 * **loader-utils** 0.2.17, 1.1.0, 1.2.3, 2.0.0 * **lodash.merge** 3.3.2 * **log4js** 3.0.6, 4.5.1 * **luxon** 2.3.0 * **markdown-it** 4.0.3, 4.3.0, 8.4.2, 13.0.2 * **marked** 0.2.10, 0.7.0, 4.0.6, 4.0.7, 4.0.9 * **mem** 1.1.0 * **micromatch** 2.3.11, 3.1.10 * **mime** 1.2.11, 1.3.0, 1.3.4 * **minimatch** 0.0.4, 0.0.5, 0.2.14, 0.3.0, 1.0.0, 2.0.10, 3.0.4, 3.1.2, 3.1.5, 5.1.0 * **minimist** 0.0.8, 0.0.10, 1.2.0, 1.2.1, 1.2.8 * **moment** 2.10.6, 2.24.0 * **moment-timezone** 0.4.1 * **morgan** 1.5.3 * **mout** 0.9.1, 0.11.0 * **multer** 1.4.5-lts, 1.4.5-lts.1, 1.4.5-lts.2 * **mysql** 2.18.1 * **negotiator** 0.5.3 * **netmask** 1.0.6 * **nguniversal-express-engine** 10.1.0 * **node-forge** 0.10.0 * **nodemailer** 2.7.2, 6.10.1 * **nth-check** 1.0.2 * **object-path** 0.11.4 * **parse-git-config** 3.0.0 * **parsejson** 0.0.3 * **path-to-regexp** 0.1.3, 0.1.12, 6.2.1 * **pdfjs-dist** 2.14.305, 2.16.105, 3.11.174 * **picocolors** 0.2.1 * **picomatch** 2.3.1, 4.0.2 * **prismjs** 1.27.0, 1.29.0 * **protobufjs** 6.10.2, 6.11.6 * **protobufjs-utf8** 1.1.0 * **pug** 2.0.4 * **qs** 0.5.1, 0.6.6, 1.0.2, 1.2.2, 2.2.5, 2.3.3, 2.4.2, 4.0.0, 5.1.0, 5.2.0, 6.5.3, 6.5.5, 6.11.0, 6.14.0 * **quill** 1.3.7 * **redis** 2.8.0 * **request** 2.88.0, 2.88.2 * **rollup** 0.41.6, 0.57.1, 2.1.0, 2.26.5, 2.38.4, 2.79.1, 2.79.2 * **sanitize-html** 1.27.5 * **semver** 2.3.2, 4.3.6, 5.0.3, 6.3.0, 7.1.3, 7.3.2, 7.3.4, 7.3.8 * **sentry-browser** 5.7.1 * **serialize-javascript** 1.9.1, 3.1.0, 4.0.0, 5.0.1, 6.0.2 * **set-value** 2.0.0 * **shell-quote** 1.4.3, 1.6.1, 1.7.2 * **shelljs** 0.1.4, 0.3.0 * **socket.io** 2.1.1 * **socket.io-parser** 3.2.0, 3.3.4, 3.4.3, 4.2.4 * **ssr-window** 4.0.2 * **ssri** 7.1.0 * **stringstream** 0.0.4, 0.0.5 * **svgo** 2.8.0 * **swiper** 8.4.7, 11.2.10 * **tar** 1.0.3, 2.1.1, 2.2.1, 2.2.2, 4.4.19, 6.0.2, 6.1.15, 6.2.1 * **terser** 3.17.0, 4.6.3, 4.6.10, 4.8.1, 5.3.0, 5.5.1, 5.7.1, 5.10.0 * **tinymce** 4.9.11, 5.10.9, 6.8.6 * **tmp** 0.0.24, 0.0.28, 0.0.30, 0.0.33, 0.1.0, 0.2.1 * **tmpl** 1.0.4 * **tough-cookie** 0.12.1, 1.2.0, 2.2.0, 2.4.3, 2.5.0, 3.0.1 * **tunnel-agent** 0.3.0, 0.4.0, 0.4.3 * **ua-parser-js** 0.7.21, 0.7.31 * **uglify-js** 1.1.1, 1.3.5, 2.3.6 * **underscore** 1.4.4, 1.6.0, 1.7.0, 1.13.4 * **underscore.string** 2.2.1, 2.3.3 * **uuid** 3.4.0, 8.3.2, 9.0.1, 11.0.5 * **validator** 8.2.0, 10.11.0 * **webpack-dev-middleware** 1.12.2, 3.7.2, 3.7.3, 5.0.0, 5.3.0, 5.3.3 * **webpack-subresource-integrity** 1.4.0, 1.4.1 * **websocket-extensions** 0.1.1 * **word-wrap** 1.2.3 * **ws** 1.1.1, 1.1.2, 1.1.5, 3.3.3, 4.1.0, 7.4.6 * **xlsx** 0.18.5 * **xml2js** 0.2.6, 0.2.8, 0.4.23 * **xmldom** 0.1.31, 0.6.0 * **xmlhttprequest-ssl** 1.5.3, 1.5.5 * **y18n** 4.0.0 * **yaml** 1.10.2, 2.5.0 * **yargs-parser** 4.2.1, 7.0.0, 10.1.0, 11.1.1, 13.1.2 * **zod** 3.21.4, 3.25.76 Other libraries upon request. ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your JavaScript Libraries project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-javascript-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace JavaScript library dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your JavaScript library dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "cookie": "npm:@els-js/cookie@>=0.4.2-tuxcare.1" }, "overrides": { "cookie@0.4.2": "npm:@els-js/cookie@>=0.4.2-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the JavaScript library versions in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for JavaScript Libraries repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/jetty/ ================================================================================ # Eclipse Jetty TuxCare's Endless Lifecycle Support (ELS) for Eclipse Jetty provides security patches and selected bug fixes that are integral to the stable operation of applications running on Eclipse Jetty. ## Supported Versions * Eclipse Jetty 7.6.0.v20120127, 8.2.0.v20160908, 9.2.16.v20160414, 9.4.24.v20191120, 9.4.41.v20210516, 9.4.48.v20220622, 9.4.50.v20221201, 9.4.53.v20231009, 9.4.57.v20241219, 9.4.58.v20250814, 9.4.59, 9.4.60, 9.4.61, 9.4.62, 10.0.26, 10.0.27, 10.0.28, 10.0.29, 10.0.30, 11.0.19, 11.0.26, 11.0.27, 11.0.28, 11.0.29, 11.0.30 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Eclipse Jetty repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Eclipse Jetty repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Eclipse Jetty dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Each TuxCare version is the upstream Jetty version with a TuxCare patch suffix — for example, `9.4.58.v20250814-tuxcare.3`. It differs from the upstream number (`9.4.58`) because it is a safe version provided by TuxCare, so use the version string as shown in Nexus. The snippet below is only an example — check Nexus for the current version of your Jetty line. Maven (pom.xml): ``` org.eclipse.jetty jetty-bom 9.4.58.v20250814-tuxcare.3 pom import org.eclipse.jetty jetty-server ``` Gradle (build.gradle): ``` plugins { id 'java' } dependencyManagement { imports { mavenBom 'org.eclipse.jetty:jetty-bom:9.4.58.v20250814-tuxcare.3' } } dependencies { implementation "org.eclipse.jetty:jetty-server" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Eclipse Jetty repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Eclipse+Jetty) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Eclipse+Jetty) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Eclipse+Jetty) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.eclipse.jetty/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/jquery-ui/ ================================================================================ # jQuery UI Endless Lifecycle Support (ELS) for jQuery UI from TuxCare provides security fixes for jQuery UI versions that have reached their end of life. This allows you to continue running jQuery UI applications without vulnerability concerns, even after official support has ended. ## Supported jQuery UI Versions * jQuery UI 1.10.4 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your jQuery UI project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-jquery-ui-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace jQuery UI dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your jQuery UI dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "jquery-ui": "npm:@els-js/jquery-ui@>=1.10.4-tuxcare.1" }, "overrides": { "jquery-ui@1.10.4": "npm:@els-js/jquery-ui@>=1.10.4-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the jQuery UI version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "jquery-ui": "^1.10.4" } ``` to: ```text "dependencies": { "jquery-ui": "npm:@els-js/jquery-ui@>=1.10.4-tuxcare.1" }, "overrides": { "jquery-ui@1.10.4": "npm:@els-js/jquery-ui@>=1.10.4-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for jQuery UI repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=jquery-ui) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=jquery-ui) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?q=jquery-ui) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:jquery-ui) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/jquery/ ================================================================================ # jQuery Endless Lifecycle Support (ELS) for jQuery from TuxCare provides security fixes for jQuery versions that have reached their end of life. This allows you to continue running jQuery applications without vulnerability concerns, even after official support has ended. ## Supported jQuery Versions * jQuery 1.8.2, 1.11.3, 1.12.4, 2.2.4, 3.2.1, 3.3.1, 3.4.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your jQuery project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-jquery-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace jQuery dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your jQuery dependencies with the TuxCare packages. This method gives you full control over which packages to update. * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the jQuery version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "jquery": "^1.12.4" } ``` to: ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=1.12.4-tuxcare.1" }, "overrides": { "jquery@1.12.4": "npm:@els-js/jquery@>=1.12.4-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=1.8.2-tuxcare.1" }, "overrides": { "jquery@1.8.2": "npm:@els-js/jquery@>=1.8.2-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=1.11.3-tuxcare.1" }, "overrides": { "jquery@1.11.3": "npm:@els-js/jquery@>=1.11.3-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=1.12.4-tuxcare.1" }, "overrides": { "jquery@1.12.4": "npm:@els-js/jquery@>=1.12.4-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=2.2.4-tuxcare.1" }, "overrides": { "jquery@2.2.4": "npm:@els-js/jquery@>=2.2.4-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=3.2.1-tuxcare.1" }, "overrides": { "jquery@3.2.1": "npm:@els-js/jquery@>=3.2.1-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=3.3.1-tuxcare.1" }, "overrides": { "jquery@3.3.1": "npm:@els-js/jquery@>=3.3.1-tuxcare.1" } ``` ```text "dependencies": { "jquery": "npm:@els-js/jquery@>=3.4.1-tuxcare.1" }, "overrides": { "jquery@3.4.1": "npm:@els-js/jquery@>=3.4.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for jQuery repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=jQuery) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=jQuery) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=jQuery) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:jquery) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/jsonwebtoken/ ================================================================================ # JSON Web Token (JWT) Endless Lifecycle Support (ELS) for JSON Web Token from TuxCare provides security fixes for JSON Web Token versions that have reached their end of life. This allows you to continue running JSON Web Token applications without vulnerability concerns, even after official support has ended. ## Supported JSON Web Token Versions * JSON Web Token 0.4.0, 0.4.1, 7.1.6, 8.5.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your JSON Web Token (JWT) project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-jsonwebtoken-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace JSON Web Token dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your JSON Web Token dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "jsonwebtoken": "npm:@els-js/jsonwebtoken@>=0.4.0-tuxcare.1" }, "overrides": { "jsonwebtoken@0.4.0": "npm:@els-js/jsonwebtoken@>=0.4.0-tuxcare.1" } ``` ```text "dependencies": { "jsonwebtoken": "npm:@els-js/jsonwebtoken@>=0.4.1-tuxcare.1" }, "overrides": { "jsonwebtoken@0.4.1": "npm:@els-js/jsonwebtoken@>=0.4.1-tuxcare.1" } ``` ```text "dependencies": { "jsonwebtoken": "npm:@els-js/jsonwebtoken@>=7.1.6-tuxcare.1" }, "overrides": { "jsonwebtoken@7.1.6": "npm:@els-js/jsonwebtoken@>=7.1.6-tuxcare.1" } ``` ```text "dependencies": { "jsonwebtoken": "npm:@els-js/jsonwebtoken@>=8.5.1-tuxcare.1" }, "overrides": { "jsonwebtoken@8.5.1": "npm:@els-js/jsonwebtoken@>=8.5.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the JSON Web Token version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "jsonwebtoken": "^8.5.1" } ``` to: ```text "dependencies": { "jsonwebtoken": "npm:@els-js/jsonwebtoken@>=8.5.1-tuxcare.1" }, "overrides": { "jsonwebtoken@8.5.1": "npm:@els-js/jsonwebtoken@>=8.5.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for JSON Web Token repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=jsonwebtoken) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=jsonwebtoken) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/jsonwebtoken/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:jsonwebtoken) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/karma/ ================================================================================ # karma Endless Lifecycle Support (ELS) for karma from TuxCare provides security fixes for karma versions that have reached their end of life. This allows you to continue running karma applications without vulnerability concerns, even after official support has ended. ## Supported karma Versions * karma 3.0.0, 4.0.1, 4.1.0, 4.4.1, 5.0.0, 5.0.9 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your karma project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-karma-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace karma dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your karma dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "karma": "npm:@els-js/karma@>=4.1.0-tuxcare.1" }, "overrides": { "karma@4.1.0": "npm:@els-js/karma@>=4.1.0-tuxcare.1" } ``` ```text "dependencies": { "karma": "npm:@els-js/karma@>=5.0.9-tuxcare.1" }, "overrides": { "karma@5.0.9": "npm:@els-js/karma@>=5.0.9-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the karma version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "karma": "^5.0.9" } ``` to: ```text "dependencies": { "karma": "npm:@els-js/karma@>=5.0.9-tuxcare.1" }, "overrides": { "karma@5.0.9": "npm:@els-js/karma@>=5.0.9-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for karma repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=karma) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=karma) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/karma/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:karma) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/knockout/ ================================================================================ # Knockout Endless Lifecycle Support (ELS) for Knockout from TuxCare provides security fixes for Knockout versions that have reached their end of life. This allows you to continue running Knockout applications without vulnerability concerns, even after official support has ended. ## Supported Knockout Versions * Knockout 2.3.0, 3.2.0, 3.4.2 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Knockout project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-knockout-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Knockout dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Knockout dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "knockout": "npm:@els-js/knockout@>=2.3.0-tuxcare.1" }, "overrides": { "knockout@2.3.0": "npm:@els-js/knockout@>=2.3.0-tuxcare.1" } ``` ```text "dependencies": { "knockout": "npm:@els-js/knockout@>=3.2.0-tuxcare.1" }, "overrides": { "knockout@3.2.0": "npm:@els-js/knockout@>=3.2.0-tuxcare.1" } ``` ```text "dependencies": { "knockout": "npm:@els-js/knockout@>=3.4.2-tuxcare.1" }, "overrides": { "knockout@3.4.2": "npm:@els-js/knockout@>=3.4.2-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Knockout version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "knockout": "^3.4.2" } ``` to: ```text "dependencies": { "knockout": "npm:@els-js/knockout@>=3.4.2-tuxcare.1" }, "overrides": { "knockout@3.4.2": "npm:@els-js/knockout@>=3.4.2-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Knockout repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Knockout) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Knockout) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Knockout) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/knockout/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:knockout) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/koa/ ================================================================================ # koa Endless Lifecycle Support (ELS) for koa from TuxCare provides security fixes for koa versions that have reached their end of life. This allows you to continue running koa applications without vulnerability concerns, even after official support has ended. ## Supported koa Versions * koa 1.7.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your koa project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-koa-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace koa dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your koa dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "koa": "npm:@els-js/koa@>=1.7.1-tuxcare.1" }, "overrides": { "koa@1.7.1": "npm:@els-js/koa@>=1.7.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the koa version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "koa": "^1.7.1" } ``` to: ```text "dependencies": { "koa": "npm:@els-js/koa@>=1.7.1-tuxcare.1" }, "overrides": { "koa@1.7.1": "npm:@els-js/koa@>=1.7.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for koa repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=koa) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=koa) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/koa/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:koa) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/laminas/ ================================================================================ # Laminas Endless Lifecycle Support (ELS) for Laminas from TuxCare provides security fixes for Laminas components that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **laminas-diactoros** 2.22.0 Other components and versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Laminas components Install the TuxCare-maintained Laminas component release that matches your project: Composer CLI: ``` composer require laminas/laminas-diactoros:2.22.0-p1+tuxcare ``` composer.json: ``` { "require": { "laminas/laminas-diactoros": "2.22.0-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=laminas) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=laminas) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/laminas/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/laravel-media-library/ ================================================================================ # Laravel Media Library Endless Lifecycle Support (ELS) for Laravel Media Library (spatie/laravel-medialibrary) from TuxCare provides security fixes for package versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **Laravel Media Library** 9.12.4, 10.15.0 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Laravel Media Library Install the TuxCare-maintained release that matches your project: Composer CLI: ``` composer require spatie/laravel-medialibrary:10.15.0-p2+tuxcare ``` composer.json: ``` { "require": { "spatie/laravel-medialibrary": "10.15.0-p2+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=spatie%2Flaravel-medialibrary) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=spatie%2Flaravel-medialibrary) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/spatie/laravel-medialibrary/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/laravel/ ================================================================================ # Laravel Endless Lifecycle Support (ELS) for Laravel from TuxCare provides security fixes for Laravel framework versions that have reached their end-of-life. This allows you to continue running your Laravel applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Laravel** 5.4.36, 5.5.50, 5.6.40, 5.7.29, 5.8.38, 6.20.45, 7.30.7, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.83.29, 9.52.21, 10, 11, 12.58.0 * **Illuminate View** 5.4.36 * **Illuminate Database** 5.4.36 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Laravel components Install the TuxCare-maintained Laravel or Illuminate release that matches your project: Composer CLI: ``` composer require laravel/framework:10.48.28-p1+tuxcare ``` composer.json: ``` { "require": { "laravel/framework": "10.48.28-p1+tuxcare" } } ``` Composer CLI: ``` composer require illuminate/view:5.4.36-p1+tuxcare ``` composer.json: ``` { "require": { "illuminate/view": "5.4.36-p1+tuxcare" } } ``` Composer CLI: ``` composer require illuminate/database:5.4.36-p2+tuxcare ``` composer.json: ``` { "require": { "illuminate/database": "5.4.36-p2+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Laravel) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Laravel) — Patched versions and changelogs * ![](/images/box.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Laravel) — Components covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/league-commonmark/ ================================================================================ # League CommonMark Endless Lifecycle Support (ELS) for League CommonMark from TuxCare provides security fixes for League CommonMark versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **League CommonMark** 1.6.7, 2.7.1 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install League CommonMark Install the TuxCare-maintained League CommonMark release that matches your project: Composer CLI: ``` composer require league/commonmark:1.6.7-p3+tuxcare ``` composer.json: ``` { "require": { "league/commonmark": "1.6.7-p3+tuxcare" } } ``` Composer CLI: ``` composer require league/commonmark:2.7.1-p1+tuxcare ``` composer.json: ``` { "require": { "league/commonmark": "2.7.1-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=league%2Fcommonmark) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=league%2Fcommonmark) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/league/commonmark/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/league-flysystem/ ================================================================================ # League Flysystem Endless Lifecycle Support (ELS) for League Flysystem from TuxCare provides security fixes for Flysystem versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **League Flysystem** 1.0.70, 1.1.10 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install League Flysystem Install the TuxCare-maintained Flysystem release that matches your project: Composer CLI: ``` composer require league/flysystem:1.1.10-p1+tuxcare ``` composer.json: ``` { "require": { "league/flysystem": "1.1.10-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=league%2Fflysystem) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=league%2Fflysystem) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/league/flysystem/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/livewire/ ================================================================================ # Livewire Endless Lifecycle Support (ELS) for Livewire from TuxCare provides security fixes for Livewire versions that have reached their end-of-life. This allows you to continue running your Livewire applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Livewire** 3.x Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Livewire Install the TuxCare-maintained Livewire release that matches your project: Composer CLI: ``` composer require livewire/livewire:3.6.3-p1+tuxcare ``` composer.json: ``` { "require": { "livewire/livewire": "3.6.3-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Livewire) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Livewire) — Patched versions and changelogs * ![](/images/box.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Livewire) — Components covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/livewire/livewire/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/lodash/ ================================================================================ # Lodash Endless Lifecycle Support (ELS) for Lodash from TuxCare provides security fixes for Lodash versions that have reached their end of life. This allows you to continue running Lodash applications without vulnerability concerns, even after official support has ended. ## Supported Lodash Versions * Lodash 1.3.1, 2.4.2, 3.10.1, 3.2.0, 4.17.4, 4.17.5, 4.17.15, 4.17.19, 4.17.21, 4.18.1, 4.5.0 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Lodash project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-lodash-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Lodash dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Lodash dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=1.3.1-tuxcare.1" }, "overrides": { "lodash@1.3.1": "npm:@els-js/lodash@>=1.3.1-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=2.4.2-tuxcare.1" }, "overrides": { "lodash@2.4.2": "npm:@els-js/lodash@>=2.4.2-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=3.2.0-tuxcare.1" }, "overrides": { "lodash@3.2.0": "npm:@els-js/lodash@>=3.2.0-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=3.10.1-tuxcare.1" }, "overrides": { "lodash@3.10.1": "npm:@els-js/lodash@>=3.10.1-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.5.0-tuxcare.1" }, "overrides": { "lodash@4.5.0": "npm:@els-js/lodash@>=4.5.0-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.17.4-tuxcare.1" }, "overrides": { "lodash@4.17.4": "npm:@els-js/lodash@>=4.17.4-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.17.5-tuxcare.1" }, "overrides": { "lodash@4.17.5": "npm:@els-js/lodash@>=4.17.5-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.17.15-tuxcare.1" }, "overrides": { "lodash@4.17.15": "npm:@els-js/lodash@>=4.17.15-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.17.19-tuxcare.1" }, "overrides": { "lodash@4.17.19": "npm:@els-js/lodash@>=4.17.19-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.17.21-tuxcare.1" }, "overrides": { "lodash@4.17.21": "npm:@els-js/lodash@>=4.17.21-tuxcare.1" } ``` ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.18.1-tuxcare.1" }, "overrides": { "lodash@4.18.1": "npm:@els-js/lodash@>=4.18.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Lodash version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "lodash": "^4.17.19" } ``` to: ```text "dependencies": { "lodash": "npm:@els-js/lodash@>=4.17.19-tuxcare.1" }, "overrides": { "lodash@4.17.19": "npm:@els-js/lodash@>=4.17.19-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Lodash repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Lodash) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Lodash) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Lodash) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/lodash/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:lodash) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/loopback/ ================================================================================ # LoopBack Endless Lifecycle Support (ELS) for LoopBack from TuxCare provides security fixes for LoopBack versions that have reached their end of life. This allows you to continue running LoopBack applications without vulnerability concerns, even after official support has ended. ## Supported LoopBack Versions * LoopBack 1.10.0, 2.42.0 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your LoopBack project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-loopback-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Manually update your `package.json` file by replacing LoopBack dependencies with TuxCare-maintained packages: ```text "dependencies": { "loopback": "npm:@els-js/loopback@>=1.10.0-tuxcare.1" }, "overrides": { "loopback@1.10.0": "npm:@els-js/loopback@>=1.10.0-tuxcare.1", "aws-sdk": "npm:@els-js/aws-sdk@>=2.0.5-tuxcare.1", "base64-url": "npm:@els-js/base64-url@>=1.2.1-tuxcare.1", "basic-auth-connect": "npm:@els-js/basic-auth-connect@>=1.0.0-tuxcare.1", "body-parser": "npm:@els-js/body-parser@>=1.13.3-tuxcare.1", "cookie": "npm:@els-js/cookie@>=0.1.3-tuxcare.1", "debug": "npm:@els-js/debug@>=2.2.0-tuxcare.1", "ejs": "npm:@els-js/ejs@>=1.0.0-tuxcare.1", "follow-redirects": "npm:@els-js/follow-redirects@>=0.0.3-tuxcare.1", "form-data": "npm:@els-js/form-data@>=0.1.4-tuxcare.1", "fresh": "npm:@els-js/fresh@>=0.3.0-tuxcare.1", "hawk": "npm:@els-js/hawk@>=1.1.1-tuxcare.1", "hoek": "npm:@els-js/hoek@>=0.9.1-tuxcare.1", "mime": "npm:@els-js/mime@>=1.3.4-tuxcare.1", "minimist": "npm:@els-js/minimist@>=0.0.8-tuxcare.1", "ms": "npm:@els-js/ms@>=0.7.1-tuxcare.1", "negotiator": "npm:@els-js/negotiator@>=0.5.3-tuxcare.1", "on-headers": "npm:@els-js/on-headers@>=1.0.2-tuxcare.1", "qs": "npm:@els-js/qs@>=4.0.0-tuxcare.1", "tunnel-agent": "npm:@els-js/tunnel-agent@>=0.4.3-tuxcare.1", "underscore": "npm:@els-js/underscore@>=1.6.0-tuxcare.1", "underscore.string": "npm:@els-js/underscore.string@>=2.3.3-tuxcare.1", "xml2js": "npm:@els-js/xml2js@>=0.2.6-tuxcare.1" } ``` ```text "dependencies": { "loopback": "npm:@els-js/loopback@>=2.42.0-tuxcare.1" }, "overrides": { "loopback@2.42.0": "npm:@els-js/loopback@>=2.42.0-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for LoopBack repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=loopback) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=loopback) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/loopback/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:loopback) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/machine-readable-security-data/ ================================================================================ # Machine-Readable Security Data (SBOM, VEX, GPG) TuxCare provides machine-readable security data and verification tooling for ELS for Libraries: * **SBOM (Software Bill of Materials)** — package composition and dependency inventory in SPDX and CycloneDX formats * **VEX (Vulnerability Exploitability eXchange)** — exploitability status for known CVEs in CycloneDX VEX format * **Package signatures (GPG)** — detached OpenPGP signatures to verify each artifact's authenticity and integrity * **Integrity violation logging** — detecting and retaining integrity-check failures for administrator review Released fixes are available via [tuxcare.com/cve-tracker](https://tuxcare.com/cve-tracker/) and [security.tuxcare.com](https://security.tuxcare.com/). ## Software Bill of Materials (SBOM) Each package built by TuxCare ships with an SBOM that lists its components, versions, and dependency relationships. SBOMs are provided in industry-standard formats — SPDX and CycloneDX — so they can be consumed by any SBOM-aware scanner or supply-chain tool. TuxCare generates an SBOM for every package it builds, across all ELS for Libraries ecosystems (Java, JavaScript, Python, PHP, .NET). SBOMs are published to TuxCare Nexus and require credentials. Direct browse repositories are currently available for: * Java - [els-java-sbom](https://nexus.repo.tuxcare.com/#browse/browse:els-java-sbom) * Python - [els_python_sbom](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom) * JavaScript - [els-js-sbom](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom) For PHP, .NET, and other ecosystems, reach out to [sales@tuxcare.com](mailto:sales@tuxcare.com) to check SBOM availability. ## Vulnerability Exploitability eXchange (VEX) TuxCare publishes VEX as CycloneDX VEX documents, distributed alongside each package version and updated with every release. A VEX document tells you which known CVEs actually affect a given artifact version and which don't, so scanner results stay focused on real exposure. Feeds are published per ecosystem: * Java - [els_lang_java](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/) * Python - [els_lang_python](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/) * JavaScript - [els_lang_javascript](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/) * PHP - [els_lang_php](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/) * .NET - [els_lang_dotnet](https://security.tuxcare.com/vex/cyclonedx/els_lang_dotnet/) Each entry links one CVE to one artifact version and carries a status: * **exploitable** — the CVE affects this artifact version and has not yet been patched in this release. * **resolved** — the CVE has been patched through a TuxCare release. Each VEX document reports the CVEs that directly affect the artifact. The feed covers every supported base version and every released `-tuxcare.N` iteration, so the entry count reflects these combinations rather than the number of unique CVEs. When checking coverage, filter to the artifact versions you actually use — usually the latest `-tuxcare.N` iteration of your chosen base version. Earlier iterations remain in the feed for historical completeness but aren't relevant once you've adopted a newer release. ## Package Signature Verification (GPG) Every package TuxCare builds is signed with a detached OpenPGP signature so you can confirm, before installing or updating, that the artifact was produced by TuxCare and has not been altered in transit. The signature is published as a separate `.asc` file in TuxCare Nexus and is created with TuxCare's signing key (SHA-256 detached signature). A successful verification proves two things about the artifact: * **Authenticity** — it was signed by TuxCare's private key. * **Integrity** — its bytes match exactly what was signed; no tampering or corruption occurred. A failed verification is an **integrity violation**: the artifact must be treated as untrusted and not installed. Do not work around a failed check by re-downloading over an insecure channel or skipping verification — investigate the source instead. ### Where Signatures Are Published Signature files are published to TuxCare Nexus and require the same credentials as the package repositories. By default the `.asc` is published in the same repository as the SBOM; JavaScript is the exception, publishing signatures to a dedicated signatures repository. See the per-ecosystem steps under [Verify a Package](#verify-a-package) for the precise repository and path. ### Obtain the TuxCare Public Key To verify a signature you first need TuxCare's public signing key. Obtain the key from your TuxCare account, or request it from [sales@tuxcare.com](mailto:sales@tuxcare.com) or your TuxCare support contact. Once you have the key file (for example, `tuxcare-els-public.asc`), import it into your keyring: ```text gpg --import tuxcare-els-public.asc ``` Confirm it imported by listing the keys in your keyring: ```text gpg --list-keys ``` Import the public key once. It can verify every TuxCare-signed package, so this step is not repeated for each artifact. ### Verify a Package The verification procedure is the same for every ELS for Libraries ecosystem (Java, JavaScript, Python, PHP, .NET): obtain the exact published artifact, download its detached `.asc` signature from TuxCare Nexus, and run `gpg --verify`. Select your ecosystem below. The signature location and artifact naming vary by ecosystem. The Java steps below are confirmed; for the other ecosystems, the repository paths and example versions shown are representative — confirm the exact signatures location and artifact naming for your account with your TuxCare contact. 1. **Obtain the exact published artifact** With your TuxCare repository configured (see the [Java libraries](/els-for-libraries/java-libraries/) setup), copy the published `.jar` out of the repository: ```text mvn dependency:copy \ -Dartifact=org.apache.commons:commons-lang3:3.12.0-tuxcare.1 \ -DoutputDirectory=. ``` 2. **Download the matching signature** For Java, the `.asc` is published in the SBOM repository (`els-java-sbom`), keyed by artifact name and version: ```text curl -u "${USERNAME}:${PASSWORD}" -fsSL \ https://nexus.repo.tuxcare.com/repository/els-java-sbom/commons-lang3/3.12.0-tuxcare.1/commons-lang3-3.12.0-tuxcare.1.jar.asc \ -o commons-lang3-3.12.0-tuxcare.1.jar.asc ``` 3. **Verify the signature against the artifact** ```text gpg --verify commons-lang3-3.12.0-tuxcare.1.jar.asc commons-lang3-3.12.0-tuxcare.1.jar ``` A `Good signature` line confirms authenticity and integrity. `BAD signature`, or a missing public key, is an integrity violation — stop and re-obtain the package from TuxCare over a trusted channel. 1. **Obtain the exact published tarball** Verification works on the byte-for-byte artifact that was signed, so download the published `.tgz` rather than repacking it locally. With your TuxCare registry configured (see the [JavaScript libraries](/els-for-libraries/javascript-libraries/) setup), `npm pack` with a version spec downloads the registry tarball as-is: ```text npm pack @els-js/angular@1.8.3-tuxcare.8 ``` This writes `els-js-angular-1.8.3-tuxcare.8.tgz` to the current directory. The filename is normalized by npm, but the contents are identical to the published artifact. 2. **Download the matching signature** Fetch the `.asc` file for the same version from the signatures repository, authenticating with the TuxCare registry token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com) (the same token used in your `.npmrc`): ```text curl -H "Authorization: Basic ${TOKEN}" -fsSL \ https://nexus.repo.tuxcare.com/repository/els-js-signatures/angular/1.8.3-tuxcare.8/angular-1.8.3-tuxcare.8.tgz.asc \ -o angular-1.8.3-tuxcare.8.tgz.asc ``` 3. **Verify the signature against the tarball** Pass the signature file first, then the tarball you downloaded: ```text gpg --verify angular-1.8.3-tuxcare.8.tgz.asc els-js-angular-1.8.3-tuxcare.8.tgz ``` A valid signature produces output similar to: ```text gpg: Signature made Mon 12 May 2025 10:14:21 UTC gpg: using RSA key gpg: Good signature from "TuxCare <...>" [unknown] ``` The `Good signature` line, and a key ID that matches the TuxCare public key you imported, confirm the artifact is authentic and unmodified. (The `[unknown]` trust level only reflects that you have not personally signed TuxCare's key in your web of trust; it does not affect the validity of the signature.) 1. **Obtain the exact published artifact** With your TuxCare index configured (see the [Python libraries](/els-for-libraries/python-libraries/) setup), `pip download` fetches the published file as-is: ```text pip download certifi==2021.10.8.post2+tuxcare --no-deps -d . ``` 2. **Download the matching signature** Fetch the `.asc` for the same version from the signatures repository, authenticating with your TuxCare Nexus credentials: ```text curl -u "${USERNAME}:${PASSWORD}" -fsSL \ https://nexus.repo.tuxcare.com/repository/els-python-signatures/certifi/2021.10.8.post2+tuxcare/certifi-2021.10.8.post2+tuxcare.tar.gz.asc \ -o certifi-2021.10.8.post2+tuxcare.tar.gz.asc ``` 3. **Verify the signature against the artifact** ```text gpg --verify certifi-2021.10.8.post2+tuxcare.tar.gz.asc certifi-2021.10.8.post2+tuxcare.tar.gz ``` A `Good signature` line confirms authenticity and integrity. `BAD signature`, or a missing public key, is an integrity violation — stop and re-obtain the package from TuxCare over a trusted channel. 1. **Obtain the exact published artifact** With your TuxCare repository configured (see any PHP library's setup, e.g. [PHPMailer](/els-for-libraries/phpmailer/)), download the published package archive from your Nexus `els_php` account, or use the copy Composer caches under `~/.composer/cache/files/`. This example assumes `phpmailer-5.2.28-p1+tuxcare.zip` in the current directory. 2. **Download the matching signature** ```text curl -u "${USERNAME}:${PASSWORD}" -fsSL \ https://nexus.repo.tuxcare.com/repository/els-php-signatures/phpmailer/phpmailer/5.2.28-p1+tuxcare/phpmailer-5.2.28-p1+tuxcare.zip.asc \ -o phpmailer-5.2.28-p1+tuxcare.zip.asc ``` 3. **Verify the signature against the artifact** ```text gpg --verify phpmailer-5.2.28-p1+tuxcare.zip.asc phpmailer-5.2.28-p1+tuxcare.zip ``` A `Good signature` line confirms authenticity and integrity. `BAD signature`, or a missing public key, is an integrity violation — stop and re-obtain the package from TuxCare over a trusted channel. 1. **Obtain the exact published artifact** With your TuxCare NuGet source configured (see the [.NET libraries](/els-for-libraries/dotnet/) setup), download the published `.nupkg`: ```text nuget install Newtonsoft.Json -Version 12.0.4-tuxcare.1 -DependencyVersion Ignore -OutputDirectory . ``` The package is written to `./Newtonsoft.Json.12.0.4-tuxcare.1/`; copy the `.nupkg` from there for verification. 2. **Download the matching signature** ```text curl -u "${USERNAME}:${PASSWORD}" -fsSL \ https://nexus.repo.tuxcare.com/repository/els-dotnet-signatures/newtonsoft.json/12.0.4-tuxcare.1/newtonsoft.json.12.0.4-tuxcare.1.nupkg.asc \ -o newtonsoft.json.12.0.4-tuxcare.1.nupkg.asc ``` 3. **Verify the signature against the artifact** ```text gpg --verify newtonsoft.json.12.0.4-tuxcare.1.nupkg.asc newtonsoft.json.12.0.4-tuxcare.1.nupkg ``` A `Good signature` line confirms authenticity and integrity. `BAD signature`, or a missing public key, is an integrity violation — stop and re-obtain the package from TuxCare over a trusted channel. If `gpg` reports `BAD signature`, or cannot find the matching public key, treat the artifact as an integrity violation: stop the installation and re-obtain the package and signature from TuxCare over a trusted channel. All ELS for Libraries ecosystems are signed the same way. If you need a signatures-repository path or the TuxCare public key, contact [sales@tuxcare.com](mailto:sales@tuxcare.com). ## Integrity Violation Events An **integrity violation** is any event where an artifact obtained from TuxCare — or the channel it was retrieved over — fails a verification check, indicating the package may not be authentic or may have been altered in transit. The package manager already **blocks** such an operation (the install or update stops), but by default the only trace is the command's exit code and whatever scrolled past in the terminal. To align with the EU Cyber Resilience Act (CRA), these events should be treated as security-relevant and retained in a dedicated log so a system administrator can review them regardless of when or how the update was triggered. ### What Counts as an Integrity Violation The ELS for Libraries delivery model is a set of per-ecosystem registries hosted on TuxCare Nexus (an npm registry for JavaScript, a PyPI-compatible index for Python, a Maven repository for Java, a Composer repository for PHP, and a NuGet feed for .NET), served exclusively over HTTPS, plus a detached GPG signature published alongside each artifact. Select your ecosystem for the integrity checks — and therefore the violation types — that apply to it: | Event | What it means | How it surfaces | |---|---|---| | **GPG signature failure** | The detached `.asc` signature does not match the artifact, or the artifact was not signed by TuxCare's key. | `gpg --verify` reports `BAD signature` or `No public key` — see [Verify a Package](#verify-a-package) above. | | **Checksum / integrity-hash mismatch** | The downloaded artifact's checksum does not match the `.sha1`/`.sha256` published next to it — the bytes changed in transit or the artifact was substituted. | **Maven**, run with strict checksums (`mvn -C`), fails with `Checksum validation failed`. **Gradle**, with dependency verification enabled, fails with `Dependency verification failed`. | | **HTTPS / TLS certificate error** | The TLS certificate presented by `nexus.repo.tuxcare.com` cannot be validated, so the transport itself cannot be trusted. | Maven/Gradle fail with `PKIX path building failed` / `unable to find valid certification path`. | | Event | What it means | How it surfaces | |---|---|---| | **GPG signature failure** | The detached `.asc` signature does not match the artifact, or the artifact was not signed by TuxCare's key. | `gpg --verify` reports `BAD signature` or `No public key` — see [Verify a Package](#verify-a-package) above. | | **Checksum / integrity-hash mismatch** | The downloaded tarball's hash does not match the integrity value recorded in `package-lock.json` — the bytes changed in transit or the artifact was substituted. | `npm` aborts the install with `EINTEGRITY` (`sha512-… integrity checksum failed`). | | **HTTPS / TLS certificate error** | The TLS certificate presented by `nexus.repo.tuxcare.com` cannot be validated, so the transport itself cannot be trusted. | `npm` fails with `UNABLE_TO_VERIFY_LEAF_SIGNATURE` / `SELF_SIGNED_CERT_IN_CHAIN`. | | Event | What it means | How it surfaces | |---|---|---| | **GPG signature failure** | The detached `.asc` signature does not match the artifact, or the artifact was not signed by TuxCare's key. | `gpg --verify` reports `BAD signature` or `No public key` — see [Verify a Package](#verify-a-package) above. | | **Checksum / integrity-hash mismatch** | The downloaded artifact's hash does not match the hash pinned for it — the bytes changed in transit or the artifact was substituted. | `pip`, when run in hash-checking mode (`--require-hashes`), aborts with `THESE PACKAGES DO NOT MATCH THE HASHES…`. | | **HTTPS / TLS certificate error** | The TLS certificate presented by `nexus.repo.tuxcare.com` cannot be validated, so the transport itself cannot be trusted. | `pip` fails with `SSLError` / `CERTIFICATE_VERIFY_FAILED`. | | Event | What it means | How it surfaces | |---|---|---| | **GPG signature failure** | The detached `.asc` signature does not match the artifact, or the artifact was not signed by TuxCare's key. | `gpg --verify` reports `BAD signature` or `No public key` — see [Verify a Package](#verify-a-package) above. | | **Checksum / integrity-hash mismatch** | The downloaded package archive's hash does not match the `dist.shasum` recorded in `composer.lock` — the bytes changed in transit or the artifact was substituted. | **Composer** aborts with `The checksum verification of the file failed`. | | **HTTPS / TLS certificate error** | The TLS certificate presented by `nexus.repo.tuxcare.com` cannot be validated, so the transport itself cannot be trusted. | **Composer**, with `secure-http` enabled (the default), fails with `curl error 60` / `SSL certificate problem`. | | Event | What it means | How it surfaces | |---|---|---| | **GPG signature failure** | The detached `.asc` signature does not match the artifact, or the artifact was not signed by TuxCare's key. | `gpg --verify` reports `BAD signature` or `No public key` — see [Verify a Package](#verify-a-package) above. | | **Checksum / integrity-hash mismatch** | The restored package's content hash does not match the value recorded in `packages.lock.json` — the bytes changed in transit or the artifact was substituted. | **NuGet** (`dotnet restore --locked-mode`) fails with `NU1403` (`Package content hash validation failed`). | | **HTTPS / TLS certificate error** | The TLS certificate presented by `nexus.repo.tuxcare.com` cannot be validated, so the transport itself cannot be trusted. | `dotnet restore` fails with `The SSL connection could not be established` / `The remote certificate is invalid`. | **Metadata signature mismatch** is an OS-package-manager concept (yum/dnf and apt verify a GPG signature over the *repository metadata index* — `repomd.xml`, `InRelease`). The language registries used by ELS for Libraries — npm, pip, Maven, Composer, and NuGet — do not distribute a separately signed metadata index, so this specific violation type does not map to the setup. The equivalent authenticity and integrity guarantee is provided **per artifact** by the checksum/integrity-hash check and the detached GPG signature listed above. ### Capturing Integrity Violations in a Dedicated Log Because these checks run inside the package manager (`npm`, `pip`, `mvn`, `composer`, `dotnet`) or `gpg`, their outcome lives only in the command's exit code and console output. To retain violations for later review — as CRA expects — run the install or verification inside a wrapper that writes the result to a dedicated log, separate from ordinary build output. Doing this in a CI job or an install/deploy script guarantees the event is captured no matter who triggered the update or whether anyone was watching the terminal. `mvn -C` (`--strict-checksums`) makes a checksum mismatch fail the build; TLS to Nexus is always enforced. A failure is written to a dedicated log file and to the system journal. (For Gradle, enable dependency verification and run `./gradlew build` in place of the Maven command.) ```bash #!/usr/bin/env bash set -o pipefail LOG=/var/log/tuxcare-integrity.log if mvn -C clean install; then logger -t tuxcare-integrity -p authpriv.info "OK: mvn build" else rc=$? msg="INTEGRITY VIOLATION: mvn build (exit ${rc})" echo "$(date -u +%FT%TZ) ${msg}" | tee -a "$LOG" logger -t tuxcare-integrity -p authpriv.err "${msg}" exit 1 fi ``` `npm ci` enforces the `package-lock.json` integrity hashes (checksum check) and TLS on every download; the on-demand `gpg --verify` adds signature verification. A non-zero exit from either is written to a dedicated log file and to the system journal under a distinct tag. ```bash #!/usr/bin/env bash set -o pipefail LOG=/var/log/tuxcare-integrity.log run() { # $1 = event label, remaining args = the command to check local label="$1"; shift if "$@"; then logger -t tuxcare-integrity -p authpriv.info "OK: ${label}" else local rc=$? local msg="INTEGRITY VIOLATION: ${label} (exit ${rc})" echo "$(date -u +%FT%TZ) ${msg}" | tee -a "$LOG" logger -t tuxcare-integrity -p authpriv.err "${msg}" exit 1 fi } # Checksum (EINTEGRITY) and TLS are enforced by this install: run "npm ci" npm ci # On-demand GPG check of a pulled artifact: run "gpg verify @els-js/angular@1.8.3-tuxcare.8" \ gpg --verify angular-1.8.3-tuxcare.8.tgz.asc els-js-angular-1.8.3-tuxcare.8.tgz ``` `--require-hashes` turns on pip's checksum verification against the hashes pinned in `requirements.txt`; TLS to the Nexus index is always enforced. A failure is written to a dedicated log file and to the system journal. ```bash #!/usr/bin/env bash set -o pipefail LOG=/var/log/tuxcare-integrity.log if pip install --require-hashes -r requirements.txt; then logger -t tuxcare-integrity -p authpriv.info "OK: pip install" else rc=$? msg="INTEGRITY VIOLATION: pip install (exit ${rc})" echo "$(date -u +%FT%TZ) ${msg}" | tee -a "$LOG" logger -t tuxcare-integrity -p authpriv.err "${msg}" exit 1 fi ``` Composer verifies each downloaded package against the `dist.shasum` in `composer.lock` (checksum check), and `secure-http` (HTTPS-only) is enabled by default. A failure is written to a dedicated log file and to the system journal. ```bash #!/usr/bin/env bash set -o pipefail LOG=/var/log/tuxcare-integrity.log if composer install; then logger -t tuxcare-integrity -p authpriv.info "OK: composer install" else rc=$? msg="INTEGRITY VIOLATION: composer install (exit ${rc})" echo "$(date -u +%FT%TZ) ${msg}" | tee -a "$LOG" logger -t tuxcare-integrity -p authpriv.err "${msg}" exit 1 fi ``` `dotnet restore --locked-mode` enforces the `packages.lock.json` content hashes (checksum check) and TLS on every download. A failure is written to a dedicated log file and to the system journal. ```bash #!/usr/bin/env bash set -o pipefail LOG=/var/log/tuxcare-integrity.log if dotnet restore --locked-mode; then logger -t tuxcare-integrity -p authpriv.info "OK: dotnet restore" else rc=$? msg="INTEGRITY VIOLATION: dotnet restore (exit ${rc})" echo "$(date -u +%FT%TZ) ${msg}" | tee -a "$LOG" logger -t tuxcare-integrity -p authpriv.err "${msg}" exit 1 fi ``` `logger` hands the event to journald/rsyslog under the `tuxcare-integrity` tag. To route these events into their own file, add an rsyslog rule: ```text # /etc/rsyslog.d/30-tuxcare-integrity.conf :programname, isequal, "tuxcare-integrity" /var/log/tuxcare-integrity.log & stop ``` Reload rsyslog afterwards (`systemctl restart rsyslog`). To review the captured events through journald instead of a file: ```text journalctl -t tuxcare-integrity ``` Forward `/var/log/tuxcare-integrity.log` (or the `tuxcare-integrity` journald tag) to your central log collector or SIEM so integrity violations are alerted on and retained under your standard log-retention policy. ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/managing-els-repository/ ================================================================================ # Managing the ELS repository This page provides instructions for upgrading to newer TuxCare package versions, accessing source code for ELS-patched libraries, and managing the TuxCare NuGet source for .NET projects. ## How to Upgrade to a Newer Version If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.3`), update the version string in your Maven or Gradle build file with the version listed in your TuxCare Nexus account. If you have already installed a TuxCare-patched package and want to upgrade to a newer release, update the version string in your `composer.json` file or run the `composer require` command with the new version. 1. Update the required version Replace `VENDOR/PACKAGE` with the package name and `VERSION-pN+tuxcare` with the version listed in your TuxCare Nexus account: ```text composer require VENDOR/PACKAGE:VERSION-pN+tuxcare ``` 2. Apply the changes Run `composer update` to resolve dependencies and install the new release: ```text composer update ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** To upgrade to a newer TuxCare release (for example, from `version.post1+tuxcare` to `version.post2+tuxcare`), use the same installation method you used during setup and specify the newer package version listed in your TuxCare Nexus account. To upgrade to a newer TuxCare release (for example, from `tuxcare.1` to `tuxcare.3`), remove `node_modules`, clear the npm cache to avoid conflicts, and then run the installation command: ```text rm -rf node_modules package-lock.json && npm cache clean --force npm install ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** To upgrade to a newer TuxCare release, update the package in your project: ```text dotnet add package --version ``` Then rebuild the project to verify the upgrade: ```text dotnet build ``` ## Source code Source code is available for TuxCare-patched **Java** libraries. Source JARs follow the standard Maven naming convention with a `-sources` classifier and are published to the [Nexus repository](https://nexus.repo.tuxcare.com/#browse/browse:els_java). For example: [https://nexus.repo.tuxcare.com/repository/els_java/commons-lang/commons-lang/2.6-tuxcare.1/commons-lang-2.6-tuxcare.1-sources.jar](https://nexus.repo.tuxcare.com/repository/els_java/commons-lang/commons-lang/2.6-tuxcare.1/commons-lang-2.6-tuxcare.1-sources.jar). If a source JAR is not available for a specific package, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). The TuxCare NuGet source is configured per-project in `nuget.config`. Use the `dotnet` CLI or edit `nuget.config` directly to manage it. Replace `` with your customer repository name. * **Add the TuxCare source** ```text dotnet nuget add source "https://nexus.repo.tuxcare.com/repository//index.json" \ --name TuxCare \ --username USERNAME \ --password PASSWORD ``` * **List configured sources** ```text dotnet nuget list source ``` Example output: ```text Registered Sources: 1. TuxCare [Enabled] https://nexus.repo.tuxcare.com/repository//index.json 2. nuget [Enabled] https://api.nuget.org/v3/index.json ``` * **Update source credentials** ```text dotnet nuget remove source TuxCare dotnet nuget add source "https://nexus.repo.tuxcare.com/repository//index.json" ` --name TuxCare ` --username ` --password ``` * **Remove the source** ```text dotnet nuget remove source TuxCare ``` * **Route specific packages to TuxCare (Package Source Mapping)** If you use a `nuget.config` file, you can add package source mapping to route specific packages to the TuxCare feed. This ensures certain packages are always fetched from TuxCare while others come from NuGet.org. Add a `` section inside `` in your `nuget.config`. For example, to route Newtonsoft.Json to TuxCare: Snippet to Add: ``` ``` Full nuget.config: ```                                                                                                 ``` ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/mongodb-driver/ ================================================================================ # MongoDB Driver Endless Lifecycle Support (ELS) for MongoDB driver from TuxCare provides security fixes for MongoDB driver versions that have reached their end of life. This allows you to continue running MongoDB applications without vulnerability concerns, even after official support has ended. ## Supported MongoDB Driver Versions * MongoDB Driver 2.2.36 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your MongoDB Driver project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-mongodb-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace MongoDB driver dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your MongoDB driver dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "mongodb": "npm:@els-js/mongodb@>=2.2.36-tuxcare.1" }, "overrides": { "mongodb@2.2.36": "npm:@els-js/mongodb@>=2.2.36-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the MongoDB driver version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "mongodb": "^2.2.36" } ``` to: ```text "dependencies": { "mongodb": "npm:@els-js/mongodb@>=2.2.36-tuxcare.1" }, "overrides": { "mongodb@2.2.36": "npm:@els-js/mongodb@>=2.2.36-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for MongoDB repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=mongodb-driver) — Track vulnerability fixes and updates * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/mongodb/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:mongodb-driver) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/mongoose/ ================================================================================ # Mongoose Endless Lifecycle Support (ELS) for Mongoose from TuxCare provides security fixes for Mongoose versions that have reached their end of life. This allows you to continue running Mongoose applications without vulnerability concerns, even after official support has ended. ## Supported Mongoose Versions * Mongoose 5.13.23, 6.12.2, 7.8.8 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Mongoose project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-mongoose-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Mongoose dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Mongoose dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "mongoose": "npm:@els-js/mongoose@>=5.13.23-tuxcare.1" }, "overrides": { "mongoose@5.13.23": "npm:@els-js/mongoose@>=5.13.23-tuxcare.1" } ``` ```text "dependencies": { "mongoose": "npm:@els-js/mongoose@>=6.12.2-tuxcare.1" }, "overrides": { "mongoose@6.12.2": "npm:@els-js/mongoose@>=6.12.2-tuxcare.1" } ``` ```text "dependencies": { "mongoose": "npm:@els-js/mongoose@>=7.8.8-tuxcare.1" }, "overrides": { "mongoose@7.8.8": "npm:@els-js/mongoose@>=7.8.8-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Mongoose version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "mongoose": "^5.13.23" } ``` to: ```text "dependencies": { "mongoose": "npm:@els-js/mongoose@>=5.13.23-tuxcare.1" }, "overrides": { "mongoose@5.13.23": "npm:@els-js/mongoose@>=5.13.23-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Mongoose repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=mongoose) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=mongoose) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/mongoose/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:mongoose) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/monolog/ ================================================================================ # Monolog Endless Lifecycle Support (ELS) for Monolog from TuxCare provides security fixes for Monolog versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Monolog** 1.11.0 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Monolog Install the TuxCare-maintained Monolog release that matches your project: Composer CLI: ``` composer require monolog/monolog:1.11.0-p1+tuxcare ``` composer.json: ``` { "require": { "monolog/monolog": "1.11.0-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=monolog%2Fmonolog) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=monolog%2Fmonolog) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/monolog/monolog/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/mysql2/ ================================================================================ # MySQL2 Endless Lifecycle Support (ELS) for MySQL2 from TuxCare provides security fixes for MySQL2 versions that have reached their end of life. This allows you to continue running MySQL2 applications without vulnerability concerns, even after official support has ended. ## Supported MySQL2 Versions * MySQL2 2.3.3 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your MySQL2 project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-mysql2-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace MySQL2 dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your MySQL2 dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "mysql2": "npm:@els-js/mysql2@>=2.3.3-tuxcare.1" }, "overrides": { "mysql2@2.3.3": "npm:@els-js/mysql2@>=2.3.3-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the MySQL2 version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "mysql2": "^2.3.3" } ``` to: ```text "dependencies": { "mysql2": "npm:@els-js/mysql2@>=2.3.3-tuxcare.1" }, "overrides": { "mysql2@2.3.3": "npm:@els-js/mysql2@>=2.3.3-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for MySQL2 repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=mysql2) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=mysql2) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/mysql2/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:mysql2) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/next/ ================================================================================ # Next.js Endless Lifecycle Support (ELS) for Next.js from TuxCare provides security fixes for Next.js versions that have reached their end of life. This allows you to continue running Next.js applications without vulnerability concerns, even after official support has ended. ## Supported Next.js Versions * Next.js 12.3.7, 13.5.11, 14.2.35, 16.0.6 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Next.js project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-nextjs-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Next.js dependencies with TuxCare-maintained packages. Choose your Next.js version below and add the `dependencies` and `overrides` entries shown. ```text "dependencies": { "next": "npm:@els-js/next@>=12.3.7-tuxcare.1" }, "overrides": { "next@12.3.7": "npm:@els-js/next@>=12.3.7-tuxcare.1" } ``` ```text "dependencies": { "next": "npm:@els-js/next@>=13.5.11-tuxcare.1" }, "overrides": { "next@13.5.11": "npm:@els-js/next@>=13.5.11-tuxcare.1" } ``` ```text "dependencies": { "next": "npm:@els-js/next@>=14.2.35-tuxcare.1" }, "overrides": { "next@14.2.35": "npm:@els-js/next@>=14.2.35-tuxcare.1" } ``` ```text "dependencies": { "next": "npm:@els-js/next@>=16.0.6-tuxcare.1" }, "overrides": { "next@16.0.6": "npm:@els-js/next@>=16.0.6-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Next.js repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Next.js) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Next.js) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Next.js) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/next/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:next) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/node-fetch/ ================================================================================ # node-fetch Endless Lifecycle Support (ELS) for node-fetch from TuxCare provides security fixes for node-fetch versions that have reached their end of life. This allows you to continue running node-fetch applications without vulnerability concerns, even after official support has ended. ## Supported node-fetch Versions * node-fetch 1.6.3, 1.7.3, 2.6.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your node-fetch project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-node-fetch-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace node-fetch dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your node-fetch dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "node-fetch": "npm:@els-js/node-fetch@>=1.6.3-tuxcare.1" }, "overrides": { "node-fetch@1.6.3": "npm:@els-js/node-fetch@>=1.6.3-tuxcare.1" } ``` ```text "dependencies": { "node-fetch": "npm:@els-js/node-fetch@>=1.7.3-tuxcare.1" }, "overrides": { "node-fetch@1.7.3": "npm:@els-js/node-fetch@>=1.7.3-tuxcare.1" } ``` ```text "dependencies": { "node-fetch": "npm:@els-js/node-fetch@>=2.6.1-tuxcare.1" }, "overrides": { "node-fetch@2.6.1": "npm:@els-js/node-fetch@>=2.6.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the node-fetch version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "node-fetch": "^2.6.1" } ``` to: ```text "dependencies": { "node-fetch": "npm:@els-js/node-fetch@>=2.6.1-tuxcare.1" }, "overrides": { "node-fetch@2.6.1": "npm:@els-js/node-fetch@>=2.6.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for node-fetch repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=node-fetch) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=node-fetch) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/node-fetch/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:node-fetch) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/numpy/ ================================================================================ # NumPy Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for NumPy. This allows you to continue running your NumPy applications without vulnerability concerns, even after official support has ended. ## Supported NumPy Versions * **NumPy** 1.15.4, 1.16.0, 1.21.0 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple numpy ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade numpy ``` Or install a specific patched TuxCare version, for example: ```text pip install numpy==1.15.4.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install numpy==1.15.4.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=NumPy) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=NumPy) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=NumPy) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/numpy/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:numpy) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/nuxt/ ================================================================================ # Nuxt Endless Lifecycle Support (ELS) for Nuxt from TuxCare provides security fixes for Nuxt versions that have reached their end of life. This allows you to continue running Nuxt applications without vulnerability concerns, even after official support has ended. ## Supported Nuxt Versions * Nuxt 0.10.7, 1.4.5, 2.18.1, 3.2.0, 3.12.3, 3.12.4, 4.0.3 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Nuxt project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-nuxt-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to add the following overrides for the TuxCare packages: ```text "dependencies": { "nuxt": "npm:@els-js/nuxt@>=3.12.4-tuxcare.1" }, "overrides": { "nuxt@3.12.4": "npm:@els-js/nuxt@>=3.12.4-tuxcare.1" } ``` ```text "overrides": { "braces@2.3.2": "npm:@els-js/braces@>=2.3.2-tuxcare.1", "braces@3.0.3": "npm:@els-js/braces@>=3.0.3-tuxcare.1", "cookie@0.3.1": "npm:@els-js/cookie@>=0.3.1-tuxcare.1", "devalue@2.0.1": "npm:@els-js/devalue@>=2.0.1-tuxcare.1", "ip@2.0.1": "npm:@els-js/ip@>=2.0.1-tuxcare.1", "lodash.template@4.5.0": "npm:@els-js/lodash.template@>=4.5.0-tuxcare.1", "parse-git-config@3.0.0": "npm:@els-js/parse-git-config@>=3.0.0-tuxcare.1", "postcss@7.0.39": "npm:@els-js/postcss@>=7.0.39-tuxcare.1", "tmp@0.0.33": "npm:@els-js/tmp@>=0.0.33-tuxcare.1", "vue@2.7.16": "npm:@els-js/vue@>=2.7.16-tuxcare.1", "vue-template-compiler@2.7.16": "npm:@els-js/vue-template-compiler@>=2.7.16-tuxcare.1" } ``` ```text "dependencies": { "nuxt": "npm:@els-js/nuxt@>=1.4.5-tuxcare.1" }, "overrides": { "nuxt@1.4.5": "npm:@els-js/nuxt@>=1.4.5-tuxcare.1" } ``` ```text "overrides": { "ajv@4.11.8": "npm:@els-js/ajv@>=4.11.8-tuxcare.1", "ajv@6.14.0": "npm:@els-js/ajv@>=6.14.0-tuxcare.1", "color-string@0.3.0": "npm:@els-js/color-string@>=0.3.0-tuxcare.1", "deep-extend@0.4.2": "npm:@els-js/deep-extend@>=0.4.2-tuxcare.1", "is-svg@2.1.0": "npm:@els-js/is-svg@>=2.1.0-tuxcare.1", "js-yaml@3.7.0": "npm:@els-js/js-yaml@>=3.7.0-tuxcare.1", "mime@1.3.0": "npm:@els-js/mime@>=1.3.0-tuxcare.1", "postcss@5.2.18": "npm:@els-js/postcss@>=5.2.18-tuxcare.1", "serialize-javascript@1.9.1": "npm:@els-js/serialize-javascript@>=1.9.1-tuxcare.1", "ssri@5.3.0": "npm:@els-js/ssri@>=5.3.0-tuxcare.1", "webpack-dev-middleware@1.12.2": "npm:@els-js/webpack-dev-middleware@>=1.12.2-tuxcare.1", "webpack-dev-middleware@2.0.6": "npm:@els-js/webpack-dev-middleware@>=2.0.6-tuxcare.1", "ws@4.1.0": "npm:@els-js/ws@>=4.1.0-tuxcare.1", "yargs-parser@4.2.1": "npm:@els-js/yargs-parser@>=4.2.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Nuxt repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=nuxt) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=nuxt) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/nuxt/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:nuxt) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/passport/ ================================================================================ # passport Endless Lifecycle Support (ELS) for passport from TuxCare provides security fixes for passport versions that have reached their end of life. This allows you to continue running passport applications without vulnerability concerns, even after official support has ended. ## Supported passport Versions * passport 0.5.3 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your passport project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-passport-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace passport dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your passport dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "passport": "npm:@els-js/passport@>=0.5.3-tuxcare.1" }, "overrides": { "passport@0.5.3": "npm:@els-js/passport@>=0.5.3-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the passport version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "passport": "^0.5.3" } ``` to: ```text "dependencies": { "passport": "npm:@els-js/passport@>=0.5.3-tuxcare.1" }, "overrides": { "passport@0.5.3": "npm:@els-js/passport@>=0.5.3-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for passport repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=passport) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=passport) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/passport/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:passport) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/php-svg-lib/ ================================================================================ # php-svg-lib Endless Lifecycle Support (ELS) for php-svg-lib from TuxCare provides security fixes for php-svg-lib versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **php-svg-lib** 0.3.4 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install php-svg-lib Install the TuxCare-maintained php-svg-lib release that matches your project: Composer CLI: ``` composer require phenx/php-svg-lib:0.3.4-p1+tuxcare ``` composer.json: ``` { "require": { "phenx/php-svg-lib": "0.3.4-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=phenx%2Fphp-svg-lib) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=phenx%2Fphp-svg-lib) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/phenx/php-svg-lib/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/phpmailer/ ================================================================================ # PHPMailer Endless Lifecycle Support (ELS) for PHPMailer from TuxCare provides security fixes for PHPMailer library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **PHPMailer** 5.2.28 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install PHPMailer Install the TuxCare-maintained PHPMailer release that matches your project: Composer CLI: ``` composer require phpmailer/phpmailer:5.2.28-p1+tuxcare ``` composer.json: ``` { "require": { "phpmailer/phpmailer": "5.2.28-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=phpmailer%2Fphpmailer) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=phpmailer%2Fphpmailer) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/phpmailer/phpmailer/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/phpseclib/ ================================================================================ # phpseclib Endless Lifecycle Support (ELS) for phpseclib from TuxCare provides security fixes for phpseclib library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **phpseclib** 0.3.10 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install phpseclib Install the TuxCare-maintained phpseclib release that matches your project: Composer CLI: ``` composer require phpseclib/phpseclib:0.3.10-p1+tuxcare ``` composer.json: ``` { "require": { "phpseclib/phpseclib": "0.3.10-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=phpseclib%2Fphpseclib) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=phpseclib%2Fphpseclib) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/phpseclib/phpseclib/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/phpspreadsheet/ ================================================================================ # PhpSpreadsheet Endless Lifecycle Support (ELS) for PhpSpreadsheet from TuxCare provides security fixes for PhpSpreadsheet library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **PhpSpreadsheet** 4.5.0 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install PhpSpreadsheet Install the TuxCare-maintained PhpSpreadsheet release that matches your project: Composer CLI: ``` composer require phpoffice/phpspreadsheet:4.5.0-p1+tuxcare ``` composer.json: ``` { "require": { "phpoffice/phpspreadsheet": "4.5.0-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=phpoffice%2Fphpspreadsheet) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=phpoffice%2Fphpspreadsheet) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/phpoffice/phpspreadsheet/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/phpunit/ ================================================================================ # PHPUnit Endless Lifecycle Support (ELS) for PHPUnit from TuxCare provides security fixes for PHPUnit versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **PHPUnit** 4.8.10, 6.5.14, 7.5.20, 8.4.3, 9.5.28, 10.4.2, 11.4.4, 12.4.5 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install PHPUnit Install the TuxCare-maintained PHPUnit release that matches your project: Composer CLI: ``` composer require phpunit/phpunit:6.5.14-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "6.5.14-p1+tuxcare" } } ``` Composer CLI: ``` composer require phpunit/phpunit:7.5.20-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "7.5.20-p1+tuxcare" } } ``` Composer CLI: ``` composer require phpunit/phpunit:8.4.3-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "8.4.3-p1+tuxcare" } } ``` Composer CLI: ``` composer require phpunit/phpunit:9.5.28-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "9.5.28-p1+tuxcare" } } ``` Composer CLI: ``` composer require phpunit/phpunit:10.4.2-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "10.4.2-p1+tuxcare" } } ``` Composer CLI: ``` composer require phpunit/phpunit:11.4.4-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "11.4.4-p1+tuxcare" } } ``` Composer CLI: ``` composer require phpunit/phpunit:12.4.5-p1+tuxcare ``` composer.json: ``` { "require": { "phpunit/phpunit": "12.4.5-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=phpunit%2Fphpunit) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=phpunit%2Fphpunit) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/sebastianbergmann/phpunit/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/postcss/ ================================================================================ # PostCSS Endless Lifecycle Support (ELS) for PostCSS from TuxCare provides security fixes for PostCSS versions that have reached their end of life. This allows you to continue running PostCSS applications without vulnerability concerns, even after official support has ended. ## Supported PostCSS Versions * PostCSS 5.2.18, 6.0.23, 7.0.14, 7.0.17, 7.0.21, 7.0.32, 7.0.39, 8.2.15, 8.3.6, 8.4.5, 8.4.14, 8.4.31, 8.4.41, 8.5.6 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your PostCSS project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-postcss-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace PostCSS dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your PostCSS dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "postcss": "npm:@els-js/postcss@>=5.2.18-tuxcare.1" }, "overrides": { "postcss@5.2.18": "npm:@els-js/postcss@>=5.2.18-tuxcare.1" } ``` ```text "dependencies": { "postcss": "npm:@els-js/postcss@>=6.0.23-tuxcare.1" }, "overrides": { "postcss@6.0.23": "npm:@els-js/postcss@>=6.0.23-tuxcare.1" } ``` ```text "dependencies": { "postcss": "npm:@els-js/postcss@>=7.0.39-tuxcare.1" }, "overrides": { "postcss@7.0.39": "npm:@els-js/postcss@>=7.0.39-tuxcare.1" } ``` ```text "dependencies": { "postcss": "npm:@els-js/postcss@>=8.3.6-tuxcare.1" }, "overrides": { "postcss@8.3.6": "npm:@els-js/postcss@>=8.3.6-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the PostCSS version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "postcss": "^8.3.6" } ``` to: ```text "dependencies": { "postcss": "npm:@els-js/postcss@>=8.3.6-tuxcare.1" }, "overrides": { "postcss@8.3.6": "npm:@els-js/postcss@>=8.3.6-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for PostCSS repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=postcss) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=postcss) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/postcss/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:postcss) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/postgresql-driver/ ================================================================================ # PostgreSQL driver TuxCare's Endless Lifecycle Support (ELS) for PostgreSQL driver provides security patches and selected bug fixes that are integral to the stable operation of applications using the PostgreSQL driver. ## Supported Versions * PostgreSQL driver 42.2.16, 42.5.0 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare PostgreSQL driver repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official PostgreSQL driver repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace PostgreSQL driver dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.postgresql postgresql 42.5.0-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation 'org.postgresql:postgresql:42.5.0-tuxcare.1' } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for PostgreSQL driver repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=PostgreSQL+Driver) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=PostgreSQL+Driver) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=PostgreSQL+Driver) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/org.postgresql/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/protobuf/ ================================================================================ # Protobuf TuxCare's Endless Lifecycle Support (ELS) for Protobuf provides security patches, and selected bug fixes, that are integral to the stable operation of applications using Google Protocol Buffers. ## Supported Versions * Protobuf 2.5.0, 2.6.1, 3.21.9 ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (~/.m2/settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (~/.gradle/gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Protobuf repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } ``` * To fully switch from the official Protobuf repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/tree/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/tree/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Protobuf dependencies with TuxCare-maintained versions. You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` com.google.protobuf protobuf-java 2.5.0-tuxcare.1 ``` Gradle (build.gradle): ``` dependencies { implementation 'com.google.protobuf:protobuf-java:2.5.0-tuxcare.1' } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Protobuf repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Protocol+Buffers) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Protocol+Buffers) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Protocol+Buffers) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/com.google.protobuf/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/python-libraries/ ================================================================================ # Python Libraries Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for a variety of Python Libraries. This allows you to continue running your Python applications without vulnerability concerns, even after official support has ended. ## Supported Python Libraries * **aiohttp** 3.8.1, 3.8.4, 3.8.5, 3.8.6 * **apache-airflow-providers-http** 4.13.3 * **certifi** 2021.10.8, 2022.12.7, 2023.7.22 * **cryptography** 3.4.8, 41.0.7, 42.0.0, 42.0.8, 43.0.1, 43.0.3, 44.0.3, 45.0.7, 46.0.7 * **deepdiff** 6.2.3 * **dnspython** 2.3.0 * **dulwich** 0.25.2 * **fastmcp** 2.14.5, 2.14.7 * **flask-cors** 4.0.2 * **future** 1.0.0 * **GitPython** 3.1.31 * **gunicorn** 20.0.4, 20.1.0, 21.2.0, 22.0.0, 23.0.0 * **h11** 0.9.0 * **httpx** 0.22.0 * **idna** 2.1, 2.8, 2.10, 3.6 * **jaraco-context** 5.3.0 * **Jinja2** 2.11.3, 3.0.3 * **keras** 2.15.0 * **langchain-core** 0.3.83 * **langchain-text-splitters** 0.3.11 * **langgraph-checkpoint** 2.1.2 * **LightGBM** 3.3.5 * **lxml** 4.9.4, 5.4.0 * **MLflow** 2.9.1, 2.22.4 * **MySQL Connector/Python** 8.4.0 * **orjson** 3.8.5 * **pandas** 2.2.0, 2.2.2 * **paramiko** 3.0.0 * **pdfkit** 0.6.1 * **pip** 9.0 * **Pillow** 8.4.0, 9.4.0, 9.5.0, 10.4.0, 11.2.1, 11.3.0 * **protobuf** 3.17.0, 3.20.3, 4.24.3, 4.25.8 * **pyarrow** 12.0.1 * **pydantic** 1.10.5 * **PyJWT** 1.7.1, 2.3.0, 2.8.0, 2.10.1 * **pymongo** 3.13.0 * **pymysql** 0.10.1 * **pyOpenSSL** 23.3.0, 24.3.0, 25.3.0 * **pypdf** 5.9.0 * **pytest** 7.4.4, 8.4.2 * **python-jose** 3.3.0 * **python-multipart** 0.0.6 * **PyYAML** 3.13, 5.3.1 * **redis-py** 4.5.1 * **requests** 2.25.1, 2.30.0, 2.31.0, 2.32.3 * **scikit-learn** 1.0.2 * **setuptools** 59.8.0, 65.5.1, 68.0.0, 70.3.0, 75.0.0, 75.8.0 * **torch** 1.13.1 * **tornado** 5.1.1, 6.1.0 * **tqdm** 4.66.1 * **transformers** 4.57.6 * **twisted** 20.3.0 * **urllib3** 1.25.11, 1.26.4, 1.26.20, 2.0.7 * **uvicorn** 0.11.6 * **waitress** 2.1.2 * **websockets** 8.1 Other libraries upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above), and `` with the Python package name (e.g., `certifi`). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version. Replace `` with the Python package name (e.g., `certifi`): ```text pip install --upgrade ``` Or install a specific patched TuxCare version, for example: ```text pip install certifi==2021.10.8.post2+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install certifi==2021.10.8.post2+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/ratchet/ ================================================================================ # Ratchet Endless Lifecycle Support (ELS) for Ratchet from TuxCare provides security fixes for Ratchet (a PHP WebSocket server) versions that have reached their end of life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Ratchet** 0.3.6 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Ratchet Install the TuxCare-maintained Ratchet release that matches your project: Composer CLI: ``` composer require cboden/ratchet:0.3.6-p3+tuxcare ``` composer.json: ``` { "require": { "cboden/ratchet": "0.3.6-p3+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=cboden%2Fratchet) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=cboden%2Fratchet) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/cboden/ratchet/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/react-pdf/ ================================================================================ # react-pdf Endless Lifecycle Support (ELS) for react-pdf from TuxCare provides security fixes for react-pdf versions that have reached their end of life. This allows you to continue running react-pdf applications without vulnerability concerns, even after official support has ended. ## Supported react-pdf Versions * react-pdf 7.7.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your react-pdf project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-react-pdf-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace react-pdf dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your react-pdf dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "react-pdf": "npm:@els-js/react-pdf@>=7.7.1-tuxcare.1" }, "overrides": { "react-pdf@7.7.1": "npm:@els-js/react-pdf@>=7.7.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the react-pdf version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "react-pdf": "^7.7.1" } ``` to: ```text "dependencies": { "react-pdf": "npm:@els-js/react-pdf@>=7.7.1-tuxcare.1" }, "overrides": { "react-pdf@7.7.1": "npm:@els-js/react-pdf@>=7.7.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for react-pdf repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=react-pdf) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=react-pdf) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/react-pdf/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:react-pdf) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/react-router/ ================================================================================ # react-router Endless Lifecycle Support (ELS) for react-router from TuxCare provides security fixes for react-router versions that have reached their end of life. This allows you to continue running react-router applications without vulnerability concerns, even after official support has ended. ## Supported react-router Versions * react-router 6.3.0, 7.5.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your react-router project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-react-router-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace react-router dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your react-router dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "react-router": "npm:@els-js/react-router@>=6.3.0-tuxcare.1" }, "overrides": { "react-router@6.3.0": "npm:@els-js/react-router@>=6.3.0-tuxcare.1" } ``` ```text "dependencies": { "react-router": "npm:@els-js/react-router@>=7.5.1-tuxcare.1" }, "overrides": { "react-router@7.5.1": "npm:@els-js/react-router@>=7.5.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the react-router version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "react-router": "^7.5.1" } ``` to: ```text "dependencies": { "react-router": "npm:@els-js/react-router@>=7.5.1-tuxcare.1" }, "overrides": { "react-router@7.5.1": "npm:@els-js/react-router@>=7.5.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for react-router repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=react-router) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=react-router) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?q=react-router) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/react-router/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:react-router) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/react/ ================================================================================ # React Endless Lifecycle Support (ELS) for React from TuxCare provides security fixes for React versions that have reached their end of life. This allows you to continue running React applications without vulnerability concerns, even after official support has ended. ## Supported React Versions * React 15.6.2, 16.4.1, 19.2.0 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your React project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-react-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace React dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your React dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "react": "npm:@els-js/react@>=15.6.2-tuxcare.1", "react-dom": "npm:@els-js/react-dom@>=15.6.2-tuxcare.1" }, "overrides": { "react@15.6.2": "npm:@els-js/react@>=15.6.2-tuxcare.1", "react-dom@15.6.2": "npm:@els-js/react-dom@>=15.6.2-tuxcare.1" } ``` ```text "dependencies": { "react": "npm:@els-js/react@>=16.4.1-tuxcare.1", "react-dom": "npm:@els-js/react-dom@>=16.4.1-tuxcare.1" }, "overrides": { "react@16.4.1": "npm:@els-js/react@>=16.4.1-tuxcare.1", "react-dom@16.4.1": "npm:@els-js/react-dom@>=16.4.1-tuxcare.1" } ``` ```text "dependencies": { "react": "npm:@els-js/react@>=19.2.0-tuxcare.1", "react-dom": "npm:@els-js/react-dom@>=19.2.0-tuxcare.1" }, "overrides": { "react@19.2.0": "npm:@els-js/react@>=19.2.0-tuxcare.1", "react-dom@19.2.0": "npm:@els-js/react-dom@>=19.2.0-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the React version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "react": "^19.2.0" } ``` to: ```text "dependencies": { "react": "npm:@els-js/react@>=19.2.0-tuxcare.1" }, "overrides": { "react@19.2.0": "npm:@els-js/react@>=19.2.0-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for React repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=React) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=React) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=React) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/react/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:react) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/requirejs/ ================================================================================ # RequireJS Endless Lifecycle Support (ELS) for RequireJS from TuxCare provides security fixes for RequireJS versions that have reached their end of life. This allows you to continue running RequireJS applications without vulnerability concerns, even after official support has ended. ## Supported RequireJS Versions * RequireJS 2.1.22, 2.3.6 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your RequireJS project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-requirejs-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace RequireJS dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your RequireJS dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "requirejs": "npm:@els-js/requirejs@>=2.1.22-tuxcare.1" }, "overrides": { "requirejs@2.1.22": "npm:@els-js/requirejs@>=2.1.22-tuxcare.1" } ``` ```text "dependencies": { "requirejs": "npm:@els-js/requirejs@>=2.3.6-tuxcare.1" }, "overrides": { "requirejs@2.3.6": "npm:@els-js/requirejs@>=2.3.6-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the RequireJS version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "requirejs": "^2.3.6" } ``` to: ```text "dependencies": { "requirejs": "npm:@els-js/requirejs@>=2.3.6-tuxcare.1" }, "overrides": { "requirejs@2.3.6": "npm:@els-js/requirejs@>=2.3.6-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for RequireJS repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=requirejs) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=requirejs) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/requirejs/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:requirejs) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/saloon/ ================================================================================ # Saloon Endless Lifecycle Support (ELS) for Saloon from TuxCare provides security fixes for Saloon library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Saloon** 3.15.0 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Saloon Install the TuxCare-maintained Saloon release that matches your project: Composer CLI: ``` composer require saloonphp/saloon:3.15.0-p1+tuxcare ``` composer.json: ``` { "require": { "saloonphp/saloon": "3.15.0-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=saloonphp%2Fsaloon) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=saloonphp%2Fsaloon) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/saloonphp/saloon/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/spring/ ================================================================================ # Spring® Spring® is a trademark of Broadcom Inc. and/or its subsidiaries.
TuxCare's Endless Lifecycle Support (ELS) for Spring® provides security updates, system enhancement patches, and selected bug fixes that are integral to the stable operation of applications running on these versions of Spring® ecosystem components. These components have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS for Spring® service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their legacy Spring® applications. ELS for Spring® also patches transitive dependencies at no extra cost, including Hibernate, Netty, Jackson Databind, SnakeYAML, Apache Kafka, Apache Velocity, and more. See the [full list of supported Java libraries](/els-for-libraries/java-libraries/). ### Supported Modules and Versions | Module | Version | |---|---| | spring-core | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.1.7.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.2.13.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.37, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-jcl | 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-context | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.2.13.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.37, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-beans | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.1.7.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.2.13.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.37, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-expression | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-jms | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-messaging | 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-aop | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-context-support | 3.1.1.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-tx | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-orm | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-aspects | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-r2dbc | 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-jdbc | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-web | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.2.13.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.37, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-webmvc | 3.1.1.RELEASE, 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-oxm | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-webflux | 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-websocket | 4.0.0.RELEASE, 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-framework-bom | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.21 | | spring-context-indexer | 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-instrument | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-test | 4.3.30.RELEASE, 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31, 5.3.39, 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-core-test | 6.0.16, 6.0.23, 6.1.20, 6.1.21 | | spring-webmvc-portlet | 4.3.30.RELEASE | | spring-instrument-tomcat | 4.3.30.RELEASE | | spring | 5.2.0.RELEASE, 5.3.27, 5.3.29, 5.3.30, 5.3.31 | | framework-docs | 6.0.16, 6.1.21 | | Module | Version | |---|---| | spring-amqp | 2.4.17 | | spring-rabbit | 2.4.17 | | spring-rabbit-junit | 2.4.17 | | spring-rabbit-test | 2.4.17 | | spring-rabbit-stream | 2.4.17 | | spring-amqp-dist | 2.4.17 | | Module | Version | |---|---| | spring-batch-core | 4.3.10 | | spring-batch-infrastructure | 4.3.10 | | spring-batch-integration | 4.3.10 | | spring-batch-test | 4.3.10 | | spring-batch-core-tests | 4.3.10 | | spring-batch-infrastructure-tests | 4.3.10 | | spring-batch-samples | 4.3.10 | | spring-batch-docs | 4.3.10 | | Module | Version | |---|---| | spring-boot | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-actuator | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-actuator-autoconfigure | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-autoconfigure | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-amqp | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-json | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-logging | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-reactor-netty | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-rsocket | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-tomcat | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-validation | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-web | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-webflux | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-autoconfigure-processor | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-configuration-processor | 2.4.5, 2.4.6, 2.6.15, 2.7.18, 3.1.8 | | spring-boot-starter-test | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-test-autoconfigure | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-mongodb-reactive | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-graphql | 2.7.18, 3.1.8 | | spring-boot-cli | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-dependencies | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-devtools | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-parent | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-properties-migrator | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-activemq | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-actuator | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-aop | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-artemis | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-batch | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-cache | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-cassandra | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-cassandra-reactive | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-couchbase | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-couchbase-reactive | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-elasticsearch | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-jdbc | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-jpa | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-ldap | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-mongodb | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-neo4j | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-r2dbc | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-redis | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-rest | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-freemarker | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-groovy-templates | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-hateoas | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-integration | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-jdbc | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-jersey | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-jetty | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-jooq | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-jta-atomikos | 2.4.5, 2.4.6, 2.7.18 | | spring-boot-starter-log4j2 | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-mail | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-mustache | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-oauth2-client | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-oauth2-resource-server | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-parent | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-quartz | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-security | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-thymeleaf | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-undertow | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-web-services | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-websocket | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-antlib | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-buildpack-platform | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-configuration-metadata | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-gradle-plugin | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-jarmode-layertools | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-loader | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-loader-tools | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-maven-plugin | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-redis-reactive | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-test | 2.4.5, 2.4.6, 2.7.18, 3.1.8 | | spring-boot-starter-data-solr | 2.4.5, 2.4.6 | | org.springframework.boot.gradle.plugin | 2.4.5, 2.4.6, 3.1.8 | | spring-boot-starter-jta-bitronix | 2.4.5, 2.4.6 | | Module | Version | |---|---| | spring-cloud-build | 3.1.9 | | spring-cloud-build-dependencies | 3.1.9 | | spring-cloud-build-tools | 3.1.9 | | spring-cloud-build-docs | 3.1.9 | | spring-cloud-dependencies-parent | 3.1.9 | | spring-cloud-gateway | 3.1.9 | | spring-cloud-gateway-dependencies | 3.1.9 | | spring-cloud-gateway-server | 3.1.9 | | spring-cloud-gateway-webflux | 3.1.9 | | spring-cloud-gateway-mvc | 3.1.9 | | spring-cloud-gateway-docs | 3.1.9 | | spring-cloud-starter-gateway | 3.1.9 | | Module | Version | |---|---| | spring-data-bom | 2021.2.18 | | spring-data-build | 2.7.18 | | spring-data-build-resources | 2.7.18 | | spring-data-parent | 2.7.18 | | spring-data-commons | 2.7.18 | | spring-data-jpa | 2.7.18 | | spring-data-keyvalue | 2.7.18 | | spring-data-ldap | 2.7.18 | | spring-data-redis | 2.7.18 | | spring-data-cassandra-parent | 3.4.18 | | spring-data-cassandra | 3.4.18 | | spring-data-cassandra-distribution | 3.4.18 | | spring-data-mongodb | 3.4.18 | | spring-data-mongodb-distribution | 3.4.18 | | spring-data-mongodb-parent | 3.4.18 | | spring-data-rest-webmvc | 3.7.18 | | spring-data-rest-core | 3.7.18 | | spring-data-rest-distribution | 3.7.18 | | spring-data-rest-hal-explorer | 3.7.18 | | spring-data-rest-parent | 3.7.18 | | spring-data-couchbase | 4.4.18 | | spring-data-elasticsearch | 4.4.18 | | spring-data-neo4j | 6.3.18 | | spring-data-r2dbc | 1.5.18 | | spring-data-relational | 2.4.18 | | spring-data-relational-parent | 2.4.18 | | spring-data-jdbc | 2.4.18 | | spring-data-jdbc-distribution | 2.4.18 | | Module | Version | |---|---| | spring-security | 5.7.11, 5.7.12, 5.7.14, 5.8.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-bom | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-core | 4.2.20.RELEASE, 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-config | 4.2.20.RELEASE, 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-web | 4.2.20.RELEASE, 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-crypto | 4.2.20.RELEASE, 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-data | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-ldap | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-messaging | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-oauth2-client | 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-oauth2-core | 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-oauth2-jose | 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-oauth2-resource-server | 5.7.11, 5.7.12, 5.7.14, 5.8.15, 5.8.16, 6.1.6 | | spring-security-rsocket | 5.8.15, 5.8.16, 6.1.6 | | spring-security-saml2-service-provider | 5.8.15, 5.8.16, 6.1.6 | | spring-security-test | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-acl | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-aspects | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-cas | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-remoting | 4.2.20.RELEASE, 5.8.15, 5.8.16 | | spring-security-taglibs | 4.2.20.RELEASE, 5.8.15, 5.8.16, 6.1.6 | | spring-security-openid | 4.2.20.RELEASE, 5.8.15, 5.8.16 | | Module | Version | |---|---| | spring-security-jwt | 1.1.1.RELEASE | | Module | Version | |---|---| | spring-ws-core | 3.1.8 | | spring-xml | 3.1.8 | | spring-ws-security | 3.1.8 | | spring-ws-test | 3.1.8 | | spring-ws-support | 3.1.8 | | spring-ws | 3.1.8 | | Module | Version | |---|---| | spring-integration | 5.5.20 | | spring-integration-amqp | 5.5.20 | | spring-integration-bom | 5.5.20 | | spring-integration-core | 5.5.20 | | spring-integration-event | 5.5.20 | | spring-integration-feed | 5.5.20 | | spring-integration-file | 5.5.20 | | spring-integration-ftp | 5.5.20 | | spring-integration-gemfire | 5.5.20 | | spring-integration-groovy | 5.5.20 | | spring-integration-http | 5.5.20 | | spring-integration-ip | 5.5.20 | | spring-integration-jdbc | 5.5.20 | | spring-integration-jms | 5.5.20 | | spring-integration-jmx | 5.5.20 | | spring-integration-jpa | 5.5.20 | | spring-integration-kafka | 5.5.20 | | spring-integration-mail | 5.5.20 | | spring-integration-mongodb | 5.5.20 | | spring-integration-mqtt | 5.5.20 | | spring-integration-r2dbc | 5.5.20 | | spring-integration-redis | 5.5.20 | | spring-integration-rmi | 5.5.20 | | spring-integration-rsocket | 5.5.20 | | spring-integration-scripting | 5.5.20 | | spring-integration-security | 5.5.20 | | spring-integration-sftp | 5.5.20 | | spring-integration-stomp | 5.5.20 | | spring-integration-stream | 5.5.20 | | spring-integration-syslog | 5.5.20 | | spring-integration-test | 5.5.20 | | spring-integration-test-support | 5.5.20 | | spring-integration-webflux | 5.5.20 | | spring-integration-websocket | 5.5.20 | | spring-integration-ws | 5.5.20 | | spring-integration-xml | 5.5.20 | | spring-integration-xmpp | 5.5.20 | | spring-integration-zeromq | 5.5.20 | | spring-integration-zookeeper | 5.5.20 | | Module | Version | |---|---| | spring-hateoas | 1.5.6 | | Module | Version | |---|---| | spring-ldap-core | 2.4.1, 2.4.4 | | spring-ldap-odm | 2.4.4 | | spring-ldap-test | 2.4.4 | | spring-ldap-sandbox | 2.4.4 | | spring-ldap-ldif-core | 2.4.4 | | spring-ldap-core-tiger | 2.4.4 | | spring-ldap-odm-sample | 2.4.4 | | spring-ldap-plain-sample | 2.4.4 | | Module | Version | |---|---| | spring-graphql | 1.0.6 | | spring-graphql-docs | 1.0.6 | | spring-graphql-test | 1.0.6 | | Module | Version | |---|---| | spring-retry | 1.3.4 | | Module | Version | |---|---| | spring-plugin | 2.0.0.RELEASE | | spring-plugin-core | 2.0.0.RELEASE | | Module | Version | |---|---| | spring-binding | 2.3.1.RELEASE, 2.3.3.RELEASE | | spring-js | 2.3.1.RELEASE, 2.3.3.RELEASE | | spring-js-resources | 2.3.1.RELEASE, 2.3.3.RELEASE | | spring-webflow | 2.3.1.RELEASE, 2.3.3.RELEASE | | spring-faces | 2.3.1.RELEASE, 2.3.3.RELEASE | | Module | Version | |---|---| | spring-pulsar | 1.1.13 | | spring-pulsar-reactive | 1.1.13 | | spring-pulsar-cache-provider | 1.1.13 | | spring-pulsar-cache-provider-caffeine | 1.1.13 | | spring-pulsar-test | 1.1.13 | | spring-pulsar-bom | 1.1.13 | | Module | Version | |---|---| | spring-security-oauth2-authorization-server | 1.1.4 | ## Installation * **Maven** or **Gradle** build tool installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Navigate to the build tool directory** * Windows ```text Maven: C:\Users\{username}\.m2 Gradle: C:\Users\{username}\.gradle ``` * macOS ```text Maven: /Users/{username}/.m2 Gradle: /Users/{username}/.gradle ``` * Linux ```text Maven: /home/{username}/.m2 Gradle: /home/{username}/.gradle ``` 2. **Configure credentials** For Maven, you may choose any valid `` value instead of `tuxcare-registry`, but the same value must be used in both `settings.xml` and `pom.xml`. Maven (settings.xml): ``` tuxcare-registry USERNAME PASSWORD ``` Gradle (gradle.properties): ``` tuxcare_registry_url=https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare_registry_user=USERNAME tuxcare_registry_password=PASSWORD ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. **Add the TuxCare repository** Add the TuxCare Spring® repository and plugins to your build configuration. Maven (pom.xml): ``` tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ tuxcare-registry https://nexus.repo.tuxcare.com/repository/els_java/ ``` Gradle (build.gradle): ``` repositories { maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() } pluginManagement { repositories { //... maven { url = uri(providers.gradleProperty("tuxcare_registry_url").get()) credentials { username = providers.gradleProperty("tuxcare_registry_user").get() password = providers.gradleProperty("tuxcare_registry_password").get() } authentication { basic(BasicAuthentication) } } mavenCentral() //... } } ``` * To fully switch from the official Spring® repository, replace it with the TuxCare repository. * To keep both, add TuxCare after the official one. Example **[Maven](https://github.com/cloudlinux/securechain-java/blob/main/examples/maven)** and **[Gradle](https://github.com/cloudlinux/securechain-java/blob/main/examples/gradle)** projects are available on GitHub. Ensure the required environment variables are set. 4. **Update dependencies** Replace Spring® build dependencies with TuxCare-maintained versions (set the TuxCare release as the parent or BOM as needed). You can find artifact versions on [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_java) — sign in with your TuxCare credentials. Maven (pom.xml): ``` org.springframework.boot spring-boot-starter-parent 2.7.18-tuxcare.8 org.springframework.boot spring-boot-starter-web org.springframework.boot spring-boot-starter-test test ``` Gradle (build.gradle): ``` plugins { id 'java' id 'org.springframework.boot' version '2.7.18-tuxcare.8' id 'io.spring.dependency-management' version '1.0.15.RELEASE' } dependencies { implementation "org.springframework.boot:spring-boot-starter-web" implementation "org.springframework.boot:spring-boot-starter-security" implementation "org.springframework.boot:spring-boot-starter-validation" } ``` 5. **Verify and build** Verify the setup: Maven: ``` mvn dependency:tree -Dverbose ``` Gradle: ``` ./gradlew dependencies --configuration runtimeClasspath ``` Build the project: Maven: ``` mvn clean install ``` Gradle: ``` ./gradlew build ``` The build tool should be able to identify and resolve dependencies from the TuxCare ELS for Spring® repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Spring) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Spring) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Spring) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [Source code](/els-for-libraries/managing-els-repository/#javaSources) — Access source JARs in Nexus * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#java) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/starlette/ ================================================================================ # Starlette Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for Starlette. This allows you to continue running your Starlette applications without vulnerability concerns, even after official support has ended. ## Supported Starlette Versions * **Starlette** 0.13.6, 0.27.0 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple starlette ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade starlette ``` Or install a specific patched TuxCare version, for example: ```text pip install starlette==0.13.6.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install starlette==0.13.6.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Starlette) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Starlette) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Starlette) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/starlette/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:starlette) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/svelte/ ================================================================================ # Svelte Endless Lifecycle Support (ELS) for Svelte from TuxCare provides security fixes for Svelte versions that have reached their end of life. This allows you to continue running Svelte applications without vulnerability concerns, even after official support has ended. ## Supported Svelte Versions * Svelte 0.3.0, 1.64.1, 2.16.1, 3.59.2, 4.2.20 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Svelte project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-svelte-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Svelte dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Svelte dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "svelte": "npm:@els-js/svelte@>=0.3.0-tuxcare.1" }, "overrides": { "svelte@0.3.0": "npm:@els-js/svelte@>=0.3.0-tuxcare.1" } ``` ```text "dependencies": { "svelte": "npm:@els-js/svelte@>=1.64.1-tuxcare.1" }, "overrides": { "svelte@1.64.1": "npm:@els-js/svelte@>=1.64.1-tuxcare.1" } ``` ```text "dependencies": { "svelte": "npm:@els-js/svelte@>=2.16.1-tuxcare.1" }, "overrides": { "svelte@2.16.1": "npm:@els-js/svelte@>=2.16.1-tuxcare.1" } ``` ```text "dependencies": { "svelte": "npm:@els-js/svelte@>=3.59.2-tuxcare.1" }, "overrides": { "svelte@3.59.2": "npm:@els-js/svelte@>=3.59.2-tuxcare.1" } ``` ```text "dependencies": { "svelte": "npm:@els-js/svelte@>=4.2.20-tuxcare.1" }, "overrides": { "svelte@4.2.20": "npm:@els-js/svelte@>=4.2.20-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Svelte version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "svelte": "^4.2.20" } ``` to: ```text "dependencies": { "svelte": "npm:@els-js/svelte@>=4.2.20-tuxcare.1" }, "overrides": { "svelte@4.2.20": "npm:@els-js/svelte@>=4.2.20-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Svelte repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=svelte) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=svelte) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:svelte) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/swiftmailer/ ================================================================================ # SwiftMailer Endless Lifecycle Support (ELS) for SwiftMailer from TuxCare provides security fixes for SwiftMailer library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **SwiftMailer** 5.4.12, 6.0.2 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install SwiftMailer Install the TuxCare-maintained SwiftMailer release that matches your project: Composer CLI: ``` composer require swiftmailer/swiftmailer:5.4.12-p1+tuxcare ``` composer.json: ``` { "require": { "swiftmailer/swiftmailer": "5.4.12-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=swiftmailer%2Fswiftmailer) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=swiftmailer%2Fswiftmailer) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/swiftmailer/swiftmailer/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/symfony/ ================================================================================ # Symfony Endless Lifecycle Support (ELS) for Symfony components such as Symfony Process, Symfony HttpFoundation from TuxCare provides security fixes for Symfony component versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions and Components * **Symfony Process** 3.4.x, 4.4.x, 5.x, 6.x * **Symfony HttpFoundation** 2.8.x, 3.4.x, 4.4.x * **Symfony HttpKernel** 3.4.x, 7.4.x * **Symfony Mailer** 6.4.x * **Symfony Mime** 5.4.x, 6.4.x, 7.4.x * **Symfony Routing** 3.4.x, 4.4.x, 5.4.x, 6.4.x, 7.4.x * **Symfony Yaml** 2.8.x, 3.4.x, 4.4.x Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Symfony components Install the TuxCare-maintained Symfony component release that matches your project: ```text composer require symfony/process:6.4.13-p2+tuxcare ``` `composer.json`: ```text { "require": { "symfony/process": "6.4.13-p2+tuxcare" } } ``` ```text composer require symfony/http-foundation:4.4.49-p2+tuxcare ``` `composer.json`: ```text { "require": { "symfony/http-foundation": "4.4.49-p2+tuxcare" } } ``` ```text composer require symfony/http-kernel:7.4.10-p1+tuxcare ``` `composer.json`: ```text { "require": { "symfony/http-kernel": "7.4.10-p1+tuxcare" } } ``` ```text composer require symfony/mailer:6.4.34-p1+tuxcare ``` `composer.json`: ```text { "require": { "symfony/mailer": "6.4.34-p1+tuxcare" } } ``` ```text composer require symfony/mime:7.4.9-p1+tuxcare ``` `composer.json`: ```text { "require": { "symfony/mime": "7.4.9-p1+tuxcare" } } ``` ```text composer require symfony/routing:7.4.9-p1+tuxcare ``` `composer.json`: ```text { "require": { "symfony/routing": "7.4.9-p1+tuxcare" } } ``` ```text composer require symfony/yaml:4.4.45-p1+tuxcare ``` `composer.json`: ```text { "require": { "symfony/yaml": "4.4.45-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Symfony) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Symfony) — Patched versions and changelogs * ![](/images/box.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Symfony) — Components covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/symfony/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/tailwindcss/ ================================================================================ # tailwindcss Endless Lifecycle Support (ELS) for tailwindcss from TuxCare provides security fixes for tailwindcss versions that have reached their end of life. This allows you to continue running tailwindcss applications without vulnerability concerns, even after official support has ended. ## Supported tailwindcss Versions * tailwindcss 2.1.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your tailwindcss project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-tailwindcss-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace tailwindcss dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your tailwindcss dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "tailwindcss": "npm:@els-js/tailwindcss@>=2.1.1-tuxcare.1" }, "overrides": { "tailwindcss@2.1.1": "npm:@els-js/tailwindcss@>=2.1.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the tailwindcss version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "tailwindcss": "^2.1.1" } ``` to: ```text "dependencies": { "tailwindcss": "npm:@els-js/tailwindcss@>=2.1.1-tuxcare.1" }, "overrides": { "tailwindcss@2.1.1": "npm:@els-js/tailwindcss@>=2.1.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for tailwindcss repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=tailwindcss) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=tailwindcss) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/tailwindcss/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:tailwindcss) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/thruway/ ================================================================================ # Thruway Endless Lifecycle Support (ELS) for Thruway from TuxCare provides security fixes for Thruway (a PHP WAMP/WebSocket router) versions that have reached their end of life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Thruway** 0.4.2 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Thruway Install the TuxCare-maintained Thruway release that matches your project: Composer CLI: ``` composer require voryx/thruway:0.4.2-p1+tuxcare ``` composer.json: ``` { "require": { "voryx/thruway": "0.4.2-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=voryx%2Fthruway) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=voryx%2Fthruway) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/voryx/thruway/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/twig/ ================================================================================ # Twig Endless Lifecycle Support (ELS) for Twig from TuxCare provides security fixes for Twig templating engine versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Twig** 2.15.6, 2.16.1 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install Twig Install the TuxCare-maintained Twig release that matches your project: Composer CLI: ``` composer require twig/twig:2.16.1-p1+tuxcare ``` composer.json: ``` { "require": { "twig/twig": "2.16.1-p1+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=twig%2Ftwig) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=twig%2Ftwig) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/twig/twig/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/undici/ ================================================================================ # undici Endless Lifecycle Support (ELS) for undici from TuxCare provides security fixes for undici versions that have reached their end of life. This allows you to continue running undici applications without vulnerability concerns, even after official support has ended. ## Supported undici Versions * undici 5.28.5, 5.29.0, 6.11.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your undici project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-undici-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace undici dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your undici dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "undici": "npm:@els-js/undici@>=5.28.5-tuxcare.1" }, "overrides": { "undici@5.28.5": "npm:@els-js/undici@>=5.28.5-tuxcare.1" } ``` ```text "dependencies": { "undici": "npm:@els-js/undici@>=5.29.0-tuxcare.1" }, "overrides": { "undici@5.29.0": "npm:@els-js/undici@>=5.29.0-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the undici version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "undici": "^5.28.5" } ``` to: ```text "dependencies": { "undici": "npm:@els-js/undici@>=5.28.5-tuxcare.1" }, "overrides": { "undici@5.28.5": "npm:@els-js/undici@>=5.28.5-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for undici repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=undici) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=undici) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/undici/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:undici) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/vite/ ================================================================================ # Vite Endless Lifecycle Support (ELS) for Vite from TuxCare provides security fixes for Vite versions that have reached their end of life. This allows you to continue running Vite applications without vulnerability concerns, even after official support has ended. ## Supported Vite Versions * Vite 2.9.18, 3.2.11, 4.5.14, 4.5.5, 5.4.14, 5.4.21 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els-vue) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Vite project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-vite-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-vue:registry=https://nexus.repo.tuxcare.com/repository/els-vue/ //nexus.repo.tuxcare.com/repository/els-vue/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Vite dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Vite dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "vite": "npm:@els-vue/vite@>=4.5.5-tuxcare.1" }, "overrides": { "vite@4.5.5": "npm:@els-vue/vite@>=4.5.5-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Vite version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-vue/*` packages. ```text npm install -g @els-vue/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "vite": "^4.5.5" } ``` to: ```text "dependencies": { "vite": "npm:@els-vue/vite@>=4.5.5-tuxcare.1" }, "overrides": { "vite@4.5.5": "npm:@els-vue/vite@>=4.5.5-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Vite repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=vite) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Vite) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/vite/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:vite) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/vue/ ================================================================================ # Vue Endless Lifecycle Support (ELS) for Vue from TuxCare provides security fixes for Vue versions that have reached end of life. This allows you to continue running Vue applications without vulnerability concerns, even after official support has ended. The versions **2.6.11**, **2.6.14**, and **2.7.16** are supported by TuxCare for the following Vue ecosystem packages: * `vue` * `@vue/server-renderer` * `vue-template-compiler` ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_vue) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Vue project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-vue-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-vue:registry=https://nexus.repo.tuxcare.com/repository/els_vue/ //nexus.repo.tuxcare.com/repository/els_vue/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` dependencies to use TuxCare packages. For exact available patched versions, check your Nexus access first. The snippets below are examples. The `>=` range with `-tuxcare.1` resolves to the latest TuxCare build for that upstream Vue version. ```text "dependencies": { "vue": "npm:@els-vue/vue@>=2.7.16-tuxcare.1", "@vue/server-renderer": "npm:@els-vue/vue-server-renderer@>=2.7.16-tuxcare.1", "vue-template-compiler": "npm:@els-vue/vue-template-compiler@>=2.7.16-tuxcare.1" }, "overrides": { "vue@2.7.16": "npm:@els-vue/vue@>=2.7.16-tuxcare.1", "@vue/server-renderer@2.7.16": "npm:@els-vue/vue-server-renderer@>=2.7.16-tuxcare.1", "vue-template-compiler@2.7.16": "npm:@els-vue/vue-template-compiler@>=2.7.16-tuxcare.1" } ``` ```text "dependencies": { "vue": "npm:@els-vue/vue@>=2.6.14-tuxcare.1", "@vue/server-renderer": "npm:@els-vue/vue-server-renderer@>=2.6.14-tuxcare.1", "vue-template-compiler": "npm:@els-vue/vue-template-compiler@>=2.6.14-tuxcare.1" }, "overrides": { "vue@2.6.14": "npm:@els-vue/vue@>=2.6.14-tuxcare.1", "@vue/server-renderer@2.6.14": "npm:@els-vue/vue-server-renderer@>=2.6.14-tuxcare.1", "vue-template-compiler@2.6.14": "npm:@els-vue/vue-template-compiler@>=2.6.14-tuxcare.1" } ``` ```text "dependencies": { "vue": "npm:@els-vue/vue@>=2.6.11-tuxcare.1", "@vue/server-renderer": "npm:@els-vue/vue-server-renderer@>=2.6.11-tuxcare.1", "vue-template-compiler": "npm:@els-vue/vue-template-compiler@>=2.6.11-tuxcare.1" }, "overrides": { "vue@2.6.11": "npm:@els-vue/vue@>=2.6.11-tuxcare.1", "@vue/server-renderer@2.6.11": "npm:@els-vue/vue-server-renderer@>=2.6.11-tuxcare.1", "vue-template-compiler@2.6.11": "npm:@els-vue/vue-template-compiler@>=2.6.11-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Vue repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Vue) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Vue) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Vue) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/vue/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:vue) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/vuetify/ ================================================================================ # Vuetify Endless Lifecycle Support (ELS) for Vuetify from TuxCare provides security fixes for Vuetify versions that have reached their end of life. This allows you to continue running Vuetify applications without vulnerability concerns, even after official support has ended. ## Supported Vuetify Versions * Vuetify 2.5.5, 2.6.13 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your Vuetify project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-vuetify-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace Vuetify dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your Vuetify dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "vuetify": "npm:@els-js/vuetify@>=2.5.5-tuxcare.1" }, "overrides": { "vuetify@2.5.5": "npm:@els-js/vuetify@>=2.5.5-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the Vuetify version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "vuetify": "^2.5.5" } ``` to: ```text "dependencies": { "vuetify": "npm:@els-js/vuetify@>=2.5.5-tuxcare.1" }, "overrides": { "vuetify@2.5.5": "npm:@els-js/vuetify@>=2.5.5-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for Vuetify repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=vuetify) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=vuetify) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?q=vuetify) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/vuetify/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:vuetify) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/webpack-dev-server/ ================================================================================ # webpack-dev-server Endless Lifecycle Support (ELS) for webpack-dev-server from TuxCare provides security fixes for webpack-dev-server versions that have reached their end of life. This allows you to continue running webpack-dev-server applications without vulnerability concerns, even after official support has ended. ## Supported webpack-dev-server Versions * webpack-dev-server 2.11.5, 3.1.14, 3.11.0, 3.11.2, 3.11.3, 4.7.3, 4.11.0, 4.11.1, 4.15.1, 4.15.2 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your webpack-dev-server project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-webpack-dev-server-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace webpack-dev-server dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your webpack-dev-server dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "webpack-dev-server": "npm:@els-js/webpack-dev-server@>=3.11.0-tuxcare.1" }, "overrides": { "webpack-dev-server@3.11.0": "npm:@els-js/webpack-dev-server@>=3.11.0-tuxcare.1" } ``` ```text "dependencies": { "webpack-dev-server": "npm:@els-js/webpack-dev-server@>=4.7.3-tuxcare.1" }, "overrides": { "webpack-dev-server@4.7.3": "npm:@els-js/webpack-dev-server@>=4.7.3-tuxcare.1" } ``` ```text "dependencies": { "webpack-dev-server": "npm:@els-js/webpack-dev-server@>=4.15.1-tuxcare.1" }, "overrides": { "webpack-dev-server@4.15.1": "npm:@els-js/webpack-dev-server@>=4.15.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the webpack-dev-server version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "webpack-dev-server": "^4.7.3" } ``` to: ```text "dependencies": { "webpack-dev-server": "npm:@els-js/webpack-dev-server@>=4.7.3-tuxcare.1" }, "overrides": { "webpack-dev-server@4.7.3": "npm:@els-js/webpack-dev-server@>=4.7.3-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for webpack-dev-server repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=webpack-dev-server) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=webpack-dev-server) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/webpack-dev-server/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:webpack-dev-server) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/webpack/ ================================================================================ # webpack Endless Lifecycle Support (ELS) for webpack from TuxCare provides security fixes for webpack versions that have reached their end of life. This allows you to continue running webpack applications without vulnerability concerns, even after official support has ended. ## Supported webpack Versions * webpack 5.50.0, 5.55.0, 5.76.1, 5.88.2, 5.94.0 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your webpack project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-webpack-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace webpack dependencies with TuxCare-maintained packages. You can do this in two ways: * **Option 1: Manual update** Manually update your `package.json` file by replacing your webpack dependencies with the TuxCare packages. This method gives you full control over which packages to update. ```text "dependencies": { "webpack": "npm:@els-js/webpack@>=5.55.0-tuxcare.1" }, "overrides": { "webpack@5.55.0": "npm:@els-js/webpack@>=5.55.0-tuxcare.1" } ``` ```text "dependencies": { "webpack": "npm:@els-js/webpack@>=5.76.1-tuxcare.1" }, "overrides": { "webpack@5.76.1": "npm:@els-js/webpack@>=5.76.1-tuxcare.1" } ``` * **Option 2: TuxCare Patcher (Automated)** Install the Patcher globally and run it. The TuxCare Patcher automatically detects the webpack version in your `package.json` and updates your `dependencies` and `overrides` to use the corresponding TuxCare `@els-js/*` packages. ```text npm install -g @els-js/tuxcare-patcher --userconfig ./.npmrc tuxcare-patch-js ``` The patcher will update your `package.json`, for example, from: ```text "dependencies": { "webpack": "^5.76.1" } ``` to: ```text "dependencies": { "webpack": "npm:@els-js/webpack@>=5.76.1-tuxcare.1" }, "overrides": { "webpack@5.76.1": "npm:@els-js/webpack@>=5.76.1-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for webpack repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=webpack) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=webpack) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/webpack/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:webpack) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/werkzeug/ ================================================================================ # Werkzeug Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for Werkzeug. This allows you to continue running your Werkzeug applications without vulnerability concerns, even after official support has ended. ## Supported Werkzeug Versions * **Werkzeug** 1.0.1, 2.2.3, 2.3.8 Other versions upon request. ## Installation * **pip** package manager installed * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_python) and click Sign in in the top right corner. You may need to refresh the page after logging in. #### Option 1: Install via command line You can install or upgrade a package directly using the ELS repository with your credentials: ```text pip install --upgrade -i https://USERNAME:PASSWORD@nexus.repo.tuxcare.com/repository/els_python/simple werkzeug ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). #### Option 2: Configure `pip` to use the ELS repository (full replacement) This method is recommended if you want to use only ELS-patched Python packages from TuxCare and replace the default PyPI source with the TuxCare ELS repository. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install the latest package version: ```text pip install --upgrade werkzeug ``` Or install a specific patched TuxCare version, for example: ```text pip install werkzeug==1.0.1.post1+tuxcare ``` #### Option 3: Add the TuxCare ELS repository as additional (recommended) If you want to keep using public PyPI and fetch only specific patched packages from TuxCare, use *extra-index-url* instead. In this configuration, make sure to specify the exact patched version, otherwise `pip` may install the version from public PyPI. 1. Create or update the `pip` configuration file and add the following: Linux/macOS (~/.pip/pip.conf): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` Windows (%APPDATA%\pip\pip.ini): ``` [global] extra-index-url = https://username:password@nexus.repo.tuxcare.com/repository/els_python/simple ``` 2. Run the command to install a specific patched TuxCare version, for example: ```text pip install werkzeug==1.0.1.post1+tuxcare ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Werkzeug) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Werkzeug) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Werkzeug) — Full list of product parts covered by ELS * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/werkzeug/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els_python_sbom:werkzeug) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#Python) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/yui/ ================================================================================ # YUI Endless Lifecycle Support (ELS) for YUI from TuxCare provides security fixes for YUI versions that have reached their end of life. This allows you to continue running YUI applications without vulnerability concerns, even after official support has ended. ## Supported YUI Versions * YUI 2.9.0, 3.18.1 ## Installation Docker compatible * **npm** package manager installed * TuxCare registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_js) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. **Create or update the .npmrc file** Navigate to the root directory of your YUI project and create a `.npmrc` file or update it if it already exists. **Example:** ```text my-yui-project/ ├── node_modules/ ├── package.json ├── .npmrc ⚠️ ← Create it here └── package-lock.json ``` 2. **Configure the npm registry** Use an editor of your choice (e.g., VS Code) to add the following registry address lines to the `.npmrc` file: ```text registry=https://registry.npmjs.org/ @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} ``` Replace `${TOKEN}` with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). 3. **Update dependencies** Update your `package.json` file to replace YUI dependencies with TuxCare-maintained packages: ```text "dependencies": { "yui2": "npm:@els-js/yui2@>=2.9.0-tuxcare.1" }, "overrides": { "yui2@2.9.0": "npm:@els-js/yui2@>=2.9.0-tuxcare.1" } ``` ```text "overrides": { "hoek@0.9.1": "npm:@els-js/hoek@>=0.9.1-tuxcare.1", "mime@1.2.11": "npm:@els-js/mime@>=1.2.11-tuxcare.1", "tunnel-agent@0.4.3": "npm:@els-js/tunnel-agent@>=0.4.3-tuxcare.1", "qs@1.0.2": "npm:@els-js/qs@>=1.0.2-tuxcare.1", "hawk@1.1.1": "npm:@els-js/hawk@>=1.1.1-tuxcare.1", "form-data@0.1.4": "npm:@els-js/form-data@>=0.1.4-tuxcare.1" } ``` 4. **Refresh the project dependencies** Remove `node_modules`, `package-lock.json`, and clear the npm cache: ```text rm -rf node_modules package-lock.json && npm cache clean --force ``` Install dependencies: ```text npm install ``` The token for the TuxCare repository is automatically picked up from your `.npmrc` file. 5. **Verify the setup** Use npm to list the project's dependencies and confirm TuxCare packages are resolved correctly: ```text npm list ``` After reviewing the dependencies, run your application to ensure everything works correctly. The `npm` tool should be able to identify and resolve dependencies from the TuxCare ELS for YUI repository. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=yui) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=yui) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/yui/) — Vulnerability Exploitability eXchange feed * ![](/images/unlock-alt.webp) [SBOM](https://nexus.repo.tuxcare.com/#browse/browse:els-js-sbom:yui) — Software Bill of Materials (Nexus, credentials required) * ![](/images/bolt.webp) [Package updates](/els-for-libraries/managing-els-repository/#JavaScript) — Update an installed package to a newer TuxCare release ================================================================================ Source: https://docs.tuxcare.com/els-for-libraries/zendframework/ ================================================================================ # Zend Framework Endless Lifecycle Support (ELS) for Zend Framework from TuxCare provides security fixes for end-of-life Zend Framework packages. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. ## Supported Versions * **Zend Framework 1** 1.12.10 * **Zend Framework** 2.4.13 * **Zend HTTP** 2.5.6 Other versions upon request. ## Installation * Nexus repository access credentials (username and password) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * To browse available artifacts, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:els_php) and click Sign in in the top right corner. You may need to refresh the page after logging in. 1. Locate the `auth.json` file Composer reads credentials from a per-user `auth.json`. Create or edit the file at: * **Linux/macOS**: ``` ~/.composer/auth.json ``` * **Windows**: ``` %APPDATA%\Composer\auth.json ``` 2. Add your TuxCare credentials Use either the Composer CLI or edit `auth.json` directly to add credentials for `nexus.repo.tuxcare.com`: Composer CLI: ``` composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD ``` auth.json: ``` { "http-basic": { "nexus.repo.tuxcare.com": { "username": "USERNAME", "password": "PASSWORD" } } } ``` Replace `USERNAME` and `PASSWORD` with your TuxCare credentials (see [Prerequisites](#prerequisites) above). 3. Register the TuxCare repository Add the `els_php` Composer repository either via CLI or by editing `composer.json`: Composer CLI: ``` composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json ``` composer.json: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "options": { "http": { "verify": true } } } ] } ``` 4. Install the package Select your package, then install the TuxCare-maintained release that matches your project: Composer CLI: ``` composer require zendframework/zendframework:2.4.13-p1+tuxcare ``` composer.json: ``` { "require": { "zendframework/zendframework": "2.4.13-p1+tuxcare" } } ``` Composer CLI: ``` composer require zendframework/zendframework1:1.12.10-p1+tuxcare ``` composer.json: ``` { "require": { "zendframework/zendframework1": "1.12.10-p1+tuxcare" } } ``` Composer CLI: ``` composer require zendframework/zend-http:2.5.6-p2+tuxcare ``` composer.json: ``` { "require": { "zendframework/zend-http": "2.5.6-p2+tuxcare" } } ``` **Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** If you edited `composer.json` manually, run `composer update` to install the package: ``` composer update ``` Composer will resolve dependencies against the TuxCare repository and install the patched releases. ### Composer Repository Configuration If you encounter dependency resolution errors like: `packages from higher priority repository do not match your constraint` it usually means your project requires a package version that is not yet available in the TuxCare repository. **Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: ``` { "repositories": [ { "type": "composer", "url": "https://nexus.repo.tuxcare.com/repository/els_php/", "canonical": false } ] } ``` This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=zendframework) — Track vulnerability fixes and updates * ![](/images/bolt.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=zendframework) — Patched versions and changelogs * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/zendframework/) — Vulnerability Exploitability eXchange feed * ![](/images/wrench.webp) [Package updates](/els-for-libraries/managing-els-repository/#PHP) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/els-for-os/ ================================================================================ # Endless Lifecycle Support for OS TuxCare's [Endless Lifecycle Support (ELS) for OS](https://tuxcare.com/extended-lifecycle-support/) service provides security updates, system enhancement patches, and selected bug fixes for older versions of a variety of Linux distributions. These distributions have either reached their end of standard support from vendors or have reached End of Life (EOL). Our ELS service is designed to provide solutions for organizations that are not yet ready to migrate to newer versions and that are seeking long-term stability for their out-of-date operating systems. The service coverage includes updates for the Linux kernel and a list of essential packages that are integral to server operations. ## Support Duration TuxCare provides continuous security patching for all supported end-of-life (EOL) technologies for as long as your organization requires them, eliminating the need for rushed or disruptive upgrades. All updates are delivered at a fixed price for the full term of your contract, ensuring predictable costs and uninterrupted protection. ## Technical Support TuxCare provides technical support according to the standard [support policy](https://tuxcare.com/TuxCare-support-policy.pdf). It delivers 24/7/365 access to TuxCare’s support team through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to TuxCare’s online knowledge base. ## Vulnerability coverage TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system integrates both NVD scoring and vendor scoring (when available); when the vendor's score is lower than the NVD score, we prioritize the NVD score. TuxCare shall provide security patches for high- and critical-risk vulnerabilities (CVSS 7 and above). For medium-risk vulnerabilities (CVSS 4.0 to 6.9), TuxCare may provide security patches where mitigations are not available, and there is sufficient customer demand. TuxCare reserves the right to offer a mitigation strategy as an alternative to a direct code fix. Custom coverage options are available, including a 10-pack of customer-directed patches for clients who need CVEs patched outside of the ELS scope. Specific details regarding these coverage options and their pricing can be obtained by contacting our sales team. ## Target response times Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements. TuxCare will make commercially reasonable efforts to deliver security patches for critical and high-risk vulnerabilities (CVSS 7 and above) within 14 days from the date the vulnerabilities become publicly disclosed. Requests for customer-directed security patches for CVEs that are outside of the ELS scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 14 days. ## Rollout Process For several platforms, TuxCare delivers security updates through staged rollout repositories. This process may take up to 14 additional days after a patch is published to stable repositories. During the rollout period, updates are applied in the usual way with standard package manager commands. **For example, standard update for kernel**: ``` yum update kernel* ``` If you need to apply the fix immediately without waiting for the rollout to complete, you can use the bypass repository. The necessary instructions are always provided on the release information page. **For example (packages in the 3rd rollout slot)**: ``` yum update kernel* --enablerepo=centos7els-rollout-3-bypass ``` You can track the status of vulnerabilities and their corresponding fixes via [tuxcare.com/cve-tracker](https://tuxcare.com/cve-tracker/): * [Vulnerabilities](https://tuxcare.com/cve-tracker/) * [Fixes](https://tuxcare.com/cve-tracker/fixes/) ## CVE status definition - Needs Triage: Vulnerability information received and pending initial review - In Research: Investigating the details of the vulnerability - In Progress: Developing a fix for the identified vulnerability - In Testing: Testing the developed fix for the vulnerability - In Rollout: Releasing the fix in rollout repositories - Released: Fix has been fully released to all users - Ignored: This CVE is ignored for specific reasons (low score or another), detailed in the statement field - Not Vulnerable: The vulnerability does not affect our version - Already Fixed: The vulnerability has already been addressed by the vendor ## Supported packages TuxCare's Endless Lifecycle Support provides updates for a comprehensive list of packages integral to server operations (100+ packages), providing maximum security for your operating system. You can view the full list of supported packages for each operating system, as well as get detailed information on the patched Common Vulnerabilities and Exposures (CVEs), [here](https://tuxcare.com/cve-tracker/products/). The list of supported packages may change as projects can be added or removed from the list. Support for additional packages can be provided on request. ## Live patching for ELS systems TuxCare provides KernelCare live patching for **Ubuntu 18.04 ELS** and **CentOS 7 ELS** systems. [KernelCare](https://docs.tuxcare.com/live-patching-services/) is a product that provides security patches for a range of popular Linux kernels that can be installed without rebooting the system. It can be further enhanced with LibCare providing live security patches for critical shared libraries – openssl and glibc. Updating both the kernel and these libraries requires a system reboot while updating other packages does not. Using ELS, KernelCare and LibCare together provides comprehensive protection for your entire system without reboots and downtime. You can easily add KernelCare to your ELS systems and start live patching them. You can also add ELS to systems already using KernelCare's live patching. Both ways, there's no need for system reboots or disruptions. Please note that if you are using KernelCare on the system that will soon reach its end-of-life date, you will be able to continue using it after this date without subscribing to ELS. In this scenario, you will [still receive](https://docs.tuxcare.com/live-patching-services/#kernel-patching-lifetime) live kernel patches, but won’t receive security updates for other operating system packages which are delivered by ELS. At the same time, if you choose to uninstall KernelCare from your Ubuntu 18.04 ELS or CentOS 7 ELS systems and subscribe these systems to ELS, all previously applied KernelCare patches will be removed. Consequently, the systems will start getting updates only from the ELS repository. ================================================================================ Source: https://docs.tuxcare.com/els-for-os/alpine-linux-3-18-els/ ================================================================================ # Alpine Linux 3.18 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/alpinelinux3.18-els/install-els-alpine-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-els-alpine-repo.sh --license-key XXXXXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` apk info els-alpine-release ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `apk upgrade` command. Example: ``` alpine:~# apk info els-alpine-release els-alpine-release-1.0.0-r0 description: ELS Alpine repository configuration els-alpine-release-1.0.0-r0 webpage: https://tuxcare.com/ els-alpine-release-1.0.0-r0 installed size: 20 KiB ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/alpinelinux3.18els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/alpinelinux3.18els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Alpine+Linux+3.18+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Alpine+Linux+3.18+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/amazon-linux-2-els/ ================================================================================ # Amazon Linux 2 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/amazonlinux2-els/install-amazonlinux2-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-amazonlinux2-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. ## What's Next? * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/amazonlinux2els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Amazon+Linux+2+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Amazon+Linux+2+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/centos-6-els/ ================================================================================ # CentOS 6 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com`, `repo.cloudlinux.com`, and `els-rollout.cloudlinux.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.els.tuxcare.com/centos6-els/install-centos6-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-centos6-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. Example: ``` [els@centos6 ~]# yum info els-define Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Available Packages Name : els-define Arch : x86_64 Version : 1 Release : 1.0.1.el6 Size : 2.6 k Repo : centos6-els Summary : CentOS Server simulate release file License : GPLv2 Description : CentOS Server simulate els release files ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/centos6els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/centos6els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=CentOS+6+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=CentOS+6+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/centos-7-els/ ================================================================================ # CentOS 7 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com`, `repo.tuxcare.com`, and `els-rollout.cloudlinux.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/centos7-els/install-centos7-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-centos7-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. Example: ``` [els@centos7 ~]# yum info els-define Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Installed Packages Name : els-define Arch : x86_64 Version : 1 Release : 1.0.4.el7 Size : 52 Repo : installed From repo : centos7-els Summary : CentOS Server els-release file License : GPLv2 Description : CentOS Server els-release file ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/centos7els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/centos7els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=CentOS+7+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=CentOS+7+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/centos-8-els/ ================================================================================ # CentOS 8 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.cloudlinux.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script CentOS 8.4 ELS: ``` wget https://repo.els.tuxcare.com/centos8.4-els/install-centos8.4-els-repo.sh ``` CentOS 8.5 ELS: ``` wget https://repo.els.tuxcare.com/centos8.5-els/install-centos8.5-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. CentOS 8.4 ELS: ``` sh install-centos8.4-els-repo.sh --license-key XXXXXXXXXXX ``` CentOS 8.5 ELS: ``` sh install-centos8.5-els-repo.sh --license-key XXXXXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. Example: ``` [els@centos8_5 ~]# yum info els-define Available Packages Name : els-define Version : 1 Release : 1.0.3.el8 Architecture : x86_64 Size : 7.0 k Source : els-define-1-1.0.3.el8.src.rpm Repository : centos8.5-els Summary : CentOS Server els-release file License : GPLv2 Description : CentOS Server els-release file ``` ## What's Next? * [8.4] ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/centos8.4els/oval.xml) — OVAL security data * [8.5] ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/centos8.5els/oval.xml) — OVAL security data * [8.4] ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/) — CSAF security advisories * [8.5] ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/centos8.5els/) — CSAF security advisories * [8.4] ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=CentOS+8.4+ELS) — Track vulnerability fixes and updates * [8.5] ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=CentOS+8.5+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * [8.4] ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=CentOS+8.4+ELS) — Full list of packages covered by ELS * [8.5] ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=CentOS+8.5+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/centos-stream-8-els/ ================================================================================ # CentOS Stream 8 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/centos8stream-els/install-centos8stream-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-centos8stream-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. Example: ``` [els@centos8stream ~]# yum info els-define Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Available Packages Name : els-define Arch : x86_64 Version : 1 Release : 1.0.1.el8 Size : 2.6 k Repo : centos8stream-els Summary : CentOS Server simulate release file License : GPLv2 Description : CentOS Server simulate els release files ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/centos-stream8els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=CentOS+Stream+8+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=CentOS+Stream+8+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/cloudlinux-7-els/ ================================================================================ # CloudLinux 7 ELS You do not need ELS for CentOS 7 subscription if you are already using CloudLinux OS 7. You can find more information [here](https://docs.cloudlinux.com/cln/billing/). ## Security Updates TuxCare provides security updates as a part of ELS for OS along with OpenSCAP scanning instructions - [learn more](/security-updates). * **CloudLinux ELS OVAL stream**: * **CloudLinux ELS CSAF data**: * **CloudLinux RSS release feed**: ================================================================================ Source: https://docs.tuxcare.com/els-for-os/debian-10-els/ ================================================================================ # Debian 10 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/debian10-els/install-debian10-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` bash install-debian10-els-repo.sh --license-key XXXXXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` apt-cache show els-os-release ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `apt upgrade` command. Example: ``` root@localhost:~# apt-cache show els-os-release Package: els-os-release Version: 1.0.0-2 Architecture: amd64 Maintainer: Koba Karaputadze Installed-Size: 17 Conflicts: els-define Replaces: els-define Homepage: https://tuxcare.com/extended-lifecycle-support/ Priority: optional Section: utils Filename: pool/main/e/els-os-release/els-os-release_1.0.0-2_amd64.deb Size: 5306 SHA256: be11d8bffaac9f70c8b19d2f9c96e64bb0a698593671d807e6fe75687863e3c8 SHA1: 47238eb136a07fb1b91fe531b6e4ebbd3207a6ab MD5sum: b82dba173e67dfbfc83a6f414c866a59 Description: ELS os release package for deb systems Description-md5: f3fdfd5cb5f71a4ebb6f1f40c8d57483 ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/debian10els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/debian10els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Debian+10+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Debian+10+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/duration-of-support/ ================================================================================ ### Duration of support TuxCare provides Endless Lifecycle Support (ELS) for the Linux distributions after they have reached End of Life (EOL) or no longer receive standard support. | **Distribution** | **Arch** | **EOL** | |---|---|---|---| | CentOS 6 | x86_64 i386 | November 2020 | | CentOS 7 | x86_64 i386 | June 2024 | | CentOS 8 | x86_64 | January 2022 | | CentOS Stream 8 | x86_64 | June 2024 | | Oracle Linux 6 | x86_64 | December 2020 | | Oracle Linux 7 | x86_64 | December 2024 | | Ubuntu 16.04 | amd64 | April 2021 | | Ubuntu 18.04 | amd64 | May 2023 | ================================================================================ Source: https://docs.tuxcare.com/els-for-os/machine-readable-security-data/ ================================================================================ # Machine-Readable Security Data (Errata, OVAL, CSAF) TuxCare provides the following security updates for ELS for OS: * **Errata** — qualified security and selected bug-fix errata advisories * **OVAL** — Open Vulnerability and Assessment Language patch definitions for use with OpenSCAP and similar tools * **CSAF** — Common Security Advisory Framework advisories in [OASIS](https://www.csaf.io/) CSAF 2.0 format (VEX and Security Advisory) * **RSS** — release feeds for tracking updates Released fixes are available via [tuxcare.com/cve-tracker](https://tuxcare.com/cve-tracker/fixes) and [security.tuxcare.com](https://security.tuxcare.com). ## Security data feeds | OS | OVAL | CSAF | RSS | |----|------|------|-----| | Alpine Linux 3.18 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/alpinelinux3.18els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/alpinelinux3.18els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Alpine+Linux+3.18+ELS) | | Amazon Linux 2 ELS | — | [csaf](https://security.tuxcare.com/csaf/v2/els_os/amazonlinux2els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Amazon+Linux+2+ELS) | | CentOS 6 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/centos6els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/centos6els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=CentOS+6+ELS) | | CentOS 7 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/centos7els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/centos7els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=CentOS+7+ELS) | | CentOS 8.4 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/centos8.4els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=CentOS+8.4+ELS) | | CentOS 8.5 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/centos8.5els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/centos8.5els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=CentOS+8.5+ELS) | | CentOS Stream 8 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/centos-stream8els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=CentOS+Stream+8+ELS) | | Debian 10 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/debian10els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/debian10els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Debian+10+ELS) | | Oracle Linux 6 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/oraclelinux6els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Oracle+Linux+6+ELS) | | Oracle Linux 7 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/oraclelinux7els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Oracle+Linux+7+ELS) | | Red Hat Enterprise Linux 7 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/rhel7els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/rhel7els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Red+Hat+Enterprise+Linux+7+ELS) | | Red Hat Enterprise Linux 8 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/rhel8els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/rhel8els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Red+Hat+Enterprise+Linux+8+ELS) | | Ubuntu 16.04 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/ubuntu16.04els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/ubuntu16.04els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Ubuntu+16.04+ELS) | | Ubuntu 18.04 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/ubuntu18.04els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Ubuntu+18.04+ELS) | | Ubuntu 20.04 ELS | [oval.xml](https://security.tuxcare.com/oval/els_os/ubuntu20.04els/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_os/ubuntu20.04els/) | [rss](https://tuxcare.com/cve-tracker/api/products/export/rss?product=Ubuntu+20.04+ELS) | ## Errata advisories TuxCare Endless Lifecycle Support provides qualified security and selected bug-fix errata advisories across all architectures. They can help users track which CVEs are resolved and which bugs have been addressed. You can view the full list of released fixes on [tuxcare.com/cve-tracker](https://tuxcare.com/cve-tracker/fixes/). ## OVAL patch definitions Leveraging the Open Vulnerability and Assessment Language (OVAL) patch definitions with OVAL-compatible tools, e.g. OpenSCAP, users can accurately check their systems for the presence of vulnerabilities. Identifying the vulnerabilities that apply to your systems is an important task for IT and InfoSec teams, and at TuxCare we make it easy. We provide OVAL data that contain instructions to the vulnerability scanner to determine the addressed vulnerabilities from the ELS updates. OVAL streams for each OS are listed in the [Security data feeds](#security-data-feeds) table above. ### How to use OpenSCAP with TuxCare ELS OpenSCAP is an open source vulnerability scanner and compliance tool and it can be used to scan a system protected by TuxCare ELS. The following steps show how to produce a vulnerability report for the system: 1. Install the ELS release package and OpenSCAP: RPM: ``` yum install els-define openscap openscap-utils scap-security-guide -y ``` DEB: ``` apt-get install els-define libopenscap8 -y ``` APK: ``` apk add els-alpine-release openscap ``` 2. Before running a scan, make sure the system is up to date and running the latest kernel: RPM: ``` yum update -y ``` DEB: ``` apt-get update && apt-get upgrade -y ``` APK: ``` apk update && apk upgrade ``` 3. Reboot the system. 4. **RPM-based system only**: after reboot, remove older kernel versions: EL 6, EL 7: ``` package-cleanup --oldkernels --count=1 -y ``` EL 8, EL 9: ``` dnf remove --oldinstallonly -y ``` 5. Download the OVAL stream. For example, Ubuntu 18.04: ``` wget https://security.tuxcare.com/oval/els_os/ubuntu18.04els/oval.xml ``` 6. Run the scan: ``` oscap oval eval --results results.xml --report report.html oval.xml ``` 7. Examine the scan results report. Following the example above, the scan results report will be saved to the report.html file in the current directory. This file can then be downloaded for analysis or published directly with a local web server, for example: ``` python3 -m http.server 8000 ``` or for python2 ``` python -m SimpleHTTPServer 8000 ``` Assuming the above command is run from the directory with the report.html file, the webpage with the report can then be accessed on `http://:8000/report.html` through a web browser. **Note: the OpenSCAP report below is provided as an example. The results will vary depending on the OS and version you are scanning.** ![](/images/available-cve-fixes-and-their-status.webp) The report includes a table with vulnerabilities and their status on the examined system. A line such as the one below reports that the system is vulnerable to CVE-2023-2828: ``` update oval:com.tuxcare.clsa:def:1688677755 true patch [CLSA-2023:1688677755], [CVE-2023-2828] Fix CVE(s): CVE-2023-2828 ``` The table also includes corresponding hyperlinks to advisory pages where the package and the version containing the fix can be found as well as the command to run on the target system in order to install the update. Lines like the one below designate that the fix for the corresponding CVE is already installed on the system, and no further action is needed: ``` oval:com.tuxcare.clsa:def:1694538670 false patch [CLSA-2023:1694538670], [CVE-2022-40433] Fix CVE(s): CVE-2022-40433 ``` ### How to integrate the OVAL data with a new vulnerability scanner Identifying the vulnerabilities that apply to your systems is an important task for IT and InfoSec teams, and at TuxCare we make it easy. To detect whether a system has TuxCare ELS installed, check for the following file being present: `/etc/els-release`. Once that is validated, you can use the OVAL files corresponding to your operating system from above to scan for vulnerabilities. ## Common Security Advisory Framework Common Security Advisory Framework (CSAF) is a machine-readable format, standardized by [OASIS](https://www.csaf.io/). It's designed to enable consistent and automated sharing of security advisory information. CSAF links for each OS are listed in the [Security data feeds](#security-data-feeds) table above. TuxCare publishes the following CSAF files at [security.tuxcare.com](https://security.tuxcare.com/csaf/v2/): * CSAF Vulnerability Exploitability eXchange (VEX) files – VEX documents, indexed by CVE, are available in CSAF 2.0 format, including past CVEs. * CSAF Security Advisory files – advisories are published in CSAF 2.0 format and indexed by Security Advisory. `provider-metadata.json` contains information for tools and users about where and how to retrieve CSAF advisories published by TuxCare. By OASIS requirements, it is available at two URLs (both serving the same file): * [csaf.data.security.tuxcare.com](https://csaf.data.security.tuxcare.com/) * [tuxcare.com/.well-known/csaf/provider-metadata.json](https://tuxcare.com/.well-known/csaf/provider-metadata.json) ## RSS release feeds TuxCare provides RSS feeds for tracking new ELS releases. RSS links for each OS are listed in the [Security data feeds](#security-data-feeds) table above. ================================================================================ Source: https://docs.tuxcare.com/els-for-os/managing-els-repository/ ================================================================================ # Managing the ELS repository This page provides instructions for updating packages, setting up a local mirror, and removing the Endless Lifecycle Support (ELS) repository. ## Updating packages After the ELS repository is installed, you can apply security updates using your system's standard package manager. **Applies to:** Amazon Linux 2, CentOS 6, CentOS 7, CentOS 8, CentOS Stream 8, Oracle Linux 6, Oracle Linux 7, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Update all packages: ``` yum update ``` Update a specific package (e.g., kernel): ``` yum update kernel* ``` **Applies to:** Debian 10, Ubuntu 16.04, Ubuntu 18.04 Update the package index and upgrade all packages: ``` apt update && apt upgrade ``` Update the package index and upgrade all packages: ``` apk update && apk upgrade ``` ### Rollout process For several platforms, TuxCare delivers security updates through staged rollout repositories. This process may take up to 14 additional days after a patch is published to stable repositories. If you need to apply a fix immediately without waiting for the rollout to complete, you can use the bypass repository. The necessary instructions are always provided on the [release information page](https://tuxcare.com/cve-tracker/fixes/). For example (packages in the 3rd rollout slot): ``` yum update kernel* --enablerepo=centos7els-rollout-3-bypass ``` ## Local mirror TuxCare provides the ability to create local mirrors of ELS repositories using `rsync`. This is useful for environments with restricted internet access or for reducing external bandwidth usage. To obtain access to the local mirroring facility, provide your external IP address to your Account Manager or contact [sales@tuxcare.com](mailto:sales@tuxcare.com). ## Removing the ELS repository **Applies to:** Amazon Linux 2, CentOS 6, CentOS 7, CentOS 8, CentOS Stream 8, Oracle Linux 6, Oracle Linux 7, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 **For Amazon Linux 2 and Red Hat Enterprise Linux 8**, the repository can be removed by running the installation script with the `--delete` flag. For example: ``` sh install-amazonlinux2-els-repo.sh --delete ``` **For other RPM-based systems:** 1. List the ELS repository file (ending with `-els.repo`) in the repository folder: ``` ls -l /etc/yum.repos.d/*-els.repo ``` 2. Remove the file to disable the ELS repository. For example, for CentOS 7: ``` rm /etc/yum.repos.d/centos7-els.repo ``` 3. Uninstall the `els-define` package: ``` yum remove els-define ``` **Applies to:** Debian 10, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04 **For Debian 10**, the repository can be removed by running the installation script with the `--delete` flag: ``` bash install-debian10-els-repo.sh --delete ``` **For Ubuntu 20.04**, the repository can be removed by running the installation script with the `--delete` flag: ``` bash install-ubuntu20.04-els-repo.sh --delete ``` **For Ubuntu 16.04 / 18.04:** 1. List the ELS repository file (ending with `-els.list`) in the repository folder: ``` ls -l /etc/apt/sources.list.d/*-els.list ``` 2. Remove the file to disable the ELS repository: ``` rm /etc/apt/sources.list.d/ubuntu-els.list ``` 3. Uninstall the `els-define` package: ``` apt remove els-define ``` 1. Remove the ELS repository configuration: ``` rm /etc/apk/repositories.d/*els* ``` 2. Uninstall the `els-alpine-release` package: ``` apk del els-alpine-release ``` ================================================================================ Source: https://docs.tuxcare.com/els-for-os/oracle-linux-6-els/ ================================================================================ # Oracle Linux 6 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.cloudlinux.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.els.tuxcare.com/oraclelinux6-els/install-oraclelinux6-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-oraclelinux6-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. Example: ``` Installed Packages Name : els-define Arch : x86_64 Version : 1 Release : 1.0.1.el6 Size : 60 From repo : oraclelinux6-els Summary : OEL6 Server simulate release file License : GPLv2 Description : OLE6 Server simulate els release files ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/oraclelinux6els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Oracle+Linux+6+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Oracle+Linux+6+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/oracle-linux-7-els/ ================================================================================ # Oracle Linux 7 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/oraclelinux7-els/install-oraclelinux7-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-oraclelinux7-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. Example: ``` [els@oraclelinux7 ~]# yum info els-define Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Installed Packages Name : els-define Arch : x86_64 Version : 1 Release : 1.0.4.el7 Size : 52 Repo : installed From repo : oraclelinux7-els Summary : OEL7 Server els-release file License : GPLv2 Description : OEL7 Server els-release file ``` **UEKR6 repository** The installation script **does not automatically add** the TuxCare UEKR6 repository. If you plan to use the `kernel-uek` package on your Oracle Linux 7 system, you need to enable the TuxCare UEKR6 repository manually. 1. Use an editor of your choice to edit the `/etc/yum.repos.d/oraclelinux7-els.repo` file ``` vi /etc/yum.repos.d/oraclelinux7-els.repo ``` 2. Add the following lines there to enable the TuxCare UEKR 6 repository ``` [oraclelinux7-els-UEKR6] name = OracleLinux 7 Extended Lifecycle Support by TuxCare UEKR6 baseurl = https://repo.tuxcare.com/oraclelinux7-els/\$elstoken/UEKR6/\$basearch/ enabled = 1 ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/oraclelinux7els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Oracle+Linux+7+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Oracle+Linux+7+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/red-hat-enterprise-linux-7-els/ ================================================================================ # Red Hat Enterprise Linux 7 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/rhel7-els/install-rhel7-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-rhel7-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/rhel7els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/rhel7els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Red+Hat+Enterprise+Linux+7+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Red+Hat+Enterprise+Linux+7+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/red-hat-enterprise-linux-8-els/ ================================================================================ # Red Hat Enterprise Linux 8 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/rhel8-els/install-rhel8-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` sh install-rhel8-els-repo.sh --license-key XXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` yum info els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `yum upgrade` command. ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/rhel8els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/rhel8els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Red+Hat+Enterprise+Linux+8+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/ubuntu-16-04-els/ ================================================================================ # Ubuntu 16.04 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.cloudlinux.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.els.tuxcare.com/ubuntu16_04-els/install-ubuntu16.04-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` bash install-ubuntu16.04-els-repo.sh --license-key XXX-XXXXXXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` apt-cache show els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `apt upgrade` command. Example: ``` [els@ubuntu16 ~]# apt-cache show els-define Package: els-define Version: 1-1.0.1 Architecture: amd64 Maintainer: Darya Malyavkina Installed-Size: 10 Homepage: https://tuxcare.com/els-for-os/ Priority: optional Section: utils Filename: pool/main/e/els-define/els-define_1-1.0.1_amd64.deb Size: 1302 SHA256: a6b68c43c88a148ecc4806d0b4eb309deb5af418c8e1d0ea980fd453f5aec8dd SHA1: 4907b9796c40327dbd45ecf2fd0806a32e2c24bd MD5sum: 42f69c642c27052b15e4470533fdab62 Description: ELS define package for Ubuntu 16.04 Description-md5: 39e3bb446b4c63607f8f0358484545bf ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/ubuntu16.04els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/ubuntu16.04els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Ubuntu+16.04+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Ubuntu+16.04+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/ubuntu-18-04-els/ ================================================================================ # Ubuntu 18.04 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.cloudlinux.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.els.tuxcare.com/ubuntu18_04-els/install-ubuntu18.04-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` bash install-ubuntu18.04-els-repo.sh --license-key XXXXXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` apt-cache show els-define ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `apt upgrade` command. Example: ``` [els@ubuntu18 ~]# apt-cache show els-define Package: els-define Version: 1-1.0.2 Architecture: amd64 Maintainer: Darya Malyavkina Installed-Size: 10 Homepage: https://tuxcare.com/extended-lifecycle-support/ Priority: optional Section: utils Filename: pool/main/e/els-define/els-define_1-1.0.2_amd64.deb Size: 1424 SHA256: 1594db1c72e64adf1fcbd6bfd4a86c72c6e4127d476d238d8c6821d34590d945 SHA1: 03780c77ab2f1982126b78ab5454f7c0ff287162 MD5sum: bd3f51b29deb5cc7ede4da8aa39ee2c2 Description: ELS define package for Ubuntu 18.04 Description-md5: 39e3bb446b4c63607f8f0358484545bf ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/ubuntu18.04els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Ubuntu+18.04+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Ubuntu+18.04+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-os/ubuntu-20-04-els/ ================================================================================ # Ubuntu 20.04 ELS ## Installation * A valid TuxCare ELS license key * Root access to the server * TCP port 443 open to `cln.cloudlinux.com` and `repo.tuxcare.com` * Architecture: x86_64. For other architectures, please contact our [sales@tuxcare.com](mailto:sales@tuxcare.com). 1. Download the install script ``` wget https://repo.tuxcare.com/ubuntu20_04-els/install-ubuntu20.04-els-repo.sh ``` 2. Run with your license key (see [Prerequisites](#prerequisites) above) The script registers the server in the CLN with the key, adds a PGP key to the server. ``` bash install-ubuntu20.04-els-repo.sh --license-key XXXXXXXXXXX ``` 3. Verify that the installation was successful by running the following command ``` apt-cache show els-os-release ``` It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard `apt upgrade` command. Example: ``` root@localhost:~# apt-cache show els-os-release Package: els-os-release Version: 1.0.0-2 Architecture: amd64 Maintainer: Koba Karaputadze Installed-Size: 17 Conflicts: els-define Replaces: els-define Homepage: https://tuxcare.com/extended-lifecycle-support/ Priority: optional Section: utils Filename: pool/main/e/els-os-release/els-os-release_1.0.0-2_amd64.deb Size: 5306 SHA256: be11d8bffaac9f70c8b19d2f9c96e64bb0a698593671d807e6fe75687863e3c8 SHA1: 47238eb136a07fb1b91fe531b6e4ebbd3207a6ab MD5sum: b82dba173e67dfbfc83a6f414c866a59 Description: ELS os release package for deb systems Description-md5: f3fdfd5cb5f71a4ebb6f1f40c8d57483 ``` ## What's Next? * ![](/images/shield-alert.webp) [OVAL](https://security.tuxcare.com/oval/els_os/ubuntu20.04els/oval.xml) — OVAL security data * ![](/images/unlock-alt.webp) [CSAF](https://security.tuxcare.com/csaf/v2/els_os/ubuntu20.04els/) — CSAF security advisories * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Ubuntu+20.04+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Machine-Readable Security Data](/els-for-os/machine-readable-security-data/) — Errata, OVAL, CSAF * ![](/images/box.webp) [Supported packages list](https://tuxcare.com/cve-tracker/products/?product=Ubuntu+20.04+ELS) — Full list of packages covered by ELS * ![](/images/wrench.webp) [Managing the ELS repository](/els-for-os/managing-els-repository/) — Updates, local mirror, and other repository operations ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/ ================================================================================ # Endless Lifecycle Support for Runtimes ## Vulnerability Coverage and Target Response Times TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system integrates both NVD scoring and vendor scoring (when available); when the vendor's score is lower than the NVD score, we prioritize the NVD score. Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements. * **Vulnerability coverage.** TuxCare shall provide security patches for critical- and high-risk (CVSS 7.0 and above), medium-risk (CVSS 4.0 to 6.9), and low-risk (CVSS 0.1 to 3.9) vulnerabilities. TuxCare reserves the right to offer a mitigation strategy as an alternative to a direct code fix. * **Response time.** TuxCare will make commercially reasonable efforts to adhere to the following guidelines when addressing vulnerabilities: * **High- and critical-risk vulnerabilities (CVSS 7.0 and above):** Patches are provided within 14 days from the date the vulnerabilities are publicly disclosed. * **Medium-risk vulnerabilities (CVSS 4.0 to 6.9):** Patches are provided within 60 days from the date the vulnerabilities are publicly disclosed. * **Low-risk vulnerabilities (CVSS 0.1 to 3.9):** Patches are provided within 90 days from the date the vulnerabilities are publicly disclosed. ## Incident Reporting and Response Timeframe Customers can report vulnerabilities by submitting a ticket through the [TuxCare Support Portal](https://tuxcare.com/support-portal/). TuxCare commits to providing an initial response to any reported issue within 3 days. Requests for customer-directed security patches for CVEs that are outside of the ELS for Runtimes scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 60 days. Handling Multiple Vulnerabilities: In cases where several CVEs are reported simultaneously for fixing, TuxCare will discuss and agree upon resolution timelines separately with the customer. ## Enhanced Transparency & Visibility TuxCare's commitment to transparency and visibility is foundational to our ELS for Runtimes offering. We aim to provide comprehensive details about how each package is built, verified, and distributed, ensuring complete trust in the software supply chain. * **Software Bill of Materials (SBOM)**: Machine-readable SBOMs provide visibility into package composition and dependencies, supporting software supply chain transparency and accountability. Depending on the package, SBOMs are provided in industry-standard formats — SPDX and CycloneDX. Note: SBOM availability for certain components is still expanding and may vary by package. Contact [sales@tuxcare.com](mailto:sales@tuxcare.com) for current availability details. * **Vulnerability Exploitability eXchange (VEX)**: Machine-readable VEX documents provide contextual vulnerability information, helping teams understand which known CVEs affect specific package versions and reduce remediation noise. For ELS for Runtimes, VEX is published as part of the CSAF advisory feed. See [Machine-Readable Security Data](./machine-readable-security-data/) for per-runtime CSAF feeds and details. * **Verifiable Integrity and Provenance**: Our packages and metadata provide comprehensive end-to-end provenance, detailing how each package was constructed and tested, ensuring that all components in your software stack are trustworthy. Note: This feature is under consideration for future development and may be available at a later date. If you are interested, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). * **Secure Distribution**: Signed versions of the packages and their metadata are distributed from a registry managed, secured, and protected by TuxCare, guaranteeing that your software updates are authentic and untampered. ## Support Duration TuxCare provides continuous security patching for all supported end-of-life (EOL) technologies for as long as your organization requires them, eliminating the need for rushed or disruptive upgrades. All updates are delivered at a fixed price for the full term of your contract, ensuring predictable costs and uninterrupted protection. ## Technical Support TuxCare provides technical support according to the: * Standard [support policy](https://tuxcare.com/TuxCare-support-policy.pdf) **(excluding .NET)**. * The **.NET-specific** [support policy](https://tuxcare.com/TuxCare-els-windows-support-policy.pdf). It delivers 24/7/365 access to TuxCare’s support team through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to TuxCare’s online knowledge base. ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/dotnet/ ================================================================================ # .NET Endless Lifecycle Support (ELS) for .NET from TuxCare provides security fixes for .NET that has reached its end of life. This allows you to continue running .NET applications without vulnerability concerns, even after official support has ended. ## Supported Versions | Windows Version | .NET 6 | .NET 8 | .NET 10 | Architectures | |---------------------------------------------------------|:------:|:------:|:-------:|:-------------:| | **Nano Server 2019, 2022** | ✓ | ✓ | ✓ | x64 | | **Nano Server 2025** | — | ✓ | ✓ | x64 | | **Windows 11** (24H2, 23H2, 22H2 E/Edu) | ✓ | ✓ | ✓ | x64 | | **Windows 10** (22H2) | ✓ | ✓ | ✓ | x64 | | **Windows Server** 2025 | — | ✓ | ✓ | x64 | | **Windows Server** 2022, 2019, 2016, 2012-R2, 2012 | ✓ | ✓ | ✓ | x64, x86 | | **Windows Server Core** 2022, 2019, 2016, 2012-R2, 2012 | ✓ | ✓ | ✓ | x64, x86 | ## Available Runtimes Choose the component that fits your use case. For more details, refer to the [official .NET documentation](https://learn.microsoft.com/en-us/dotnet/fundamentals/). TuxCare applies security patches to .NET for the above OS versions, ensuring continued stability and security even beyond the official end-of-life date. The .NET SDK (Software Development Kit) is the recommended option if you plan to develop, build, test, or publish .NET applications. It includes the .NET Runtime (required to run .NET apps), the ASP.NET Core Runtime (for hosting web applications out of the box), and the .NET CLI and build tools for compiling and managing your projects. With the SDK, you won't need to install separate runtimes for ASP.NET Core or the Desktop environment - everything is bundled together to streamline development and deployment. The ASP.NET Core Runtime contains the components needed to run ASP.NET Core web applications on .NET. It includes libraries and features for building dynamic web pages, RESTful APIs, and real-time communication with SignalR. Note, if you install the full .NET SDK, you already get the ASP.NET Core Runtime. The .NET Desktop Runtime allows you to run Windows desktop applications built with Windows Forms or WPF (Windows Presentation Foundation). It focuses on providing a smooth experience for traditional graphical apps on Windows platforms. The .NET Runtime is the base runtime required to run console or server-based .NET applications. It is more lightweight than the SDK, since it does not include compilers, build tools, or additional libraries for web or desktop development. ## Installation * A supported Windows version — see the [compatibility table](#supported-versions) above * Administrator rights * Secure download link (tokenized URL) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to receive instructions for generating one * Check if .NET is already installed — open **Command Prompt** (`cmd`) or **PowerShell** and run: ``` dotnet --version ``` If .NET is already installed, the command will return the version number. If it's not installed, you'll see an error message. Install the latest version of .NET before uninstalling the old one to ensure a smooth transition without breaking the dependencies. The following steps use the .NET SDK installation as an example. If you are installing a runtime instead, follow a similar process using the corresponding .msi file. 1. Download the installer Use your tokenized URL (see [Prerequisites](#prerequisites) above) to access the download page. Choose the appropriate runtime (SDK, Runtime, Desktop Runtime, or ASP.NET Core Runtime) and download the installer for your architecture (x64 or x86). Downloading the latest version is recommended. The .NET SDK is installed via an `.exe` installer. The .NET Runtime, Desktop Runtime, and ASP.NET Core Runtime are installed via `.msi` files. In certain versions of some browsers (for example, Edge), you might see a warning after downloading. In this case, manually allow the download. 2. Run the installer Double-click the downloaded file. Accept the **license agreement** and click **Install**. ![image](/images/els-dotnet-installation.webp) 3. Complete the installation Wait for the process to finish, then click **Close**. 4. Verify the installation Open **Command Prompt** or **PowerShell** and run: ```text dotnet --version ``` Example output: ```text 6.0.429 ``` 5. Create and run a test project Create a new console application to confirm everything works: ```text dotnet new console -o MyTestApp ``` Example output: ```text Welcome to .NET 6.0! --------------------- SDK Version: 6.0.429 ---------------------------------------------------------------------------- The template "Console App" was created successfully. Processing post-creation actions... Running 'dotnet restore' on C:\Users\user\MyTestApp\MyTestApp.csproj... Determining projects to restore... Restored C:\Users\user\MyTestApp\MyTestApp.csproj (in 115 ms). Restore succeeded. ``` Navigate to the folder and run it: ```text cd MyTestApp dotnet run ``` Expected output: ```text Hello, World! ``` ## Additional configurations ### Useful commands * `where.exe dotnet` — locates the dotnet executable on the system: ```text where.exe dotnet ``` Example output: ```text C:\Program Files\dotnet\dotnet.exe ``` * `dotnet --info` — displays information about installed SDKs, runtimes, and your OS: ```text dotnet --info ```
Example output ```text .NET SDK (reflecting any global.json): Version: 6.0.429 Commit: ef6f5ce48c Runtime Environment: OS Name: Windows OS Version: 10.0.22631 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\6.0.429\ global.json file: Not found Host: Version: 6.0.36 Architecture: x64 Commit: N/A .NET SDKs installed: 6.0.429 [C:\Program Files\dotnet\sdk] .NET runtimes installed: Microsoft.AspNetCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Download .NET: https://aka.ms/dotnet-download Learn about .NET Runtimes and SDKs: https://aka.ms/dotnet/runtimes-sdk-info ```
* `dotnet --list-sdks` — lists all installed SDKs. Uninstall old versions after installing a new one: ```text dotnet --list-sdks ``` Example output: ```text 6.0.429 [C:\Program Files\dotnet\sdk] ``` ### Uninstallation * **Via Windows Settings** Open **Settings** → **Apps** → **Installed Apps** (or **Apps & Features** on older versions). Search for *.NET SDK* or *.NET Runtime* depending on what you've installed. Click on each entry and select **Uninstall**. During the uninstall, a **"Files in use"** window can appear. Select the **"Do not close applications. A reboot will be required"** option and click **OK** to proceed. A dialog window will appear. Click **Uninstall**. It should take a few minutes. When the process is finished, close the window. ![Uninstalling via Windows Settings](/images/dotnet-uninstall-settings.webp) * **Via Control Panel** Open **Control Panel** → **Programs** → **Programs and Features**. Search for *.NET SDK* or *.NET Runtime*, right-click on each entry and select **Uninstall**. During the uninstall, a **"Files in use"** window can appear. Select the **"Do not close applications. A reboot will be required"** option and click **OK** to proceed. A dialog window will appear. Click **Uninstall**. It should take a few minutes. When the process is finished, close the window. ![Uninstalling via Control Panel](/images/dotnet-uninstall-controlpanel.webp) * **Remove remaining files** After uninstalling .NET some files may remain in `C:\Program Files\dotnet\` and `C:\Users\\.dotnet\`. Delete these folders manually to fully remove .NET. ## Frequent Issues * **How do I update .NET if a new version is released?** Currently, to update .NET, you need to manually download the latest installer and follow the installation steps described above. After installing the new version, it's recommended to remove the previous one. In the future, an automatic update mechanism for the components will be provided. * **What should I do if there are conflicts during installation?** If you encounter conflicts, try uninstalling the previous version before installing the new one. In most cases, .NET versions can coexist without issues, but removing the older version may help resolve compatibility problems. ## What's Next? * ![](/images/box.webp) [ELS NuGet Repository](/els-for-libraries/dotnet/) — Set up the TuxCare NuGet feed, install patched packages, and manage .NET package dependencies * ![](/images/book.webp) [Official .NET documentation](https://learn.microsoft.com/en-us/dotnet/fundamentals/) — Getting started guides, API reference, and platform fundamentals ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/machine-readable-security-data/ ================================================================================ # Machine-Readable Security Data (Errata, OVAL, CSAF) TuxCare provides machine-readable security data for ELS for Runtimes in the following formats: * **Errata** — qualified security and selected bug-fix errata advisories * **OVAL** — Open Vulnerability and Assessment Language patch definitions for use with OpenSCAP and similar tools * **CSAF** — Common Security Advisory Framework advisories in [OASIS](https://www.csaf.io/) CSAF 2.0 format (VEX and Security Advisory) * **RSS** — release feeds for tracking updates Released fixes are also available via [tuxcare.com/cve-tracker](https://tuxcare.com/cve-tracker/fixes) and [security.tuxcare.com](https://security.tuxcare.com). ## PHP | OS | Errata | OVAL | CSAF | RSS | |----|--------|------|------|-----| | EL 7 | [errata](https://security.tuxcare.com/errata/els_alt_php/el7/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/el7/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/el7/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | EL 8 | [errata](https://security.tuxcare.com/errata/els_alt_php/el8/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/el8/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/el8/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | EL 9 | [errata](https://security.tuxcare.com/errata/els_alt_php/el9/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/el9/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/el9/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | EL 10 | [errata](https://security.tuxcare.com/errata/els_alt_php/el10/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/el10/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/el10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Ubuntu 16.04 | [errata](https://security.tuxcare.com/errata/els_alt_php/ubuntu16.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/ubuntu16.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/ubuntu16.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Ubuntu 18.04 | [errata](https://security.tuxcare.com/errata/els_alt_php/ubuntu18.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/ubuntu18.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/ubuntu18.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Ubuntu 20.04 | [errata](https://security.tuxcare.com/errata/els_alt_php/ubuntu20.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/ubuntu20.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/ubuntu20.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Ubuntu 22.04 | [errata](https://security.tuxcare.com/errata/els_alt_php/ubuntu22.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/ubuntu22.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/ubuntu22.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Ubuntu 24.04 | [errata](https://security.tuxcare.com/errata/els_alt_php/ubuntu24.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/ubuntu24.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/ubuntu24.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Debian 10 | [errata](https://security.tuxcare.com/errata/els_alt_php/debian10/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/debian10/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/debian10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Debian 11 | [errata](https://security.tuxcare.com/errata/els_alt_php/debian11/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/debian11/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/debian11/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Debian 12 | [errata](https://security.tuxcare.com/errata/els_alt_php/debian12/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/debian12/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/debian12/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Debian 13 | [errata](https://security.tuxcare.com/errata/els_alt_php/debian13/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_php/debian13/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/debian13/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | | Alpine Linux 3.22 | — | — | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_php/alpinelinux3.22/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=PHP) | ## Python | OS | Errata | OVAL | CSAF | RSS | |----|--------|------|------|-----| | EL 7 | [errata](https://security.tuxcare.com/errata/els_alt_python/el7/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/el7/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/el7/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | EL 8 | [errata](https://security.tuxcare.com/errata/els_alt_python/el8/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/el8/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/el8/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | EL 9 | [errata](https://security.tuxcare.com/errata/els_alt_python/el9/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/el9/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/el9/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | EL 10 | [errata](https://security.tuxcare.com/errata/els_alt_python/el10/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/el10/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/el10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Ubuntu 16.04 | [errata](https://security.tuxcare.com/errata/els_alt_python/ubuntu16.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/ubuntu16.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/ubuntu16.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Ubuntu 18.04 | [errata](https://security.tuxcare.com/errata/els_alt_python/ubuntu18.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/ubuntu18.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/ubuntu18.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Ubuntu 20.04 | [errata](https://security.tuxcare.com/errata/els_alt_python/ubuntu20.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/ubuntu20.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/ubuntu20.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Ubuntu 22.04 | [errata](https://security.tuxcare.com/errata/els_alt_python/ubuntu22.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/ubuntu22.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/ubuntu22.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Ubuntu 24.04 | [errata](https://security.tuxcare.com/errata/els_alt_python/ubuntu24.04/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/ubuntu24.04/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/ubuntu24.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Debian 10 | [errata](https://security.tuxcare.com/errata/els_alt_python/debian10/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/debian10/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/debian10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Debian 11 | [errata](https://security.tuxcare.com/errata/els_alt_python/debian11/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/debian11/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/debian11/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Debian 12 | [errata](https://security.tuxcare.com/errata/els_alt_python/debian12/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/debian12/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/debian12/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Debian 13 | [errata](https://security.tuxcare.com/errata/els_alt_python/debian13/) | [oval.xml](https://security.tuxcare.com/oval/els_alt_python/debian13/oval.xml) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/debian13/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | | Alpine Linux 3.22 | — | — | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_python/alpinelinux3.22/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Python) | ## Node.js | OS | Errata | CSAF | RSS | |----|--------|------|-----| | EL 7 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/el7/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el7/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | EL 8 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/el8/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el8/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | EL 9 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/el9/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el9/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | EL 10 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/el10/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Ubuntu 16.04 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/ubuntu16.04/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/ubuntu16.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Ubuntu 18.04 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/ubuntu18.04/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/ubuntu18.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Ubuntu 20.04 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/ubuntu20.04/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/ubuntu20.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Ubuntu 22.04 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/ubuntu22.04/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/ubuntu22.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Ubuntu 24.04 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/ubuntu24.04/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/ubuntu24.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Debian 10 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/debian10/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/debian10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Debian 11 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/debian11/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/debian11/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Debian 12 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/debian12/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/debian12/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Debian 13 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/debian13/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/debian13/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | | Alpine Linux 3.22 | [errata](https://security.tuxcare.com/errata/els_alt_nodejs/alpinelinux3.22/) | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_nodejs/alpinelinux3.22/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Node.js) | ## Ruby | OS | CSAF | RSS | |----|------|-----| | EL 7 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/el7/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | EL 8 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/el8/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | EL 9 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/el9/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | EL 10 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/el10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Ubuntu 16.04 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/ubuntu16.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Ubuntu 18.04 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/ubuntu18.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Ubuntu 20.04 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/ubuntu20.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Ubuntu 22.04 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/ubuntu22.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Ubuntu 24.04 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/ubuntu24.04/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Debian 10 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/debian10/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Debian 11 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/debian11/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Debian 12 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/debian12/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Debian 13 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/debian13/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | | Alpine Linux 3.22 | [csaf](https://security.tuxcare.com/csaf/v2/els_alt_ruby/alpinelinux3.22/) | [rss](https://tuxcare.com/cve-tracker/api/cves/export/rss?product=Ruby) | ## How to use OVAL OVAL can be used with the OpenSCAP tool. 1. Install OpenSCAP RPM: ``` yum install openscap openscap-utils scap-security-guide -y ``` DEB: ``` apt-get install libopenscap8 -y ``` 2. Download an OVAL stream. For example, Python on EL 8: ```text wget https://security.tuxcare.com/oval/els_alt_python/el8/oval.xml ``` 3. Run a scan: ```text oscap oval eval --results result.xml --report report.xml oval.xml ``` ## How to use CSAF Common Security Advisory Framework (CSAF) is a machine-readable format, standardized by [OASIS](https://www.csaf.io/). TuxCare publishes CSAF VEX and Security Advisory files in CSAF 2.0 format at [security.tuxcare.com](https://security.tuxcare.com/csaf/v2/). `provider-metadata.json` is available at: * [csaf.data.security.tuxcare.com](https://csaf.data.security.tuxcare.com/) * [tuxcare.com/.well-known/csaf/provider-metadata.json](https://tuxcare.com/.well-known/csaf/provider-metadata.json) The CSAF files are published in JSON format — OASIS provides a [list of reference tools](https://www.csaf.io/tools.html) that support CSAF. ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/nodejs/ ================================================================================ # Node.js Endless Lifecycle Support (ELS) for Node.js from TuxCare provides security fixes for Node.js versions that have reached their end-of-life. This allows you to continue running your server vulnerability-free. ## About ALT-Node.js alt-nodejs is a component provided by TuxCare designed for managing Node.js versions on servers and enabling users to run multiple Node.js versions simultaneously. Here are the key features and characteristics of alt-nodejs: * **Multiple Node.js Versions** - alt-nodejs allows the installation and usage of various Node.js versions on a single server. This enables users to select the Node.js version that best suits their applications. * **User Segmentation** - alt-nodejs allows administrators to provide different Node.js versions for different users or applications. Each user can choose the Node.js version that suits their project. * **Enhanced Compatibility** - alt-nodejs is designed to ensure maximum compatibility with various Node.js applications and frameworks. This includes optimizations and changes to make it compatible with a wide range of Node.js applications. * **Updates and Support** - TuxCare provides regular updates for alt-nodejs, including bug fixes, performance improvements, and updates for new Node.js versions. This helps ensure the security and currency of Node.js usage. * **Easy Version Switching** - alt-nodejs allows switching between versions; users can easily manage which Node.js version is active in their environment. alt-nodejs provides a more flexible and convenient environment for working with different Node.js versions on a single server, which is particularly useful in development and production environments where multiple applications have varying requirements for Node.js versions. ## Supported OS and Node.js versions | Operating Systems | Package Type | OS Version | Node.js versions | | :----------------------------------------------------------: | :----------: | :-------------------------------: | :-------------------------------: | | EL 7 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 7.x | 12, 14, 16, 18, 20 | | EL 8 (CentOS, CentOS Stream, CloudLinux, Oracle Linux, etc.) | RPM | 8.x | 12, 14, 16, 18, 20 | | EL 9 (AlmaLinux, CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 9.x | 12, 14, 16, 18, 20 | | EL 10 (AlmaLinux, CloudLinux, Oracle Linux, etc.) | RPM | 10.x | 14, 16, 18, 20 | | Ubuntu | DEB | 18.04, 20.04, 22.04, 24.04 | 12, 14, 16, 18, 20 | | Debian | DEB | 10, 11 | 12, 14, 16, 18, 20 | | Debian | DEB | 12 | 12, 14, 16, 18, 20, 23 | | Debian | DEB | 13 | 12, 14, 16, 18, 20, 22, 23, 24 | | Alpine Linux | APK | 3.22, 3.23 | 12, 14, 16, 18, 20, 22, 23, 24 | **Supported architectures:** * x86_64 — all supported OSes * arm64 — Debian 12 and 13 ## Installation * A valid TuxCare ELS license key — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server 1. Download the installer script RPM: ``` wget https://repo.alt.tuxcare.com/alt-nodejs-els/install-els-alt-nodejs-rpm-repo.sh ``` DEB: ``` wget https://repo.alt.tuxcare.com/alt-nodejs-els/install-els-alt-nodejs-deb-repo.sh ``` APK: ``` wget https://repo.alt.tuxcare.com/alt-nodejs-els/install-els-alt-nodejs-apk-repo.sh ``` 2. Run the installer script with your license key (see [Prerequisites](#prerequisites) above) The script registers the server with CLN, adds the PGP key and repository. RPM: ``` sh install-els-alt-nodejs-rpm-repo.sh --license-key XXX-XXXXXXXXXXXX ``` DEB: ``` bash install-els-alt-nodejs-deb-repo.sh --license-key XXX-XXXXXXXXXXXX ``` APK: ``` sh install-els-alt-nodejs-apk-repo.sh --license-key XXX-XXXXXXXXXXXX ``` 3. Install a Node.js version Each version can be installed individually or all versions at once. RPM: ``` yum install alt-nodejs18* ``` DEB: ``` apt-get install alt-nodejs18* ``` APK: ``` apk add 'alt-nodejs18*' ``` To install all versions at the same time: RPM: ``` yum groupinstall alt-nodejs ``` DEB: ``` apt-get install alt-nodejs ``` APK: ``` apk add alt-nodejs ``` To list available groups/meta-packages: RPM: ``` sudo yum group list ``` DEB: ``` apt list -a | grep alt-nodejs ``` APK: ``` apk search alt-nodejs ``` 4. Verify the installation Activate the desired version and check it returns the expected version: ```text source /opt/alt/alt-nodejs/enable node -v ``` 5. Update packages RPM: ``` yum update 'alt-nodejs*' ``` DEB: ``` apt-get update && apt-get --only-upgrade install 'alt-nodejs*' ``` APK: ``` apk update && apk upgrade 'alt-nodejs*' ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Node.js) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Node.js) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Node.js) — Full list of product parts covered by ELS * ![](/images/shield.webp) [Machine-readable security data](/els-for-runtimes/machine-readable-security-data/#node.js) — CSAF advisories and RSS feeds for Node.js ELS ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/openjdk/ ================================================================================ # OpenJDK Endless Lifecycle Support (ELS) from TuxCare provides security fixes for OpenJDK versions that have reached end-of-life. This allows you to continue running your OpenJDK-based applications without vulnerability concerns, even after official support has ended. ## Supported OS and OpenJDK versions | OS | Package Type | OS Version | OpenJDK version | | :-------------------------------------------: | :----------: | :--------: | :-------------: | | EL 6 (CentOS, CloudLinux, Oracle Linux) | RPM | 6.x | 7, 8 | | EL 7 (CentOS, CloudLinux, Oracle Linux, RHEL) | RPM | 7.x | 8, 11 | | EL 8 (CentOS, CentOS Stream) | RPM | 8.x | 8, 11 | | EL 9 (AlmaLinux, TuxCare ESU) | RPM | 9.x | 8, 11, 17 | **Supported architecture:** x86_64 (64-bit) ## Installation Docker compatible * A valid TuxCare ELS license key — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server 1. Download the installer script ```text wget https://repo.tuxcare.com/openjdk-els/install-openjdk-els-repo.sh ``` 2. Run the installer script with your license key (see [Prerequisites](#prerequisites) above) ```text sh install-openjdk-els-repo.sh --license-key XXXXXXXXXXX ``` 3. Verify the repository is enabled ```text yum repolist | grep openjdk-els ``` 4. Install OpenJDK ```text yum install java-1.7.0-openjdk ``` ```text yum install java-1.8.0-openjdk ``` ```text yum install java-11-openjdk ``` ```text yum install java-17-openjdk ``` 5. Verify the installation ```text java -version ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?q=openjdk&product=CentOS+6+ELS&product=CloudLinux+6+ELS&product=Oracle+Linux+6+ELS&product=CentOS+7+ELS&product=CloudLinux+7+ELS&product=Oracle+Linux+7+ELS&product=RHEL+7+ELS&product=CentOS+8.4+ELS&product=CentOS+8.5+ELS&product=CentOS+Stream+8+ELS&product=AlmaLinux+9+ELS) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?q=openjdk&product=CentOS+6+ELS&product=CloudLinux+6+ELS&product=Oracle+Linux+6+ELS&product=CentOS+7+ELS&product=CloudLinux+7+ELS&product=Oracle+Linux+7+ELS&product=RHEL+7+ELS&product=CentOS+8.4+ELS&product=CentOS+8.5+ELS&product=CentOS+Stream+8+ELS&product=AlmaLinux+9+ELS) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?q=openjdk&product=CentOS+6+ELS&product=CloudLinux+6+ELS&product=Oracle+Linux+6+ELS&product=CentOS+7+ELS&product=CloudLinux+7+ELS&product=Oracle+Linux+7+ELS&product=RHEL+7+ELS&product=CentOS+8.4+ELS&product=CentOS+8.5+ELS&product=CentOS+Stream+8+ELS&product=AlmaLinux+9+ELS) — Full list of product parts covered by ELS ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/php/ ================================================================================ # PHP Endless Lifecycle Support (ELS) for PHP from TuxCare provides security fixes for PHP versions that have reached their end-of-life. This allows you to continue running your server vulnerability-free. ## About ALT-PHP alt-php is a component provided by TuxCare designed for managing PHP versions on web servers and enabling users to choose PHP versions for their websites. Here are the key features and characteristics of alt-php: * **Multiple PHP Versions** - alt-php allows the installation and usage of various PHP versions on a single web server. This enables users to select the PHP version that best suits their web applications. * **User Segmentation** - alt-php allows hosting providers and web server administrators to provide different PHP versions for different users. Each user can choose the PHP version that suits their website. * **Enhanced Compatibility** - alt-php is designed to ensure maximum compatibility with various web applications and frameworks. This includes optimizations and changes to make it compatible with a wide range of PHP applications. * **Updates and Support** - CloudLinux provides regular updates for alt-php, including bug fixes, performance improvements, and updates for new PHP versions. This helps ensure the security and currency of PHP usage. * **Management Tools** - alt-php usually comes with a set of management tools, such as PHP Selector, allowing users to manage PHP versions and enable/disable various PHP extensions. alt-php provides a more flexible and convenient environment for working with different PHP versions on a single server, which is particularly useful in a web hosting environment where multiple users have varying requirements for PHP versions for their web applications. ## Supported OS and PHP versions | OS | Package Type | OS Version | PHP versions | | :----------------------------------------------------------------------: | :----------: | :-------------------------------: | :-----------------------------------------------------------------------: | | EL 7 ( Amazon Linux 2, CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 7.x | 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | EL 8 ( AlmaLinux, CentOS, CentOS Stream, CloudLinux, Oracle Linux, etc.) | RPM | 8.x | 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | EL 9 ( AlmaLinux, CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 9.x | 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | EL 10 ( AlmaLinux, CloudLinux, Oracle Linux, etc.) | RPM | 10.x | 5.3, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | Ubuntu | DEB | 16.04 | 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | Ubuntu | DEB | 18.04, 20.04, 22.04, 24.04 | 5.2, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | Debian | DEB | 10, 11, 12 | 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | Debian | DEB | 13 | 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | | Alpine Linux | APK | 3.22, 3.23 | 7.3, 7.4, 8.0, 8.1 | | Windows | - | Windows Server 2019, 2022, 2025 | 5.2, 5.4, 5.6, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2 | **Supported architectures:** * x86_64 — all supported Linux OSes * aarch64/arm64 — Debian 12 and 13, Alpine Linux 3.22 and later * Windows — x64 (64-bit) and x86 (32-bit) builds TuxCare provides additional security support for PHP versions after the end of support from the vendor. *EOL — end of life, SST — security support time* | Version | Released | EOL by vendor | SST by vendor (years) | EOL by CloudLinux | SST by CloudLinux after vendor's EOL (years) | |:-------:|:----------:|:-------------:|:---------------------:|:-----------------------:|:--------------------------------------------:| | 4.4 | 07.11.2005 | 08.07.2008 | 2.7 | [01.07.2023](https://blog.cloudlinux.com/php-4.4-end-of-life-0) | 14.9 | | 5.1 | 23.11.2005 | 24.08.2006 | 0.8 | [01.04.2024](https://blog.cloudlinux.com/php-5.1-end-of-life) | 17.6 | | 5.2 | 01.11.2006 | 06.01.2011 | 4.2 | | 5.3 | 29.06.2009 | 14.08.2014 | 5.1 | | 5.4 | 29.02.2012 | 14.09.2015 | 3.5 | | 5.5 | 19.06.2013 | 21.07.2016 | 3.1 | | 5.6 | 27.08.2014 | 31.12.2018 | 4.3 | | 7.0 | 12.01.2015 | 10.01.2019 | 3.9 | | 7.1 | 30.11.2016 | 01.12.2019 | 3.0 | | 7.2 | 28.11.2017 | 30.11.2020 | 3.0 | | 7.3 | 04.12.2018 | 06.12.2021 | 3.0 | | 7.4 | 26.11.2019 | 28.11.2022 | 3.0 | | 8.0 | 24.11.2020 | 26.11.2023 | 3.0 | | 8.1 | 23.11.2021 | 25.11.2024 | 3.0 | | 8.2 | 08.12.2022 | 08.12.2025 | 3.0 | ## Installation on Linux * A valid TuxCare ELS license key — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server * **Amazon Linux 2-specific.** Before installing `alt-php`, make sure `libvpx` is installed. Amazon Linux 2 provides two versions of libvpx: 1.9 (the default) and 1.3. `alt-php` requires 1.3 for compatibility with EL 7 systems like CentOS 7: ``` sudo yum install libvpx-1.3.0 ``` 1. Download the installer script RPM: ``` wget https://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-rpm-repo.sh ``` DEB: ``` wget https://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-deb-repo.sh ``` APK: ``` wget https://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-apk-repo.sh ``` 2. Run the installer script with your license key (see [Prerequisites](#prerequisites) above) The script registers the server with CLN, adds the PGP key and repository. RPM: ``` sh install-els-alt-php-rpm-repo.sh --license-key XXX-XXXXXXXXXXXX ``` DEB: ``` bash install-els-alt-php-deb-repo.sh --license-key XXX-XXXXXXXXXXXX ``` APK: ``` sh install-els-alt-php-apk-repo.sh --license-key XXX-XXXXXXXXXXXX ``` If [Imunify360](https://docs.imunify360.com/) is installed on the server and has a valid license, you can install alt-php (HardenedPHP) without a separate ELS license key. Run the installer with the `-i` (`--imunify`) option instead of `--license-key` — your Imunify access credentials are used automatically for repository access: RPM: ``` sh install-els-alt-php-rpm-repo.sh --imunify ``` DEB: ``` bash install-els-alt-php-deb-repo.sh --imunify ``` APK: ``` sh install-els-alt-php-apk-repo.sh --imunify ``` 3. Install a PHP version Each version can be installed individually or all versions at once. RPM: ``` yum groupinstall alt-php73 ``` DEB: ``` apt-get install alt-php73-meta ``` APK: ``` apk add alt-php73 ``` To install all versions at the same time: RPM: ``` yum groupinstall alt-php ``` DEB: ``` apt-get install alt-php ``` APK: ``` apk add alt-php ``` 4. Verify the installation Check that the desired PHP version is installed: RPM: ``` rpm -qa | grep alt-php ``` DEB: ``` dpkg -l | grep alt-php ``` APK: ``` apk info | grep alt-php ``` ### Useful Commands and Usage When you deploy an updated version of PHP through PHP ELS, using your system's regular update tool (yum, dnf, apt), the new version will be installed under `/opt/alt/php[version]/`. This means that all modules, configurations and additional files pertaining to this version will be contained inside that path. Different versions of PHP will each have their own path and can coexist without issues on the same system. Below you will find the location of all the relevant files, should you want to make any changes. To check whether the package is installed and see its current version, use the following command based on your OS: RPM: ``` sudo yum list installed | grep php ``` DEB: ``` dpkg -l | grep php ``` APK: ``` apk info -v | grep alt-php ``` To find out which groups/meta-packages are available for installation: RPM: ``` sudo yum group list ``` DEB: ``` apt list -a | grep alt-php ``` APK: ``` apk search alt-php ``` To get a list of packages of a specific group or meta package: RPM: ``` sudo yum groupinfo alt-phpXY ``` DEB: ``` apt-cache showpkg alt-phpXY ``` APK: ``` apk info -R alt-phpXY ``` Replace `XY` with a version of alt-php. 1. Check for updates: RPM: ``` sudo yum check-update ``` DEB: ``` sudo apt-get update apt list --upgradable ``` APK: ``` sudo apk update apk list --upgradable ``` 2. Update packages: * Update all groups/meta-packages with names starting with "alt-php": RPM: ``` sudo yum update alt-php* ``` DEB: ``` sudo apt-get upgrade alt-php* ``` APK: ``` sudo apk upgrade 'alt-php*' ``` * Update a specific version: RPM: ``` sudo yum groupupdate alt-phpXY ``` DEB: ``` sudo apt-get upgrade alt-phpXY ``` APK: ``` sudo apk upgrade alt-phpXY ``` Replace `XY` with a version of alt-php. RPM: ``` sudo yum search alt-package-name ``` DEB: ``` sudo apt search alt-package-name ``` APK: ``` apk search alt-package-name ``` Replace `alt-package-name` with the specific name of the package you are looking for. **Bin files:** `ls -l /opt/alt/phpXY/usr/bin/` **Modules:** `ls /opt/alt/phpXY/usr/lib64/php/modules/` **Config files:** `/opt/alt/phpXY/etc/php.d.all/` **default.ini:** `/opt/alt/phpXY/etc/php.d/default.ini` **Run PHP CLI:** `/opt/alt/phpXY/usr/bin/php helloworld.php` **List enabled modules:** `/opt/alt/php73/usr/bin/php -m` **Option 1: Through `default.ini`** 1. Open `/opt/alt/phpXY/etc/php.d/default.ini` in an editor. 2. Remove `;` to enable an extension, add `;` to disable. 3. If the extension line is missing, add: `extension=extension_name.so` **Option 2: Through configuration files** 1. Locate the extension's `.ini` file in `/opt/alt/phpXY/etc/php.d.all/` 2. Copy it to `/opt/alt/phpXY/etc/php.d/` If the same extension is present in multiple `.ini` files within `/opt/alt/phpXY/etc/php.d/`, you may see warnings in PHP logs. **Option 3: Through the CLI** ```text /opt/alt/php73/usr/bin/php -d "extension=igbinary.so" -m ``` 1. Open the `default.ini` file in an editor. 2. Set the limits as needed: ```text upload_max_filesize=40M post_max_size=40M memory_limit=256M ``` ## Installation on Windows TuxCare provides two ways to install ELS PHP on Windows: **manually** by downloading and configuring PHP from the repository, or using the **TuxCare Installer** — a graphical tool that automates the process. * Secure download link (tokenized URL) — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * Administrator access to the Windows system Always include a **trailing slash** at the end of your tokenized URL (e.g. `https://TOKEN@windows.tuxcare.com/php/`). Without it, the server issues a redirect that strips the authentication token, causing the browser to prompt for credentials on every page. With the trailing slash, credentials are cached and subfolder navigation works as expected.
How to use a tokenized URL Your tokenized URL provides access to the TuxCare PHP for Windows repository. It contains an authentication token embedded in the URL: ```text https://@windows.tuxcare.com/php/ ``` **Always include the trailing slash.** This applies to all directory URLs, including version subfolders: - ✅ `https://TOKEN@windows.tuxcare.com/php/` — works correctly - ❌ `https://TOKEN@windows.tuxcare.com/php` — may prompt for credentials **Use a private browsing window.** We recommend opening the tokenized URL in a private (incognito) window to ensure a clean session with no cached credentials that might interfere with token authentication. - **Chrome / Edge**: `Ctrl+Shift+N` (Windows) or `Cmd+Shift+N` (macOS) - **Firefox**: `Ctrl+Shift+P` (Windows) or `Cmd+Shift+P` (macOS) **Browsing subdirectories.** Once you open the URL with a trailing slash in a private window, the browser caches your credentials for the session. If you are still prompted when entering a subdirectory, manually insert the token into the URL — prepend `@` before `windows.tuxcare.com` in the address bar. **Example walkthrough:** 1. Open the repository root: ```text https://@windows.tuxcare.com/php/ ``` 2. Click on `7.4.33/`. If the browser navigates to `https://windows.tuxcare.com/php/7.4.33/` and prompts for a password, edit the address bar and add the token: ```text https://@windows.tuxcare.com/php/7.4.33/ ``` 3. Click on `tuxcare.els8/`. If prompted again, add the token to the URL: ```text https://@windows.tuxcare.com/php/7.4.33/tuxcare.els8/ ``` 4. You see the ZIP files listed. Click on the file to download it directly. **Downloading files directly.** If you already know which file you need, skip browsing and build the full URL from the repository root, version, release folder, and file name: ```text https://@windows.tuxcare.com /php//tuxcare.els/.zip ``` PowerShell: ```text $base = "https://@windows.tuxcare.com" $file = "/php/7.4.33/tuxcare.els8/" + "php-7.4.33-tuxcare-els8-nts-Win32-vc15-x64-signed.zip" Invoke-WebRequest -Uri "$base$file" -OutFile "php-7.4.33.zip" ``` curl: ```text BASE="https://@windows.tuxcare.com" FILE="/php/7.4.33/tuxcare.els8/\ php-7.4.33-tuxcare-els8-nts-Win32-vc15-x64-signed.zip" curl -O "${BASE}${FILE}" ```

1. Open the repository in your browser Navigate to your tokenized URL (see [Prerequisites](#windows-prerequisites) above): ```text https://@windows.tuxcare.com/php/ ``` You will see a directory listing of all available PHP versions (e.g. `5.6.40/`, `7.4.33/`, `8.1.33/`). Click on the version you need. 2. Choose the correct archive Inside each version folder you will find subfolders named `tuxcare.elsN/`, where `N` is the TuxCare release number. Always select the subfolder with the **highest** number, as it contains the latest security updates. Each archive follows this naming pattern: ```text php--tuxcare-els--Win32---signed.zip ``` Select the archive that matches your environment: | Component | Options | How to choose | | --- | --- | --- | | **Thread safety** | `nts` (Non-Thread Safe) or `ts` (Thread Safe) | Use `nts` for IIS with FastCGI, nginx, or CLI. Use `ts` only for Apache `mod_php`. | | **Architecture** | `x64` or `x86` | Use `x64` for 64-bit Windows (most common). Use `x86` only for 32-bit systems. | | **VC runtime** | `vc15`, `vs16`, `vs17`, etc. | Indicates the required Visual C++ Redistributable. Download from [Microsoft](https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist) if not installed. | For example, to install PHP 7.4 (NTS, 64-bit), download `php-7.4.33-tuxcare-els8-nts-Win32-vc15-x64-signed.zip`. This archive requires the **Visual C++ Redistributable for Visual Studio 2017** (`vc15`). 3. Extract the archive Create a destination folder (e.g. `C:\PHP`) and extract the ZIP contents into it. Right-click the downloaded ZIP file, select **Extract All...**, set the destination, and click **Extract**. Alternatively, use PowerShell: ```text New-Item -ItemType Directory -Path "C:\PHP" -Force Expand-Archive ` -Path "$HOME\Downloads\php-7.4.33-tuxcare-els8-nts-Win32-vc15-x64-signed.zip" ` -DestinationPath "C:\PHP" ``` After extraction, your directory should contain `php.exe`, `php.ini-development`, `php.ini-production`, and an `ext` folder with extension DLLs. 4. Configure php.ini Create a configuration file from one of the provided templates — copy `php.ini-development` for development or `php.ini-production` for production to `php.ini`: ```text Copy-Item "C:\PHP\php.ini-production" "C:\PHP\php.ini" ``` Open `C:\PHP\php.ini` in a text editor, set the extension directory, and enable the extensions your application requires: ```text extension_dir = "C:\PHP\ext" extension=curl extension=mbstring extension=mysqli extension=openssl ``` 5. Add PHP to the System PATH To make `php` available from any terminal, add the PHP directory to the System PATH. Open **Settings > System > About** → **Advanced system settings** → **Environment Variables**. Under *System variables*, find **Path**, click **Edit**, then click **New** and add `C:\PHP`. Alternatively, use PowerShell (run as Administrator): ```text $currentPath = [System.Environment]::GetEnvironmentVariable("Path", "Machine") [System.Environment]::SetEnvironmentVariable("Path", "$currentPath;C:\PHP", "Machine") ``` Close and reopen any terminal windows for the change to take effect. 6. Verify the installation Open **Command Prompt**, **PowerShell**, or **Terminal** and run: ```text php -v ``` You should see output like: ```text PHP 7.4.33 (cli) (built: Mar 10 2026 10:12:00) Copyright (c) The PHP Group Zend Engine v3.4.0, Copyright (c) Zend Technologies ``` To verify that the required extensions are loaded, run `php -m`. TuxCare Installer allows you to install and manage ELS PHP versions through a graphical interface on Windows Server 2019, 2022, and 2025. 1. Download the installer and launch it Download the installer using your tokenized URL (see [Prerequisites](#windows-prerequisites) above): ```text https://@windows.tuxcare.com/php/installer/TuxCare.Installer.exe ``` Run the downloaded file. After the first run, the installer appears under **Settings > Apps**. 2. Register with your license key or authentication token ![image](/images/php-installer-token.webp) If you've already registered on this machine and saved your credentials, the installer detects and uses the saved token automatically. 3. Select a PHP version Tick the checkbox next to the version you want. **Only 1 version can be installed per installation**. ![image](/images/php-installer-version.webp) If you already have a version installed, it will appear highlighted in green. When another version is selected, the installer will ask whether to **replace** the existing one or install it **alongside**. ![image](/images/php-installer-versions-2.webp) 4. Choose installation path and load modules By default, the installer uses `C:\Program Files`. Click **Change** to install to a different location. Click **Load** to fetch the required PHP archive. Select the modules you need and click **Continue**. ![image](/images/php-installer-load.webp) 5. Verify the installation Open **Command Prompt**, **PowerShell**, or **Terminal** and run: ```text php -v ``` You should see output like: ```text PHP 5.6.40 (cli) (built: May 30 2025 15:43:43) Copyright (c) 1997-2016 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies ``` During installation, the installer creates a folder with PHP configuration and selected modules, and adds TuxCare PHP to the **System PATH**.
How to find System PATH 1. Right-click **This PC** and select **Properties**, or search for **Settings > System > About** in the Start menu. 2. Click **Advanced system settings**. ![image](/images/php-windows-advanced-settings.webp) 3. Click on **Environment Variables**. ![image](/images/php-windows-environment-variables.webp) 4. Under *System variables*, find **Path** and click **Edit**. ![image](/images/php-windows-add-path.webp) 5. You will see your PHP `C:\PHP` directory added. ![image](/images/php-windows-add-path-2.webp)
### Additional configurations Depending on your ELS PHP usage purpose, additional configurations may be required. You can integrate PHP with other tools, for example, IIS or WordPress. For further details, refer to the [official PHP documentation](https://www.php.net/manual/en/index.php). #### Change default PHP version If you have multiple PHP versions installed and want to change the default, update your **System Path** environment variable. Open **Settings > System > About** → **Advanced system settings** → **Environment Variables**. Under *System variables*, find **Path** and click **Edit**. Move the desired PHP version's path to the top, and remove or move down other PHP paths. Click OK, restart your terminal, and verify with `php -v`. #### Extensions Extensions are managed through the `php.ini` file located in your PHP installation directory (e.g. `C:\PHP`). Open it in a text editor and find the extensions section. Remove the semicolon `;` at the beginning of a line to enable an extension, or add `;` to disable it. ```text ;extension=curl extension=gd2 ;extension=mbstring extension=mysqli extension=pdo_mysql ``` #### Increase upload/memory limits If you're integrating PHP with applications like WordPress, you might need to increase memory and upload size limits. Open the `php.ini` file and set the values as needed: ```text upload_max_filesize=40M post_max_size=40M memory_limit=256M ``` #### Uninstallation To **uninstall a PHP version manually**, delete the PHP installation directory (e.g. `C:\PHP`) and remove the corresponding path from **System Path**. To **uninstall via TuxCare Installer**, open **Settings > Apps**, find *TuxCare Installer* and click **Uninstall**. ## SaxonC Use Case You can extend alt-php with additional modules. Below is an example of installing the SaxonC PHP extension. Although this guide uses **alt-php82** in its examples, the same installation steps apply to **alt-php83** and newer versions. Replace `php82` with your target version in all commands and file paths. This guide also uses **SaxonC-HE** as an example. Be sure to adjust file names and paths to match the version you downloaded. * Saxon 12+ (required for PHP 8.2+ compatibility) — download from [saxonica.com](https://www.saxonica.com/download/c.xml) * `httpd` (or `apache2`), `gcc-c++` (or `g++`) with minimum C++14 support * `alt-php82-devel` (or matching version) | Edition | License | Key Features | | --------- | ----------- | --------------------------------------- | | SaxonC-HE | Open Source | XSLT 3.0, XPath 3.1, XQuery 3.1 (Basic) | | SaxonC-PE | Commercial | HE + ICU localization, JSON support | | SaxonC-EE | Commercial | PE + Schema validation, Optimization | ### Set up SaxonC 1. Download SaxonC Download from the [official Saxonica download page](https://www.saxonica.com/download/c.xml). Create a working directory and move the downloaded zip file into it: ```text mkdir saxon && cd saxon mv ../SaxonCHE-linux-x86_64-12-9-0.zip . ``` 2. Extract the archive Unzip the downloaded file and verify: ```text unzip SaxonCHE-linux-x86_64-12-9-0.zip ls ``` Example output: ```text SaxonCHE-linux-x86_64-12-9-0 SaxonCHE-linux-x86_64-12-9-0.zip ``` 3. Install the libraries Starting with version 12.6, `/opt/saxonica/` is the recommended installation path. Navigate into the extracted directory and copy all Saxon files: ```text cd SaxonCHE-linux-x86_64-12-9-0 sudo mkdir -p /opt/saxonica/ sudo cp -r SaxonCHE/* /opt/saxonica/ ``` The installed structure should contain `bin`, `include`, and `lib` directories. 4. Configure environment variables Add the following lines to your `.bashrc` or `/etc/profile.d/saxon.sh`. The `LD_LIBRARY_PATH` variable must point to the Saxon libraries: ```text export LD_LIBRARY_PATH="/opt/saxonica/lib:$LD_LIBRARY_PATH" ``` To run the Transform, Query, and Validate (EE only) binaries, set the `PATH` variable: ```text export PATH="/opt/saxonica/bin:$PATH" ``` If the PHP web server can't find the Saxon libraries, you may also need to add `/opt/saxonica/lib` to a new file in `/etc/ld.so.conf.d/` and run `ldconfig`. ### Build the PHP extension 1. Install alt-php82-devel Install the development package required for compiling PHP extensions: ```text dnf install alt-php82-devel ``` Verify that `phpize` is available: ```text ls /opt/alt/php82/usr/bin/phpize ``` 2. Prepare the build environment Navigate to the PHP extension source directory within the extracted Saxon archive and run `phpize` to prepare the build: ```text cd php/src/ /opt/alt/php82/usr/bin/phpize ``` Example output: ```text Configuring for: PHP Api Version: 20220829 Zend Module Api No: 20220829 Zend Extension Api No: 420220829 ``` 3. Configure and compile Configure the extension build with Saxon support and link to the Saxon libraries: ```text ./configure --with-saxon --with-php-config=/opt/alt/php82/usr/bin/php-config LDFLAGS="-L/opt/saxonica/lib" ``` Compile and install: ```text make sudo make install ``` Example output: ```text Installing shared extensions: /opt/alt/php82/usr/lib64/php/modules/ ``` 4. Enable the extension Create a configuration file that tells PHP to load the extension: ```text tee -a /opt/alt/php82/etc/php.d/20-saxon.ini <newXslt30Processor(); $executable = $transformer->compileFromString(" "); $root = $executable->callTemplateReturningValue("go"); $node = $root->getHead()->getNodeValue(); echo "$node \n"; EOF ``` Example output: ```text ``` If you are using php-fpm or Apache, restart the services. ## PHP extensions list PHP extensions are modules that extend the functionality of the PHP programming language. These extensions provide additional capabilities for working with various types of data, performing specific tasks, interacting with external resources and supporting various protocols. The PHP core includes many built-in extensions that provide basic functionality, such as working with databases, string processing, working with images, and others. However, to support more specific tasks and third-party libraries, you can use additional PHP extensions.
| | | | | | |-|-|-|-|-| |Reflection
SPL
SimpleXML
apc
apm
ares
bcmath
bcompiler
big_int
bitset
bloomy
bz2
bz2_filter
calendar
coin_acceptor
crack
ctype
curl
date
dba
dbase
dbx
dom
doublemetaphone
eaccelerator
enchant
exif
ffmpeg* | fileinfo
filter
ftp
gd
gender
geoip
geos
gettext
gmagick
gmp
gnupg
haru
hash
hidef
htscanner
http
huffman
iconv
idn
igbinary
imagick
imap
inclued
inotify
interbase
intl
ioncube_loader| json
ldap
libxml
lzf
mailparse
mbstring
mcrypt
memcache
memcached
mhash
mongo
msgpack
mssql
mysql
mysqli
ncurses
oauth
odbc
opcache
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_firebird |
pdo_mysql
pdo_oci*
pdo_odbc
pdo_pgsql
pdo_sqlite
pgsql
phar
posix
pspell
quickhash
radius
rar
readline
recode
redis
rsync
session
shmop
snmp
soap
sockets
sourceguardian
spl_types
sqlite
ssh2
standard
stats
stem | stomp
suhosin
sybase_ct
sysvmsg
sysvsem
sysvshm
tidy
timezonedb
tokenizer
translit
uploadprogress
uuid
wddx
xcache
xcache_3
xdebug
xhprof
xml
xmlreader
xmlrpc
xmlwriter
xrange
xsl
yaf
yaz
zend_optimizer
zip
zlib|
* CentOS 7, CloudLinux 7, etc.
| | | | | | |-|-|-|-|-| |amqp
apc
apcu
apm
ares
bcmath
bcompiler
big_int
bitset
bloomy
brotli
bz2
bz2_filter
calendar
clamav*
coin_acceptor
core
crack
ctype
curl
date
dba
dbase
dbx
dom
doublemetaphone
eaccelerator
eio
enchant
ereg
exif
ffmpeg*
fileinfo
filter
ftp | functional
gd
gender
geoip
geos
gettext
gmagick
gmp
gnupg
haru
hash
hidef
htscanner
http
huffman
iconv
idn
igbinary
imagick
imap
inclued
inotify
interbase
intl
ioncube_loader
jsmin
json
ldap
libevent
libxml
lzf | mailparse
mbstring
mcrypt
memcache
memcached
mhash
mongo
msgpack
mssql
mysql
mysqli
mysqlnd
ncurses
nd_mysql
nd_mysqli
nd_pdo_mysql
oauth
odbc
opcache
openssl
pcntl
pcre
pdf
pdo
pdo_oci*
pdo_dblib
pdo_firebird
pdo_mysql
pdo_odbc
pdo_pgsql
pdo_sqlite
pgsql | phalcon*
phar
posix
propro
pspell
quickhash
radius
raphf
rar
readline
recode
redis
reflection
rsync
session
shmop
simplexml
snmp
soap
sockets
sourceguardian
solr
spl
spl_types
sqlite
sqlite3
ssh2
standard
stats
stem
stomp
suhosin | sybase_ct
sysvmsg
sysvsem
sysvshm
tidy
tideways
timezonedb
tokenizer
trader
translit
uploadprogress
uri_template
uuid
wddx
weakref
xcache*
xcache_3
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xrange
xsl
xhprof
yaf
yaml
yaz
zend_guard_loader
zip
zlib
zmq|
* CentOS 7, CloudLinux 7, etc.
| | | | | | |-|-|-|-|-| |aapm**
amqp
apc
apcu
apm
ares
bcmath
big_int
bitset
brotli
bz2
bz2_filter
calendar
core
ctype
curl
clos_ssa
date
dba
dbase
dbx
dom
doublemetaphone
eaccelerator
eio
enchant
ereg
exif
ffmpeg*
fileinfo
filter
ftp
functional
gd
gender | geoip
geos
gettext
gmagick
gmp
gnupg
haru
hash
hidef
htscanner
http
iconv
igbinary
imagick
imap
inclued
inotify
interbase
intl
ioncube_loader
json
ldap
libevent
libsodium
libxml
lzf
luasandbox*
mailparse
mbstring| mcrypt
memcache
memcached
mhash
mongo
mongodb
msgpack
mssql
mysql
mysqli
mysqlnd
ncurses
nd_mysql
nd_mysqli
nd_pdo_mysql
oauth
oci8*
odbc
opcache
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_oci*
pgsql
phalcon*
phar | posix
propro
pspell
quickhash
radius
raphf
rar
readline
recode
redis
reflection
rsync
session
shmop
simplexml
snmp
soap
sockets
solr
sourceguardian
spl
spl_types
sqlite3
ssh2
standard
stats
stem
stomp
suhosin
sybase_ct
sysvmsg | sysvsem
sysvshm
tidy
tideways
timezonedb
tokenizer
trader
translit
uploadprogress
uri_template
uuid
wddx
weakref
xcache*
xcache_3
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xrange
xray**
xsl
xhprof
jsmin
yaf
yaml
yaz
zend_guard_loader
zip
zlib
zmq|
* CentOS 7, CloudLinux 7, etc. ** CentOS 7, CentOS 8, CloudLinux 7, CloudLinux 8, etc.
| | | | | | |-|-|-|-|-| |aapm*
amqp
apcu
apm
ares
bcmath
big_int
bitset
brotli
bz2
bz2_filter
calendar
clamav*
core
ctype
curl
clos_ssa
date
dba
dbase
dbx
dom
doublemetaphone
diseval
eio
enchant
ereg
exif
ffmpeg*
fileinfo
filter
ftp
gd
gender
geoip | geos
gettext
gmagick
gmp
gnupg
gRPC
haru
hash
hidef
htscanner
http
iconv
igbinary
imagick
imap
inotify
interbase
intl
ioncube_loader
jsmin
json
ldap
libevent
libsodium
libxml
lzf
luasandbox*
mailparse
mbstring
mcrypt | memcache
memcached
mhash
mongo
mongodb
msgpack
mssql
mysql
mysqli
mysqlnd
ncurses
nd_mysql
nd_mysqli
nd_pdo_mysql
oauth
oci8*
odbc
opcache*
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_oci*
pgsql | phalcon*
phalcon3
phar
posix
postal*
propro
pspell
quickhash
radius
raphf
rar
readline
recode
redis
reflection
rsync
session
shmop
simplexml
snmp
soap
sockets
sourceguardian
solr
spl
spl_types
sqlite3
ssh2
standard
stats
stem
stomp
suhosin | sybase_ct
sysvmsg
sysvsem
sysvshm
tidy
tideways
timezonedb
tokenizer
trader
translit
uploadprogress
uri_template
uuid
wddx
weakref
xcache_3
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xrange
xray
xsl
xhprof
yaf
yaml
yaz
zend_guard_loader
zip
zlib
zmq |
* CentOS 7, CloudLinux 7, etc.
| | | | | | |-|-|-|-|-| |aapm*
amqp
apcu
apm
ares
bcmath
big_int
bitset
brotli
bz2
bz2_filter
calendar
core
ctype
curl
clos_ssa*
date
dba
dbase
dbx
dom
doublemetaphone
diseval
eio
enchant
ereg
exif
ffmpeg*
fileinfo
filter
ftp
gd
gender
geoip
gettext | geos
gmagick
gmp
gnupg
gRPC
haru
hash
htscanner
http
iconv
igbinary
imagick
imap
inotify
interbase
intl
ioncube_loader
jsmin
json
ldap
libevent
libsodium
libxml
lzf
luasandbox*
mailparse
mbstring
mcrypt
memcache
memcached
mhash | mongo
mongodb
msgpack
mssql
mysql
mysqli
mysqlnd
ncurses
nd_mysql
nd_mysqli
nd_pdo_mysql
oauth
oci8
odbc
opcache*
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_oci*
pgsql
phalcon*
phalcon3 | phar
posix
postal*
propro
pspell
quickhash
radius
raphf
rar
readline
recode
redis
reflection
rsync
session
shmop
simplexml
snmp
soap
sockets
sourceguardian
spl
spl_types
sqlite3
ssh2
standard
stats
stem
stomp
solr | suhosin
sybase_ct
sysvmsg
sysvsem
sysvshm
tidy
timezonedb
tokenizer
trader
translit
tideways
uploadprogress
uri_template
uuid
wddx
xcache_3
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xrange
xray
xsl
xhprof
yaml
yaz
zend_guard_loader
zip
zlib
zmq|
* CentOS 7, CloudLinux 7, etc.
| | | | | | |-|-|-|-|-| |aapm*
amqp
apcu
bcmath
bitset
brotli
bz2
clos_ssa*
calendar
core
ctype
curl
date
dba
dbase
dom
diseval
eio
enchant
exif
fileinfo
filter
ftp
ffmpeg*
gd
gearman
gender
geos | geoip
gettext
gmagick
gmp
gnupg
gRPC
hash
htscanner
http
iconv
igbinary
imagick
imap
inotify
interbase
intl
ioncube_loader
jsmin
json
ldap
libsodium
libxml
lzf
luasandbox*
mailparse
mbstring
mcrypt | memcached
memcache
mongodb
mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
_newrelic_
oauth
oci8*
odbc
opcache
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql
psr
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_sqlsrv
pdo_oci
pgsql
phalcon3
phar | posix
postal*
propro
pspell
phalcon4
raphf
rar
readline
rrd
redis
reflection
recode
session
shmop
simplexml
snmp
snuffleupagus
soap
sockets
sourceguardian
sodium
solr
spl
sqlite3
sqlsrv
ssh2
standard
stats
suhosin7
sysvmsg | swoole
sysvsem
sysvshm
tidy
timezonedb
tokenizer
trader
tideways_xhprof
uploadprogress
uuid
vips*
vld*
wddx
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xray
xsl
yaml
yaz
yaf
zip
zlib
zmq|
* CentOS 7, CloudLinux 7, etc. To use `newrelic` extension you should set your own `New Relic License Key` in your own `/opt/alt/php7*/etc/php.ini` file. Please find more info about New Relic License Key in the [New Relic documentation](https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/license-key).
| | | | | | |-|-|-|-|-| |aapm*
amqp
snuffleupagus
vld
apcu
bcmath
brotli
bz2
clos_ssa*
calendar
core
ctype
curl
date
dba
dbase
dom
diseval
eio
enchant
exif
fileinfo
filter
ftp
ffmpeg*
gd
gearman
gender
geoip
gettext | geos
gmagick
gmp
gnupg
gRPC
hash
htscanner
http
iconv
igbinary
imagick
imap
inotify
interbase
intl
ioncube_loader
jsmin
json
ldap
libsodium
libxml
lzf
luasandbox*
mailparse
mbstring
mcrypt
memcached | memcache
mongodb
mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
_newrelic_
oauth
oci8
odbc
opcache
openssl
pcntl
pcre
pdo
pdo_dblib
pdo_firebird
pdo_mysql
pdo_odbc
pdo_pgsql psr

pdo_sqlite
pdo_sqlsrv
pgsql
phalcon3
phar
pdf | pdo_oci
phalcon4
posix
propro
pspell
psr*
raphf
rar
readline
redis
reflection
rrd
recode
solr
session
shmop
simplexml
snmp
soap
sockets
sourceguardian
spl
sodium
sqlite3
sqlsrv
ssh2
standard
stats
suhosin7
sysvmsg | swoole
sysvsem
sysvshm
tidy
timezonedb
tokenizer
trader
tideways_xhprof
uploadprogress
uuid
vips*
wddx
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xsl
xray
yaz
yaml
yaf
zip
zlib
zmq|
* CentOS 7, CloudLinux 7, etc. To use `newrelic` extension you should set your own `New Relic License Key` in your own `/opt/alt/php7*/etc/php.ini` file. Please find more info about New Relic License Key in the [New Relic documentation](https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/license-key).
| | | | | | |-|-|-|-|-| |aapm*
jsmin
psr
rrd
yaz
amqp
snuffleupagus
vld
apcu
bcmath
brotli
bz2
calendar
clos_ssa*
core
ctype
curl
date
dba
dom
dbase
diseval
eio
enchant
exif
fileinfo
filter
ftp
ffmpeg*
gd
gender
geoip
gettext | gearman
geos
gmagick
gmp
gnupg
gRPC
hash
http
iconv
igbinary
imagick
imap
inotify
interbase
intl
ioncube_loader
json
ldap
libxml
lzf
luasandbox*
mcrypt
memcache
mailparse
mbstring
memcached
mongodb | mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
_newrelic_
oauth
oci8
odbc
opcache
openssl
pcntl
pcre
pdo
pdo_dblib
pdo_firebird
pdf
pdo_oci
phalcon4
pdo_mysql
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_sqlsrv
pgsql
phalcon3
phar | posix
propro
pspell
raphf
readline
redis
reflection
recode
sodium
sourceguardian
swoole
session
shmop
simplexml
snmp
soap
sockets
spl
sqlite3
sqlsrv
ssh2
standard
stats
sysvmsg
sysvsem | sysvshm
tidy
timezonedb
tokenizer
trader
tideways_xhprof
uploadprogress
uuid
vips*
wddx
xml
xmlreader
xmlrpc
xmlwriter
xsl
xdebug
yaf
yaml
zip
zlib
zmq
xray|
* CentOS 7, CloudLinux 7, etc. To use `newrelic` extension you should set your own `New Relic License Key` in your own `/opt/alt/php7*/etc/php.ini` file. You can find more info about New Relic License Key in the [New Relic documentation](https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/license-key).
| | | | | | | |-|-|-|-|-|-| |ffmpeg*
aapm*
amqp
clos_ssa*
gearman
jsmin
mailparse
memcache
psr
rrd
solr
tideways_xhprof
zmq
snuffleupagus
vld
apcu
bz2
brotli
calendar
core
ctype
curl
date
exif
enchant
filter
ftp
gettext
gmp
gnupg
hash
iconv
interbase
luasandbox* | libxml
mysqlnd
opcache
openssl
pcntl
pcre
pdo_pgsql
phar
readline
reflection
session
shmop
simplexml
sourceguardian
spl
sqlite3
standard
snmp
stats
tokenizer | trader
xmlreader
bcmath
fileinfo
grpc
intl
lzf
nd_mysqli
pdf
pdo
posix
swoole
uploadprogress
xmlrpc
gd
http
ioncube_loader
mbstring | nd_pdo_mysql
pdo_dblib
pdo_sqlite
propro
soap
sysvmsg
uuid
xmlwriter
dbase
gender
igbinary
mcrypt
newrelic
pdo_firebird
pdo_sqlsrv
pspell
sockets
sysvsem
vips*
xsl | dba
geoip
imagick
json
memcached
oauth
pdo_mysql
pgsql
raphf
sodium
sysvshm
yaml
dom
geos
imap
ldap
mongodb
oci8
pdo_oci | phalcon3
recode
sqlsrv
tidy
wddx
yaz
eio
gmagick
inotify
leveldb
mysqli
odbc
pdo_odbc
phalcon4
redis
ssh2
timezonedb
xdebug
zip
xml
zlib
xray
yaf|
* CentOS 7, CloudLinux 7, etc. To use `newrelic` extension you should set your own `New Relic License Key` in your own `/opt/alt/php7*/etc/php.ini` file. You can find more info about New Relic License Key in the [New Relic documentation](https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/license-key).
| | | | | | |-|-|-|-|-| |leveldb
sourceguardian
ffmpeg*
amqp
clos_ssa*
gearman
ioncube_loader
jsmin
mailparse
mcrypt
memcache
psr
rrd
solr
ssh2
tideways_xhprof
yaz
zmq
apcu
bcmath
brotli
bz2
calendar
core
ctype
curl
date
dba
dbase
dom
eio
enchant
exif
fileinfo
filter
ftp
gd
gender
geoip
geos | gettext
gmagick
gmp
gnupg
grpc
hash
http
iconv
igbinary
imagick
imap
inotify
intl
json
ldap
libxml
luasandbox*
lzf
mbstring
memcached
mongodb | mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
newrelic
snuffleupagus
oauth
oci8
odbc
opcache
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql
pdo_oci
pdo_odbc
pdo_pgsql
vld
pdo_sqlite
pdo_sqlsrv | pgsql
phalcon4
phar
posix
propro
pspell
raphf
readline
redis
reflection
phalcon5
session
shmop
simplexml
snmp
soap
sockets
sodium
spl
sqlite3
sqlsrv
standard | stats
swoole
sysvmsg
sysvsem
sysvshm
tidy
timezonedb
tokenizer
trader
xray
uploadprogress
uuid
vips*
xdebug
xml
xmlreader
xmlrpc
xmlwriter
xsl
yaml
zip
zlib |
* CentOS 7, CloudLinux 7, etc.
| | | | | | |-|-|-|-|-| |brotli
amqp
clos_ssa*
core
date
filter
gearman
geoip
gmagick
gnupg*
grpc
apcu
bcmath
bz2
calendar
ctype
curl
dba
dbase
dom
enchant
exif
ffi**
fileinfo | hash
igbinary
inotify
jsmin
json
libxml
mcrypt
memcache ftp
gd
gettext
gmp
iconv
imagick
imap
intl
ldap
lzf
mailparse
mbstring | mongodb
newrelic
oauth
oci8
openssl
pcntl
pcre
pdo_oci
pdo_sqlsrv
readline
redis
reflection
rrd
session memcached
mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
odbc
opcache
pdo
pdo_dblib
pdo_firebird
pdo_mysql
pdo_odbc | snuffleupagus
solr
SPL
sqlsrv
ssh2
standard
swoole
tideways_xhprof
trader pdo_pgsql
pdo_sqlite
pgsql
phar
posix
pspell
psr
raphf
shmop
simplexml
snmp
soap
sockets | uploadprogress
uuid
vips*
vld
xdebug
xmlrpc**
yaml
yaz
zip
zlib sodium
sqlite3
sysvmsg
sysvsem
sysvshm
tidy
timezonedb
tokenizer
xml
xmlreader
xmlwriter
xsl
zmq
sourceguardian
phalcon5
xray |
* CentOS 7, CloudLinux 7, etc. ** CentOS 7, CentOS 8, CloudLinux 7, CloudLinux 8, etc.
| | | | | | |-|-|-|-|-| |amqp
apcu
bcmath
brotli
bz2
calendar
clos_ssa***
Core
ctype
curl
date
dba
dbase
dom
enchant
exif
ffi**
fileinfo
filter
ftp | gd
geoip
gearman
gettext
gmagick
gmp
gnupg**
grpc
hash
ioncube_loader
iconv
igbinary
imagick
imap
inotify
intl
jsmin
json
ldap
libxml
lzf
mailparse
mbstring
mcrypt | memcache
memcached
mongodb
mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
newrelic
oauth
oci8
odbc
opcache
openssl
pcntl
pcre
pdf
pdo
pdo_dblib
pdo_mysql
pdo_oci
pdo_odbc
phalcon5
pdo_pgsql
pdo_firebird
pdo_sqlite
pdo_sqlsrv | pgsql
phar
posix
process
pspell
psr
rrd
raphf
readline
redis
Reflection
session
shmop
SimpleXML v snmp
solr
sourceguardian
soap
sockets
sodium
SPL
sqlite3
sqlsrv
ssh2
standard
swoole | sysvmsg
sysvsem
sysvshm
tideways_xhprof
tidy
timezonedb
tokenizer
trader
uploadprogress
uuid
vips*
xdebug
xml
xmlreader
xmlrpc**
xmlwriter
xsl
yaf
yaml
zip
zlib
zmq
xray |
* CentOS 7, CloudLinux 7, etc. ** CentOS 7, CentOS 8, CloudLinux 7, CloudLinux 8, etc. | | | | | | |-|-|-|-|-| |amqp**
apcu**
bcmath
brotli**
bz2
calendar
Core
ctype
curl
date
dba
dbase**
dom
enchant
exif
ffi
fileinfo
filter
ftp
gd
gearman**
geoip** | gettext
gmagick**
gmp
gnupg*
grpc**
hash
iconv
igbinary**
imagick**
imap
inotify**
intl
ioncube_loader
jsmin**
json
ldap
libxml
lzf**
mailparse**
mbstring
mcrypt**
memcache**
memcached** | mongodb**
mysqlnd
nd_mysqli
nd_pdo_mysql
oauth**
oci8**
odbc
opcache
openssl
pcntl
pcre**
pdo
pdo_dblib
pdo_firebird
pdo_mysql*
pdo_oci**
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_sqlsrv**
pgsql | phar
posix
pspell
psr**
random
raphf**
readline
redis**
Reflection
rrd**
session
shmop
SimpleXML
snmp
soap
sockets
sodium
solr**
SPL
sqlite3
sqlsrv**
ssh2** | standard
swoole**
sysvmsg
sysvsem
sysvshm
tideways_xhprof**
tidy
timezonedb**
tokenizer
trader**
uploadprogress**
uuid**
vips*
xdebug**
xml
xmlreader
xmlrpc**
xmlwriter
xsl
yaml**
zip
zlib
zmq**| * CentOS 7, CloudLinux 7, etc. ** CentOS 7, CentOS 8, CloudLinux 7, CloudLinux 8, etc. | | | | | | |-|-|-|-|-| |amqp**
apcu**
bcmath
brotli**
bz2
calendar
Core
ctype
curl
date
dba
dbase**
dom
elastic_apm
enchant
exif
ffi
fileinfo
filter
ftp
gd
gearman**
geoip** | gettext
gmagick**
gmp
gnupg*
grpc**
hash
iconv
igbinary**
imagick**
imap
inotify**
intl
ioncube_loader
jsmin**
json
ldap
libxml
lzf**
mailparse**
mbstring
mcrypt**
memcache**
memcached** | mongodb**
mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
oauth**
oci8**
odbc
opcache
openssl
pcntl
pcre**
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql*
pdo_oci**
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_sqlsrv**
pgsql | phalcon5
phar
posix
pspell
psr**
random
raphf**
readline
redis**
Reflection
rrd**
session
shmop
SimpleXML
snmp
snuffleupagus
soap
sockets
sodium
solr**
SPL
sqlite3
sqlsrv**
ssh2** | standard
sysvmsg
sysvsem
sysvshm
tideways_xhprof**
tidy
timezonedb**
tokenizer
trader**
uploadprogress**
uuid**
xml
xmlreader
xmlrpc**
xmlwriter
xsl
yaml**
zip
zlib
zmq**| * CentOS 7, CloudLinux 7, etc. ** CentOS 7, CentOS 8, CloudLinux 7, CloudLinux 8, etc. | | | | | | |-|-|-|-|-| |amqp**
apcu**
bcmath
brotli**
bz2
calendar
Core
ctype
curl
date
dba
dbase**
dom
elastic_apm
enchant
exif
ffi
fileinfo
filter
ftp
gd
gearman**
geoip** | gettext
gmagick**
gmp
gnupg*
grpc**
hash
iconv
igbinary**
imagick**
imap
inotify**
intl
ioncube_loader
jsmin**
json
ldap
libxml
lzf**
mailparse**
mbstring
mcrypt**
memcache**
memcached** | mongodb**
mysqli
mysqlnd
nd_mysqli
nd_pdo_mysql
oauth**
oci8**
odbc
opcache
openssl
pcntl
pcre**
pdf
pdo
pdo_dblib
pdo_firebird
pdo_mysql*
pdo_oci**
pdo_odbc
pdo_pgsql
pdo_sqlite
pdo_sqlsrv**
pgsql | phalcon5
phar
posix
pspell
psr**
random
raphf**
readline
redis**
Reflection
rrd**
session
shmop
SimpleXML
snmp
snuffleupagus
soap
sockets
sodium
solr**
SPL
sqlite3
sqlsrv**
ssh2** | standard
sysvmsg
sysvsem
sysvshm
tideways_xhprof**
tidy
timezonedb**
tokenizer
trader**
uploadprogress**
uuid**
xml
xmlreader
xmlrpc**
xmlwriter
xsl
yaml**
zip
zlib
zmq**| * CentOS 7, CloudLinux 7, etc. ** CentOS 7, CentOS 8, CloudLinux 7, CloudLinux 8, etc. ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=PHP) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=PHP) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=PHP) — Full list of product parts covered by ELS * ![](/images/shield.webp) [Machine-readable security data](/els-for-runtimes/machine-readable-security-data/#php) — OVAL, CSAF, Errata, and RSS feeds for PHP ELS * ![](/images/clipboard-notes.webp) [PHP Changelog](https://changelog.cloudlinux.com/) — latest updates, fixes, and enhancements for ALT-PHP ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/python/ ================================================================================ # Python Endless Lifecycle Support (ELS) for Python from TuxCare provides security fixes for Python versions that have reached their end-of-life. This allows you to continue running your server vulnerability-free. ## About ALT-Python alt-python is a component provided by TuxCare designed for managing Python versions on servers and enabling users to run multiple Python versions simultaneously. Here are the key features and characteristics of alt-python: * **Multiple Python Versions** - alt-python allows the installation and usage of various Python versions on a single server. This enables users to select the Python version that best suits their applications. * **User Segmentation** - alt-python allows administrators to provide different Python versions for different users or applications. Each user can choose the Python version that suits their project. * **Enhanced Compatibility** - alt-python is designed to ensure maximum compatibility with various Python applications and frameworks. This includes optimizations and changes to make it compatible with a wide range of Python applications. * **Updates and Support** - TuxCare provides regular updates for alt-python, including bug fixes, performance improvements, and updates for new Python versions. This helps ensure the security and currency of Python usage. * **Direct Version Access** - alt-python allows switching between versions, users can easily manage which Python version is active in their environment. alt-python provides a more flexible and convenient environment for working with different Python versions on a single server, which is particularly useful in development and production environments where multiple applications have varying requirements for Python versions. ## Supported OS and Python versions | Operating Systems | Package Type | OS Version | Python versions | | :----------------------------------------------------------: | :----------: | :--------------------------------: | :---------------------------: | | EL 7 (CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 7.x | 2.7, 3.6 | | EL 8 (CentOS, CentOS Stream, CloudLinux, Oracle Linux, etc.) | RPM | 8.x | 2.7, 3.6 | | EL 9 (AlmaLinux, CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 9.x | 2.7, 3.6 | | EL 10 (AlmaLinux, CloudLinux, Oracle Linux, etc.) | RPM | 10.x | 2.7, 3.6 | | Ubuntu | DEB | 16.04, 18.04, 20.04, 22.04, 24.04 | 2.7, 3.6 | | Debian | DEB | 10, 11 | 2.7, 3.6 | | Debian | DEB | 12, 13 | 2.7, 3.6, 3.7, 3.8, 3.9 | | Alpine Linux | APK | 3.22, 3.23 | 3.6, 3.7, 3.8, 3.9 | **Supported architectures:** * x86_64 — all supported OSes * arm64 — Debian 12 and 13 ## Installation * A valid TuxCare ELS license key — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server 1. Download the installer script RPM: ``` wget https://repo.alt.tuxcare.com/alt-python-els/install-els-alt-python-rpm-repo.sh ``` DEB: ``` wget https://repo.alt.tuxcare.com/alt-python-els/install-els-alt-python-deb-repo.sh ``` APK: ``` wget https://repo.alt.tuxcare.com/alt-python-els/install-els-alt-python-apk-repo.sh ``` 2. Run the installer script with your license key (see [Prerequisites](#prerequisites) above) The script registers the server with CLN, adds the PGP key and repository. RPM: ``` sh install-els-alt-python-rpm-repo.sh --license-key XXX-XXXXXXXXXXXX ``` DEB: ``` bash install-els-alt-python-deb-repo.sh --license-key XXX-XXXXXXXXXXXX ``` APK: ``` sh install-els-alt-python-apk-repo.sh --license-key XXX-XXXXXXXXXXXX ``` 3. Install a Python version **For RPM-based systems**, enable the CodeReady Builder (CRB) repository which contains the `gdbm` package: RPM: ``` yum install alt-python36 --enablerepo crb ``` DEB: ``` apt-get install alt-python36 ``` APK: ``` apk add alt-python36 ``` To see available packages: RPM: ``` yum list available 'alt-python*' ``` DEB: ``` apt list -a | grep alt-python ``` APK: ``` apk search alt-python ``` 4. Verify the installation Check that the binary exists and returns the expected version: ```text /opt/alt//bin/python3 -V ``` Optionally, verify execution: ```text /opt/alt//bin/python3 -c "print('Hello, World!')" ``` To use this version as default in the current shell: ```text export PATH=/opt/alt//bin:$PATH python3 -V which python3 ``` 5. Update packages RPM: ``` yum update 'alt-python*' ``` DEB: ``` apt-get update && apt-get --only-upgrade install 'alt-python*' ``` APK: ``` apk update && apk upgrade 'alt-python*' ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Python) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Python) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Python) — Full list of product parts covered by ELS * ![](/images/shield.webp) [Machine-readable security data](/els-for-runtimes/machine-readable-security-data/#python) — OVAL, CSAF, Errata, and RSS feeds for Python ELS ================================================================================ Source: https://docs.tuxcare.com/els-for-runtimes/ruby/ ================================================================================ # Ruby Endless Lifecycle Support (ELS) for Ruby from TuxCare provides security fixes for Ruby versions that have reached their end-of-life. This allows you to continue running your server vulnerability-free. ## About ALT-Ruby alt-ruby is a component provided by TuxCare designed for managing Ruby versions on servers and enabling users to run multiple Ruby versions simultaneously. Here are the key features and characteristics of alt-ruby: * **Multiple Ruby Versions** - alt-ruby allows the installation and usage of various Ruby versions on a single server. This enables users to select the Ruby version that best suits their applications. * **User Segmentation** - alt-ruby allows administrators to provide different Ruby versions for different users or applications. Each user can choose the Ruby version that suits their project. * **Enhanced Compatibility** - alt-ruby is designed to ensure maximum compatibility with various Ruby applications and frameworks. This includes optimizations and changes to make it compatible with a wide range of Ruby applications. * **Updates and Support** - TuxCare provides regular updates for alt-ruby, including bug fixes, performance improvements, and updates for new Ruby versions. This helps ensure the security and currency of Ruby usage. * **Easy Version Switching** - alt-ruby allows switching between versions; users can easily manage which Ruby version is active in their environment. alt-ruby provides a more flexible and convenient environment for working with different Ruby versions on a single server, which is particularly useful in development and production environments where multiple applications have varying requirements for Ruby versions. ## Supported OS and Ruby versions | Operating Systems | Package Type | OS Version | Ruby versions | | :----------------------------------------------------------------------: | :----------: | :--------: | :---------------------------: | | EL 8 (AlmaLinux, CentOS, CentOS Stream, CloudLinux, Oracle Linux, etc.) | RPM | 8.x | 2.7, 3.0, 3.1, 3.2 | | EL 9 (AlmaLinux, CentOS, CloudLinux, Oracle Linux, etc.) | RPM | 9.x | 2.7, 3.0, 3.1, 3.2 | | EL 10 (AlmaLinux, CloudLinux, Oracle Linux, etc.) | RPM | 10.x | 2.7, 3.0, 3.1, 3.2 | | Debian | DEB | 11 | 2.7, 3.0, 3.1, 3.2 | | Debian | DEB | 12 | 2.6, 2.7, 3.0, 3.1, 3.2 | | Debian | DEB | 13 | 2.6, 2.7, 3.0, 3.1, 3.2 | | Ubuntu | DEB | 22.04 | 2.7, 3.0, 3.1, 3.2 | | Ubuntu | DEB | 24.04 | 2.7, 3.0, 3.1, 3.2 | | Alpine Linux | APK | 3.22 | 2.6, 2.7, 3.0, 3.1, 3.2 | **Supported architectures:** * x86_64 — all supported OSes * aarch64/arm64 — Debian 12 and 13, Alpine Linux ## Installation * A valid TuxCare ELS license key — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) to obtain one * Root or `sudo` access to the server 1. Download the installer script RPM: ``` wget https://repo.alt.tuxcare.com/alt-ruby-els/install-els-alt-ruby-rpm-repo.sh ``` DEB: ``` wget https://repo.alt.tuxcare.com/alt-ruby-els/install-els-alt-ruby-deb-repo.sh ``` APK: ``` wget https://repo.alt.tuxcare.com/alt-ruby-els/install-els-alt-ruby-apk-repo.sh ``` 2. Run the installer script with your license key (see [Prerequisites](#prerequisites) above) The script registers the server with CLN, adds the PGP key and repository. RPM: ``` sh install-els-alt-ruby-rpm-repo.sh --license-key XXX-XXXXXXXXXXXX ``` DEB: ``` bash install-els-alt-ruby-deb-repo.sh --license-key XXX-XXXXXXXXXXXX ``` APK: ``` sh install-els-alt-ruby-apk-repo.sh --license-key XXX-XXXXXXXXXXXX ``` 3. Install a Ruby version RPM: ``` yum install alt-ruby27 ``` DEB: ``` apt-get install alt-ruby27 ``` APK: ``` apk add alt-ruby27 ``` To see available packages: RPM: ``` yum list available 'alt-ruby*' ``` DEB: ``` apt list -a | grep alt-ruby ``` APK: ``` apk search alt-ruby ``` 4. Verify the installation Check that the binary exists and returns the expected version: ```text /opt/alt//bin/ruby -v ``` Optionally, add it to `PATH` to use it as default: ```text export PATH=/opt/alt//bin:$PATH ruby -v which ruby ``` 5. Update packages RPM: ``` yum update 'alt-ruby*' ``` DEB: ``` apt-get update && apt-get --only-upgrade install 'alt-ruby*' ``` APK: ``` apk update && apk upgrade 'alt-ruby*' ``` ## What's Next? * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/?product=Ruby) — Track vulnerability fixes and updates * ![](/images/shield.webp) [Available fixes](https://tuxcare.com/cve-tracker/fixes?product=Ruby) — Patched versions and changelogs * ![](/images/clipboard-notes.webp) [Supported components](https://tuxcare.com/cve-tracker/products?product=Ruby) — Full list of product parts covered by ELS * ![](/images/shield.webp) [Machine-readable security data](../machine-readable-security-data/) — CSAF advisories and RSS feeds for Ruby ELS ================================================================================ Source: https://docs.tuxcare.com/endless-lifecycle-support/ ================================================================================ # Endless Lifecycle Support Explore TuxCare’s Endless Lifecycle Support Portfolio: * **Endless Lifecycle Support for Operating Systems** Keep your legacy Linux servers patched and compliant - no risky rebuilds, downtime, hardware upgrades, or added workload. [Learn more](/els-for-os/). * **Endless Lifecycle Support for Runtimes** Keep your apps running safely on the runtimes they were built for, without rushed upgrades or broken code – even after official support ends. [Learn more](/els-for-runtimes/). * **Endless Lifecycle Support for Libraries** Keep securely running your apps on end-of-life (EOL) libraries – without rushed upgrades, costly code rewrites, or disruption to your roadmap. [Learn more](/els-for-libraries/). * **Endless Lifecycle Support for Applications** Ensure your EOL apps stay secure and operational while avoiding outages, broken workflows, and code rewrites. [Learn more](/els-for-applications/). ================================================================================ Source: https://docs.tuxcare.com/enterprise-support-for-almalinux/ ================================================================================ # **Enterprise Support for AlmaLinux** This guide describes [TuxCare Enterprise Support](https://tuxcare.com/tuxcare-enterprise-support/) for AlmaLinux **and now Rocky Linux too!** ## What is TuxCare Enterprise Support? TuxCare Enterprise Support provides a TuxCare-vetted repository of AlmaLinux and Rocky Linux updates with 16 years of support coverage, ensures long-term stability and FIPS 140-3 compliance with extended security support for select minor releases, and helps to avoid costly upfront support package fees with pay-as-you-go hourly support bundles. Available services: * **Essential Support**: TuxCare-vetted repository of AlmaLinux and Rocky Linux updates with guaranteed uptime, expedited break-and-fix support and up to 16 years of support coverage * **Extended Security Updates** provide an extended period of security fixes for critical and high-risk vulnerabilities for select minor versions, as well as the **full suite of five FIPS-validated modules** (kernel, openssl, libcrypt, nss and gnutls) and FIPS-compliant security patches for FIPS-certified Linux deployments. **The product also unlocks commercial use of the FIPS-validated packages.** * **Enhanced Support**: Enterprise-grade support for AlmaLinux, Rocky Linux and open-source applications with pay-as-you-go pricing in 5, 10, and 20-hour bundles Learn more at [https://tuxcare.com/tuxcare-enterprise-support/](https://tuxcare.com/tuxcare-enterprise-support/) ## **Extended Security Updates** Extended Security Updates (ESU) for AlmaLinux and Rocky Linux extends the lifecycle of specific minor versions by delivering both prolonged security updates for High and Critical vulnerabilities as well as FIPS-compliant security patches enabling greater stability and security for your Linux deployments. ### ESU lifecycle AlmaLinux and Rocky Linux provide a 10-year lifecycle with a new minor release arriving every 6 months, bringing new features until the fifth year. Each of the minor releases is supported for 6 months. Customers who want to remain with the specific AlmaLinux or Rocky Linux minor release for longer can opt for Extended Security Updates (ESU). ESU delivers an extended period of security fixes for critical and high-risk vulnerabilities for select minor versions, as well as the full suite of five FIPS-validated modules (kernel, openssl, libcrypt, nss and gnutls) and FIPS-compliant security patches for FIPS-certified Linux deployments. The product also unlocks commercial use of the FIPS-validated packages. Extended Security Updates are currently available for AlmaLinux 9.2, AlmaLinux 9.6, Rocky Linux 9.6, and planned support for 9.10. This provision ensures that a given minor release continues to receive essential updates, allowing customers to avoid upgrading every six months and test/certify their applications against the next minor version at their own pace. ![esu lifecycle](/images/esu_lifecycle_graph2.png) **Disclaimer**: Minor releases planned for ESU are subject to change. TuxCare reserves the right to change them at any time without prior notice. ### Vulnerability coverage TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system integrates both NVD scoring and vendor scoring (when available); when the vendor's score is lower than the NVD score, we prioritize the NVD score. ESU prioritises security patches for High and Critical CVE's and bug fixes - but to help our customers comply with regulations such as FedRAMP, HIPAA and PCI-DSS - TuxCare also provides Low and Moderate severity security patches where possible (or otherwise mitigations/analysis) and where breaking changes aren't introduced, going back as far as November 2025. Additional Low/Moderate CVE patches can be purchased if required - speak to your Account Manager about our 10 CVE bundles. ### FIPS-compliant security patches ESU enables continuous security for FIPS-certified AlmaLinux and Rocky Linux 9 deployments by offering FIPS-compliant security patches for the FIPS-validated [kernel, openssl, libcrypt, nss and gnutls packages](https://tuxcare.com/fips-for-almalinux/). These patches [do not change the validated cryptography](https://tuxcare.com/blog/the-dilemmas-of-fips-140-3-compliance/). They are suitable for organizations that don't require strict FIPS-certified implementations that are static and never patched (i.e. military or intelligence agencies). In case of a cryptographic vulnerability that will require a security patch that changes the validated cryptography, we will fix it by delivering a new packaged module. This module will undergo an expedited FIPS 140-3 re-validation to ensure it is attested to conform to FIPS 140-3 requirements. ### Target response times Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare organizations or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements. We aim to deliver security patches for Critical and High-risk vulnerabilities (CVSS 7+) within 14 days from when the vulnerabilities become publicly disclosed. This rapid response time significantly reduces the window of opportunity for potential attackers and meets most security regulation requirements. ### Supported packages ESU provides updates for a comprehensive list of packages integral to server operations - the complete list of over 6,000 packages in BaseOS and AppStream, plus a few more - thus providing maximum security for your operating system. You can view the full list of supported packages, as well as get detailed information on the patched CVEs, here: [https://cve.tuxcare.com/](https://cve.tuxcare.com/) Support for additional packages can be provided on request. ### Errata advisories ESU provides qualified security and selected bug-fix errata advisories across all architectures. They can help users track which Common Vulnerabilities and Exposures (CVE) are resolved and which bugs have been addressed. You can view the full list of released advisories here [https://cve.tuxcare.com/els/releases](https://cve.tuxcare.com/els/releases) ### OVAL patch definitions Leveraging Open Vulnerability and Assessment Language (OVAL) patch definitions with OVAL-compatible tools, e.g. OpenSCAP, users can accurately check their systems for the presence of vulnerabilities: * ESU 9.2 OVAL: [https://security.tuxcare.com/oval/els_os/almalinux9.2esu/oval.xml](https://security.tuxcare.com/oval/els_os/almalinux9.2esu/oval.xml) * ESU 9.6 OVAL: [https://security.tuxcare.com/oval/els_os/tuxcare9.6esu/oval.xml](https://security.tuxcare.com/oval/els_os/tuxcare9.6esu/oval.xml) ### CSAF data Vulnerability scanner vendors may prefer the Common Security Advisory Framework (CSAF) 2.0 machine-readable format: * ESU 9.2 CSAF advisories: [https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/](https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/) * ESU 9.2 CSAF VEX documents: [https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/vex/](https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/vex/) * ESU 9.6 CSAF advisories: [https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/](https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/) * ESU 9.6 CSAF VEX documents: [https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/vex/](https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/vex/) * Provider metadata: [https://csaf.data.security.tuxcare.com/](https://csaf.data.security.tuxcare.com/) ### Secure Bill Of Materials * ESU 9.2 SBOM: [https://security.tuxcare.com/spdx/els_os/almalinux9.2esu/tuxcare92-esu-x86_64-esu.zip](https://security.tuxcare.com/spdx/els_os/almalinux9.2esu/tuxcare92-esu-x86_64-esu.zip) * ESU 9.6 SBOM: [https://security.tuxcare.com/spdx/els_os/almalinux9.6esu/tuxcare96-esu-x86_64-esu.zip](https://security.tuxcare.com/spdx/els_os/almalinux9.6esu/tuxcare96-esu-x86_64-esu.zip) ### RSS releases feeds * ESU 9.2: [https://cve.tuxcare.com/rss_feed/releases/almalinux9.2esu](https://cve.tuxcare.com/rss_feed/releases/almalinux9.2esu) * ESU 9.6: [https://cve.tuxcare.com/rss_feed/releases/tuxcare9.6esu](https://cve.tuxcare.com/rss_feed/releases/tuxcare9.6esu) ### Technical support All TuxCare products include technical support provided according to the support policy [https://tuxcare.com/TuxCare-support-policy.pdf](https://tuxcare.com/TuxCare-support-policy.pdf). It delivers 24/7/365 access to our engineers through the TuxCare Support Portal [https://tuxcare.com/support-portal/](https://tuxcare.com/support-portal/) and to our online knowledge base. Technical Support for Extended Security Updates provides assistance with: * ESU repository setup issues * Package update problems (package conflicts, missing dependencies) * FIPS and CVE-related questions * ePortal issues * Kernel crash issues (root cause analysis) ### GnuPG Keys The TuxCare ESU/FIPS packages and repositories are cryptographically signed with a GPG key, so you can verify the legitimacy of the software you download and the source of the download. The details of our key are below: * Public key: rsa4096/8D50EB66 (2023-03-06) * Fingerprint: FAD7 8590 81D0 738B 7A82 8496 D07B F2A0 8D50 EB66 * ID: TuxCare (Software Signing Key) * Installation location: /etc/pki/rpm-gpg/RPM-GPG-KEY-TuxCare * Download link: [RPM-GPG-KEY-TuxCare](https://repo.tuxcare.com/tuxcare/RPM-GPG-KEY-TuxCare) ### Installing tuxctl **Requirements** * AlmaLinux 9.2 or AlmaLinux/Rocky Linux 9.6 operating system (download images from [here](https://tuxcare.com/almalinux-enterprise-support/get-almalinux/)) * x86_64 or aarch64 architecture * Extended Security Updates license key (should be obtained from [portal.tuxcare.com](https://portal.tuxcare.com)) * Internet access `tuxctl` is the setup tool for TuxCare's Enterprise Support for AlmaLinux, which will configure your system to receive patches from the TuxCare repositories. To install `tuxctl` you need to install the `tuxcare-release` package first. This package contains the TuxCare repo definitions, TuxCare GPG key and the `tuxctl` setup tool. Run one of the following as root: For 9.2: ```text # dnf -y install https://repo.tuxcare.com/tuxcare/tuxcare-release-latest-9.2.noarch.rpm ``` For 9.6: ```text # dnf -y install https://repo.tuxcare.com/tuxcare/tuxcare-release-latest-9.6.noarch.rpm ``` The second step is to activate your license on the system. You should run the `tuxctl` tool as root with your ESU license key provided as a command line argument like so: ```text # tuxctl --license-key XXXXXXXXXX ``` This tool will do the following: 1. Check your OS and architecture 2. Check your license key for validity and purchased extensions 3. Check if your system is already registered 4. Register to CloudLinux Network 5. Obtain a token to access the restricted TuxCare repos 6. Enable the TuxCare ESU repo 7. Switch the default AlmaLinux repos to use repo.tuxcare.com 8. Import the TuxCare GPG key After installation you'll see the following message: ```text TuxCare installed successfully ``` This means your system is registered and ready to receive updates from TuxCare. If during installation something goes wrong then the `tuxctl` tool will show an error message and suggest how to handle it. For example, if your system is already registered you'll receive the following message: ```text This server already has a TuxCare token installed To force re-registration, please run the script with --force ``` Then you will have to run `tuxctl` like this: ```text # tuxctl --force -l XXXXXXXXXX ``` **Managing license usage** To check if a server is already activated, you can run `tuxctl` and check for return code 0: ```text # tuxctl -v Server is registered with token ``` Or if not registered you will get a return code 1: ```text # tuxctl -v Server is not registered ``` If you are decommissioning a server and would like to de-register its license, you can run `tuxctl` like this and check for return code 0: ```text # tuxctl -d De-registration successful ``` **Upgrading** ESU customers can upgrade between ESU releases, for example from 9.2 to 9.6 by editing the /etc/dnf/vars/tuxcare_releasever file to specify the new version, like so: ```text # echo 9.6 > /etc/dnf/vars/tuxcare_releasever # dnf upgrade ``` ### Uninstalling tuxctl To uninstall tuxctl, disable the ESU/FIPS functionality and revert to community repo's, you can run the following as root: ```text # dnf -y remove tuxcare-release # fips-mode-setup --disable # sed -i \ -e 's|https://repo.tuxcare.com/almalinux/|https://repo.almalinux.org/almalinux/|' \ -e 's|^# mirrorlist|mirrorlist|' \ -e 's|^baseurl|# baseurl|' \ -e 's|$tuxcare_releasever/$tuxcare_token|$releasever|g' \ -e 's|$tuxcare_releasever|$releasever|g' \ -e '/^exclude/d' \ /etc/yum.repos.d/almalinux*.repo # sed -i \ -e 's|https://repo.tuxcare.com/rockylinux/|http://dl.rockylinux.org/\$contentdir/|' \ -e 's|^# mirrorlist|mirrorlist|' \ -e 's|^baseurl|# baseurl|' \ -e 's|$tuxcare_releasever/$tuxcare_token|$releasever|g' \ -e 's|$tuxcare_releasever|$releasever|g' \ -e '/^exclude/d' \ /etc/yum.repos.d/rocky*.repo # reboot ``` Note that by disabling ESU, you will revert to tracking major version releases instead of sticking to a specific minor version, so you may be upgraded from 9.2 to 9.6 for example - a process you cannot undo. To completely remove the TuxCare packages, after following the above steps, run the following as root: ```text # dnf remove *tuxcare* ``` In most cases this will be the end of the uninstallation procedure, however if you see an error message like the following, then you may have to use `grubby` or `grub2-reboot` or simply the grub menu, to reboot into a non-TuxCare kernel first: ```text Error: Problem: The operation would result in removing the following protected packages: sudo, systemd, kernel-core, dnf (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) ``` Then run the following: ```text # dnf downgrade openssl libgcrypt gnutls nettle nss # dnf remove kernel*tuxcare* # dnf upgrade ``` ### Enabling FIPS 140-3 mode Note that Rocky Linux 9.6 is a *vendor-affirmed OE* and has not been through the same FIPS lab testing as AlmaLinux, however the FIPS *modules* are the exact same packages used for both operating systems. First please ensure you have installed the `tuxcare-release` package as described above. If you haven't already registered your ESU license using `tuxctl` the next step will also do that for you. To install the FIPS 140-3 validated ESU packages over the default ones and enable FIPS mode, please run these commands as root: ```text # dnf -y upgrade # fips-mode-setup --enable # reboot ``` If you wish to only boot into the Active FIPS-validated kernel and not the security patched kernels or updates under CMVP review (only required in very high classification environments) you can use grubby like so: ```text # dnf -y install kernel-5.14.0-284.11.1.el9_2.tuxcare.6 # grubby --set-default=/boot/vmlinuz-5.14.0-284.11.1.el9_2.tuxcare.6.$(uname -i) ``` Note the aarch64 platform doesn't currently have FIPS-validated gnutls/libgcrypt/nss packages, only kernel and openssl for AlmaLinux 9.2 We also provide multilib i686 packages of the userspace modules in the x86_64 repo for backwards compatibility, note that these are not FIPS-validated but are built from the same source. Once you've logged in after the reboot, you can run these commands to confirm it worked (note the versions may be slightly different by the time you read this, see [version table](https://tuxcare.com/fips-for-almalinux/)): ```text $ fips-mode-setup --check FIPS mode is enabled. $ update-crypto-policies --show FIPS $ update-crypto-policies --check The configured policy matches the generated policy $ uname -r 5.14.0-284.1101.el9_2.tuxcare.7.x86_64 $ openssl list -providers | grep -A3 fips fips name: OpenSSL FIPS Provider for AlmaLinux 9 version: 3.0.7-1d2bd88ee26b3c90 status: active ``` ### NSS-FIPS and Java crypto APIs #### Java crypto Java has a fully abstract crypto API with a pluggable cryptographic implementation organized into crypto Providers. Providers, as the name suggests, provide implementations for various crypto algorithms. The providers are loaded using JRE's configuration, either system-wide or per deployment, or can be loaded at application runtime. The order of available crypto providers is important as methods such as Cipher.getInstance(algorithm) without specifying the exact provider name (through second parameter) will return a matching implementation from the first provider that implements that crypto mechanism. Some providers, like one of the default JDK providers – SunJCE – provide only the basic crypto primitives. Others - like SunJSSE – provide higher level operations that rely on crypto primitives implemented by other providers. Those operations are, for instance, those being part of TLS or X509 standards in order to handle transport layer security or public key infrastructure. #### FIPS compliant implementations In order to use FIPS compliant and FIPS certified implementations of cryptographic mechanisms the application should use a crypto provider that interfaces with a concrete implementation certified to be FIPS compliant. Many 3rd party applications or libraries (packages) rely on the Provider infrastructure and cede the choice of crypto implementations to the app/system maintainer. Therefore in most cases the deployer – likely a sysadmin or devops – is free to choose an appropriate set of crypto providers for the application. OpenJDK for instance allows for configuring a PKCS11 provider which can interface with a native, system-wide crypto library – NSS and its PKCS11 implementation – libsoftokn3.so. This implementation by tuxcare is FIPS compliant. An alternative PKCS11 implementation is SoftHSM which uses OpenSSL underneath. However, the cryptographic boundary is slightly shifted here. libsoftokn3 with NSS is FIPS certified while softhsm library alone is not, although the underlying openssl is. There are also alternative ways to interface with other system wide, FIPS compliant, native libs such as OpenSSL however this would need extra effort to build and maintain other, 3rd party providers, that are not readily available in the package repos and would have to be provided by the maintainer of the end application. #### Java's crypto API diagram ![Java Crypto Providers](/images/providers.webp) #### SunPKCS11 provider SunPKCS11 is a provider which interfaces, through JNI, with a native implementation that exposes a PKCS11 crypto API, typically called a "token". Typically that would mean a hardware token – a device that implements crypto operations and exposes a PKCS11 interface through a "driver" being a native shared library. #### NSS-FIPS implementation NSS-FIPS implementation acts as a software token. It provides a PKCS11 interface like any USB crypto token, a HSM or a smart card would, but the actual implementation is provided in software using libnss3. #### JSSE JSSE provides TLS and PKI implementations and, if the provider set is properly configured, would have to rely on cryptographic primitives provided by NSS-FIPS. #### Alternative providers So far NSS is the only crypto library that alone provides an "upwards-facing" PKCS11 API and thus can be easily and seamlessly incorporated into a Java software solution. Other means include using: * softHSM Which is also a PKCS11 provider and relies on OpenSSL underneath, however, it doesn't itself fall within a FIPS cryptographic boundary of the system deliverables. * conscrypt However, conscrypt became problematic to maintain having been hardwired to boringSSL by Google. Even though boringssl essentially has the same API as OpenSSL, conscrypt would require extra maintenance and as such is not provided as an AlmaLinux package. * openssl-fips-java Maintained by Canonical but not available as a package (even in Ubuntu), this provider can be built to interface with the FIPS implementation of OpenSSL. #### PKCS11-NSS-FIPS setup As shown on the diagram, a PKCS11 provider needs to be configured in order to work with Java crypto. A HSM or smart card would require a driver in form of a shared library. For NSS specifically – OpenJDK provides several shorthand configuration attributes. The configuration can either be done in the application's Java code by passing the config as a String argument or through environment or system-wide via configuration files. #### System-wide config files * `(...)/security/java.security` This file specifies the provider list and the order of providers. In non-fips mode this file will contain the following: ```text security.provider.N=SunPKCS11 ${java.home}/lib/security/nss.cfg ``` while in FIPS mode: ```text fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg ``` Both directives configure a SunPKCS11 provider and point to the provider-specific configuration files * `(...)/security/nss.fips.cfg` ```text name = NSS-FIPS ``` The name which will be appended to "SunPKCS11-" identifying the configured provider Followed by nss-specific directives ```text nssLibraryDirectory = /usr/lib64 nssSecmodDirectory = ${fips.nssdb.path} nssDbMode = readWrite nssModule = fips ``` Instead of providing a full path to the NSS shared lib one needs only to point to a library directory containing NSS libraries. #### SoftHSM configuration The configuration of SoftHSM includes * setting up a config file. If the Java app is used in non-root context (as it probably is) then the config file needs to be user accessible and SOFTHSM2_CONF environment variable must point to it. * a keystore needs to be set up in the config file * a SoftHSM "token" needs to be created within the keystore directory. It must be PIN protected, therefore * in order to use crypto primitves Java application needs to instantiate SoftHSM KeyStore object and .init() it with the PIN. #### Limiting non-FIPS algorithm implementations Neither PKCS11 alone, nor NSS, does prevent library users from instantiating and using FIPS unapproved algorithms. Application developers are also free to include any code within their applications, including FIPS unapproved cryptographic algorithms in cryptographic context, or using FIPS unapproved algos, like SHA-1 in non-cryptographic contexts, like file checksums or lookup hashes. NSS implements a notion of a FIPS indicator which allows the application's implementer to decide what to do with a FIPS unapproved algorithms. Unlike openssl which bluntly fails if a non-fips operation is requested. The caveat – NSS's PKCS11 API does not provide a facility for querying the indicator as there can be no such facility within PKCS11. #### disabledAlgorithms directive Certain algorithms from NSS (or any other PKCS11 provider) can be blacklisted in the provider's config file (or by other means of configuring PKCS11). For instance DES based cipher mechanisms can be explicitly blocked using ```text disabledMechanisms = { CKM_DES_ECB CKM_DES_ECB_ENCRYPT_DATA CKM_DES3_ECB CKM_DES3_ECB_ENCRYPT_DATA CKM_DES_CBC CKM_DES_CBC_ENCRYPT_DATA CKM_DES_CBC_PAD CKM_DES3_CBC CKM_DES3_CBC_ENCRYPT_DATA CKM_DES3_CBC_PAD } ``` The above will not even appear on the mechanism list for this provider. ### Migrating from CentOS This guide contains steps on how to upgrade from CentOS 7 or Stream 8 [ELS](https://tuxcare.com/endless-lifecycle-support/centos-stream-8-eol-support/) to AlmaLinux 9.2 [ESU](https://tuxcare.com/fips-for-almalinux/). You will require an ESU license key from [https://tuxcare.com/buy/almalinux/](https://tuxcare.com/buy/almalinux/) or [https://tuxcare.com/buy/rockylinux/](https://tuxcare.com/buy/rockylinux/) or talk to your Account Manager about our ELS-to-ESU migration bundle offer. Ensure that you have a non-root user who can SSH and elevate privileges to root using su/sudo as this process will disable root SSH login. FIPS mode will also disable non-RSA SSH keys. Console access is recommended. Choose **one** of the migrations below (1a or 1b) based on your CentOS ELS version. Once you have migrated to AlmaLinux 8, the instructions for getting to 9.2 and enabling ESU/FIPS are the same. **1A. Migrate CentOS 7.9 ELS to AlmaLinux 8.10** ```text # update then disable els yum -y update dnf config-manager --set-disabled centos7* # install elevate 7to8 yum install -y http://repo.almalinux.org/elevate/elevate-release-latest-el7.noarch.rpm yum install -y leapp-upgrade leapp-data-almalinux leapp preupgrade leapp answer --section remove_pam_pkcs11_module_check.confirm=True leapp upgrade reboot ``` You will now be running AlmaLinux 8.10 and can skip ahead to step 2. **1B. Migrate CentOS Stream 8 ELS to AlmaLinux 8.10** ```text # update then disable els dnf -y upgrade dnf config-manager --set-disabled centos8stream-els # install almalinux-deploy curl -O https://raw.githubusercontent.com/AlmaLinux/almalinux-deploy/master/almalinux-deploy.sh bash almalinux-deploy.sh -d reboot ``` **2. Upgrade AlmaLinux 8.10 to 9.2** ```text # clean up sed -i '/^exclude=.*/d' /etc/yum.conf /etc/dnf/dnf.conf dnf -y remove *leapp* elevate-release els-define rm -rf /lib/modules/3.10* # disable root ssh in a portable way echo PermitRootLogin no | sudo tee -a /etc/ssh/sshd_config sed -i 's/^PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config # install elevate 8to9 dnf -y install https://repo.almalinux.org/elevate/elevate-release-latest-el8.noarch.rpm dnf -y install leapp-upgrade leapp-data-almalinux # upgrade specifically to 9.2 export LEAPP_DISABLE_NET_NAMING_SCHEMES=1 leapp preupgrade --target=9.2 leapp upgrade --target=9.2 reboot ``` **3. Enable AlmaLinux 9.2 ESU repositories and FIPS mode** ```text # clean up sed -i '/^exclude=.*/d' /etc/yum.conf /etc/dnf/dnf.conf dnf -y remove *leapp* elevate-release kernel-*.el8* # enable esu+fips dnf -y install https://repo.tuxcare.com/tuxcare/tuxcare-release-latest-9.2.noarch.rpm tuxctl --license-key XXXXXXXXXX dnf -y upgrade fips-mode-setup --enable reboot ``` See also [Enabling FIPS 140-3 mode](#enabling-fips-140-3-mode) ## **Essential and Enhanced Support** ### 1. Introduction In April 2023, TuxCare, a division of CloudLinux Inc., launched Enterprise Support for AlmaLinux, delivering a range of services for AlmaLinux workloads. It provides two levels of support, the essential level, focused on the operating system, and the enhanced support focused on applications. This document defines those services. **Overview of Services** There are two levels of support services: **Essential Support** - a limited technical support offering that covers AlmaLinux and Rocky Linux installation/update issues (packaging, dependencies, repositories), migration issues (from CentOS/OracleLinux/RHEL to AlmaLinux), operating systems bugs/kernel crashes, a self-service portal, as well as an online knowledge base **Enhanced Support** - an enterprise technical support service covering a range of open-source software, a self-service portal, as well as an online knowledge base. ### 2. Definitions **"Customer," "End User," "User," "You/Your"** shall mean an organization which has a valid license to the Product that is supported in accordance with this Program. **"Customer Technical Lead"** shall mean an employee or authorized contractor of Customer who shall complete required AlmaLinux/Rocky Linux product training, in order to serve as Customer's first line of internal support for the purpose of triaging AlmaLinux or Rocky Linux-related product issues, and who shall have authority to submit Technical Support Incidents and Service Requests to TuxCare Technical Support **"Incident"** shall mean any event reported by the Customer, which is not part of the standard operation of a Product, and which causes, or may cause an interruption to, or a reduction in, the quality of service provided by the Product. **"Incident Severity/Urgency"** shall mean a measure of the business criticality of an incident or problem based on the business needs of the Customer. See Appendix 1 for more details. **"Known Error"** shall mean a Problem that becomes a Known Error when the root cause is known, and a temporary workaround or permanent alternative has been identified. **"Problem"** shall mean an unknown underlying cause of one or more Incidents. It becomes a Known Error when the root cause is known, and a temporary workaround or permanent alternative has been identified. **"Product(s)"** shall mean software product(s) of TuxCare, which the Customer has purchased, deployed, and installed in accordance with the terms of a License Agreement between TuxCare and the Customer. **"Product Error"** shall mean undeclared behaviour of the Product. **"Response time"** shall mean the elapsed time measured from the moment of any incident receipt until confirmation of receipt by TuxCare to the initiator (via the support system). **"Service Request"** shall mean a request from a Customer for support, delivery, information, advice, or documentation, which is not related to an incorrect functioning or non-functioning of the Product(s). **"Upgrade"** shall mean a Product update associated with assigning a new version number. **"Workaround"** shall mean a procedure that may serve as a temporary solution to an incident. ### 3. Service Features | Feature | Essential Support | Enhanced Support | |------|:------|:------| |Support|
  • AlmaLinux/Rocky Linux installation/update issues (packaging, dependencies, repositories)
  • Migration advice and recommendations
  • Operating system bugs / kernel crashes; root cause analysis
***Outside the scope: software upgrades, requests to perform migration***|Coverage, includes the following applications:
  • Apps - Identity / Directory
    • FreeIPA, Bind
    • openldap
  • Apps - Infrastructure
    • Ceph
    • Samba
  • Containers (docker, podman)
  • VMs (KVM)
  • Apps - Package / Config management:
    • Foreman
    • Ansible
    • Puppet
    • Chef
  • Apps - Web servers
    • nginx
    • apache
    • squid
  • Apps - Data
    • SQL Databases (MariaDB, Postgresql)
    • Redis, MySQL, InfluxDB, CouchDB
  • Apps - Security / Compliance
    • OpenSCAP
  • Devops Apps:
    • gitlab/git, jenkins, kubernetes
  • Apps - event streaming
    • Apache Kafka
    • Rabbitmq
  • Migration advice and recommendations
  • Design & Architecture (e.g., review)
  • Data storage, backup assistance
  • Configuration assistance
***Outside the scope: code changes, software upgrades, requests to perform migration***| |Incident Support|24/7/365 support through web ticketing system|24/7/365 support through web ticketing system and email| |Allowed Number of Customer Technical Leads|2 per 1000 hosts, with maximum 10|2 per 1000 hosts, with maximum 10| ### 4. Description of Support Program #### Accessing Technical Support TuxCare Technical Support is designed for enterprise clients with trained IT staff which provide initial ‘1st-line' support to triage incidents. Customer and TuxCare will agree on Customer Technical Leads with the client, who will be entitled to access TuxCare Technical Support services; Customer Technical Leads must complete AlmaLinux/Rocky Linux training requirements. Customer Technical Leads may submit Technical Support Incidents and Service Requests to: 1. Technical Support ticketing system: [https://tuxcare.com/support-portal/](https://tuxcare.com/support-portal/) * Acceptance of requests 24 hours a day, 365 days a year * Unlimited number of tickets may be submitted * Customers will be supplied with instructions describing the use of the ticketing system during onboarding * User accounts will be created for each nominated user within each client organization * User accounts will have access to log, view and respond to tickets 2. Email: acceptance of requests 24 hours a day, 365 days a year: * New tickets may be created by simply emailing the support desk: [support@tuxcare.com](support@tuxcare.com) If you are a user of our server product AMI's on AWS Marketplace, before you contact support, you should have your AWS accountId to hand, there are various ways to find it. If you have the aws cli tool installed on your computer, you can run: ```text $ aws sts get-caller-identity --query Account --output text 123456789012 ``` Alternatively you can make a request to the AWS API from within a running instance, as described [here](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html#retrieve-iid), for example using IMDSv1: ```text $ curl -s http://169.254.169.254/latest/dynamic/instance-identity/document | grep accountId "accountId" : "123456789012", ``` Or if you have access to the [ec2 console](https://console.aws.amazon.com/console/home) you can simply click your username at the top right of the page. Your Account ID is the 12 digits in the dropdown. All customers are entitled to access the Support knowledgebase, FAQs, and other self-service tools as may be offered by TuxCare Enterprise Support. #### Response Time When submitting a ticket, Customers will select the appropriate Severity Level, as defined in Appendix A, from a drop-down list; TuxCare reserves the right to change the Severity Level based on available information. TuxCare will use reasonable efforts to respond to support requests within the initial response times described below, based on the Severity Level of the incident. |Severity Level|Essential Support|Enhanced Support| |------|:------|:------| |1|2 hours|30 minutes| |2|12 hours|2 hours| |3|2 business days|12 hours| |4|5 business days|2 business days| #### Incident Resolution Cooperation Some incidents may require reproduction by TuxCare for the purpose of testing and verifying a product error. Customer agrees to provide TuxCare with all information which may be necessary for reproducing the condition under which the incident will re-occur and could be examined. TuxCare will endeavor to reproduce the incident as soon as all the necessary information and software and/or hardware is provided. If the incident could not be reproduced, Customer should grant TuxCare a supervised remote access to the malfunctioning system. If the incident cannot be reproduced by either party, or Customer did not grant access to the network environment where the incident could be reproduced, or if it is detected that the incident's cause lies beyond the Product, the incident cannot be classified within this Support Program. An incident may at any time be either on the Customer's side (i.e. Customer is taking actions that will promote/expedite the resolution of the issue by TuxCare) or on the AlmaLinux side. An incident is on the Customer's side when TuxCare engineers request information from the Customer. When Customer provides the requested information to TuxCare, the incident is considered to be on the side of the latter. The period during which the incident may be on the Customer's side is limited to one calendar week. If the Customer's response is overdue, the incident is closed by timeout. ### Appendices #### Appendix A. Incident Severity Levels |Level: Descriptor|Criteria/Definition| |------|:------| |Level 1: Business Standstill|Production and/or mission critical services are down and there is no immediate workaround.
  • All or a majority of your mission critical environment is unavailable or not functioning
  • Your business operations are completely disrupted
  • Majority / All Critical users affected
  • Request from important client/partner (subject to management approval)
| |Level 2: Major Impact|Major feature or function failure; operations are severely restricted, but a workaround is available.
  • Critical business operations seriously affected
  • Direct fiscal impact
  • Substantial number of users are affected, or critical group of users are affected that would not allow the business to run normally
| |Level 3: Minor Impact|Minor feature or function failure; standard business operations can continue, though possibly in a minor restricted manner.
  • No immediate direct fiscal impact
  • A temporary workaround may have been provided
| |Level 4: General Inquiry/Issue|General usage questions or other non-critical inquiries.
  • Small number of users/systems affected
  • Documentation issue
  • General information request
  • Enhancement request
| #### Appendix B: Quality management **Incident escalation** Customer may escalate unresolved incidents or reports of dissatisfaction according to the following scheme: |Escalation Level|1|2|3| |------|------|---|---| |Escalation Path|Technical Senior Support Engineer|Specialized Support Team Lead or Manager|Chief Experience Officer (CXO)| **Provision of reports on open incidents** During the process of incident resolution, TuxCare will use reasonable effort to promptly provide the Customer with information regarding open incidents' status, according to the following table. |Severity Level|Report Schedule (through the web ticketing system)| |------|------| |1|By agreement, but not more often than once a day| |2|At least once every 3 business days| |3|At least once every 2 weeks| |4|Upon customer request| **Limitations of the Support Services** Technical support covered by any of the TuxCare Support Programs shall not be provided in the following cases: * Incidents already resolved for the Customer (e.g., an incident that occurred on one installed copy of the Product after the same incident had been resolved for another copy of the Product) * Troubleshooting of all issues similar or identical to already resolved issues (i.e. the incidents to which a previously produced solution can be applied without additional guidance from TuxCare) * Incidents caused by Customer's hardware malfunction * Incidents caused by software platform incompatibility (including, but not limited to beta software, new versions of service packs or additions, whose compatibility with the Product has not been confirmed with AlmaLinux/Rocky Linux) * Incidents caused by installing and running third-party applications (including, but not limited to the list of unsupported or incompatible applications published in the documentation) * Incidents for which the Customer cannot provide accurate information, as reasonably requested by TuxCare, in order to reproduce, investigate, and resolve the incident * Incidents which arise as a result of neglect or incorrect use of TuxCare instructions, which, if properly used, would have prevented the Incident #### Appendix C. Validity of Enhanced Support Hours Enhanced Support is sold in bundles of 5, 10, or 20 hours. The contract term for purchased Enhanced Support hours begins on the date of purchase unless otherwise agreed by the parties in the applicable Agreement or Quote. All purchased Enhanced Support hours remain valid for use only during the applicable contract term and expire at the end of that term. Any unused hours remaining at the end of the applicable contract term are forfeited, do not carry over to any renewal term, and are non-refundable and non-transferable. ### Installing tuxctl (Essential Support) Similarly to the ESU instructions [above](/enterprise-support-for-almalinux/#installing-tuxctl), Essential Support customers should install tuxcare-release and register their server using tuxctl. The main difference is the choice of OS version - you must install the RPM specifically for your AlmaLinux/Rocky Linux version, currently 8.8, 8.10, 9.2, 9.4, 9.5, 9.6, 9.7, 10.0 and 10.1 are supported. If you are unsure, run this to find your exact OS version: ```text $ cat /etc/almalinux-release AlmaLinux release 8.10 (Cerulean Leopard) ``` Or: ```text cat /etc/rocky-release Rocky Linux release 9.6 (Blue Onyx) ``` You can browse [https://repo.tuxcare.com/tuxcare/](https://repo.tuxcare.com/tuxcare/) and find the correct RPM, or you can figure it out by substituting the version number (8.8, 8.10, 9.2, 9.4, 9.5, 9.6, 9.7, 10.0 or 10.1) then install it as root, for example, choose one of these: For 8.10: ```text # dnf -y install https://repo.tuxcare.com/tuxcare/tuxcare-release-latest-8.10.noarch.rpm ``` For 9.7: ```text # dnf -y install https://repo.tuxcare.com/tuxcare/tuxcare-release-latest-9.7.noarch.rpm ``` For 10.1: ```text # dnf -y install https://repo.tuxcare.com/tuxcare/tuxcare-release-latest-10.1.noarch.rpm ``` Be aware that installing tuxcare-release will modify any files that match the wildcard `/etc/yum.repos.d/almalinux*.repo` and `/etc/yum.repos.d/rocky*.repo` The second step is to activate your license on the system. You should run the `tuxctl` tool as root with your Essential Support license key provided as a command line argument like so: ```text # tuxctl --license-key XXXXXXXXXX ``` If you get a status code 403: ```text Errors during downloading metadata for repository 'tuxcare-esu' ``` Then you are using an Essential Support license key for an Extended Security Updates release (9.2, 9.6 or 9.10) and can disable the ESU repository using: ```text dnf config-manager --set-disabled tuxcare-esu ``` ESU customers can find instructions [above](/enterprise-support-for-almalinux/#installing-tuxctl) **Managing license usage** To check if a server is already activated, you can run `tuxctl` and check for return code 0: ```text # tuxctl -v Server is registered with token ``` Or if not registered you will get a return code 1: ```text # tuxctl -v Server is not registered ``` If you are decommissioning a server and would like to de-register its license, you can run `tuxctl` like this and check for return code 0: ```text # tuxctl -d De-registration successful ``` **Upgrading** Essential Support customers can upgrade to a new minor version, for example from 9.6 to 9.7 by editing the /etc/dnf/vars/tuxcare_releasever file to specify the new version, like so: ```text # echo 9.7 > /etc/dnf/vars/tuxcare_releasever # dnf upgrade ``` ================================================================================ Source: https://docs.tuxcare.com/enterprise-support-for-almalinux/fips/ ================================================================================ # FIPS packages for AlmaLinux Community Below are the instructions for installing the TuxCare FIPS 140-3 validated modules for AlmaLinux and Rocky Linux 9.6, they should be run as root. **For commercial customers of our ESU product, please use the instructions [here](/enterprise-support-for-almalinux/#enabling-fips-140-3-mode) instead.** By installing this software, you agree to be bound by the terms of the [TuxCare Community EULA](https://tuxcare.com/wp-content/uploads/2023/09/COMMUNITY-EULA.txt). ```text # dnf -y install https://repo.tuxcare.com/fips/tuxcare-fips-release-latest-9.noarch.rpm # dnf -y install openssl-3.2.2-6.el9_6.1.tuxcare.6 kernel-5.14.0-570.21.1.el9_6.tuxcare.1 # fips-mode-setup --enable # reboot ``` Once you've logged in after the reboot, run this to confirm it worked (doesn't have to be root): ```text $ fips-mode-setup --check FIPS mode is enabled. $ uname -r 5.14.0-570.21.1.el9_6.tuxcare.1.x86_64 ``` If you wish to stay on the FIPS validated kernel/openssl packages when a newer community package is available, you can use `dnf versionlock` like so: ```text # dnf -y install 'dnf-command(versionlock)' # dnf versionlock add openssl*tuxcare* kernel*tuxcare* ``` To revert to the previous behaviour of getting updated kernel/openssl packages from the community, run the following as root: ```text # dnf versionlock delete openssl*tuxcare* kernel*tuxcare* ``` Alternatively you could set the `priority` level on the tuxcare repo to prefer the TuxCare packages: ```text # dnf config-manager --save --setopt="tuxcare-fips-community.priority=1" ``` And to revert: ```text # dnf config-manager --save --setopt="tuxcare-fips-community.priority=" ``` ================================================================================ Source: https://docs.tuxcare.com/eportal-api/ ================================================================================ # ePortal API You may need to create a separate ePortal account for API usage with: ``` kc.eportal user -a api-user -p ``` It can be useful for SSO/LDAP setups to be able to pass HTTP API credentials via basic auth. Starting with version 2.14-1, an API key can be used for authentication as an alternative to basic authentication. First, you need to generate an API token using ePortal admin UI. Then you can put it in the *X-Api-Key* http header. In this case the Authorization header is no longer needed. If for some reason the "X-Api-Key" header doesn't work for you, you can define your own header name in the API_AUTH_HEADER setting in eportal.conf. In general ePortal API is configuration management friendly and idempotent. You don't need to make additional request to check existing state. For example entity deletion doesn't raise an error in case there is no such entity. Or entity creation/modification is a single request that just works and simply brings desired final state. ## List servers **GET /admin/api/servers** Filters servers on various criteria, iterate through list and get server counts. Requires basic authorization with read only user permissions. **Query string parameters:** * `hostname`: String, optional. Return servers with a hostname like value. Value can contain `%` placeholder to match any string. * `ip`: String, optional. Return servers with IP like value. Value can contain `%` placeholder to match any string. * `service_id`: String, optional. Return a single server with the service ID equal to the provided value. * `feed`: String, optional. Return servers attached to feed. Use `main` for default feed. * `key`: String, optional. Return servers registered to key. * `registered_age`: Integer, optional. Return servers registered more than `registered_age` days ago. If `registered_age` is negative then return servers registered less or equal -`registered_age` days ago. For example: `registered_age=-3` means to return servers registered 3 or less days ago. Hours can be specified by adding `h` suffix: `registered_age=4h` selects servers registered more than 4 hours ago. * `checkin_age`: Integer, optional. Return servers sent check-in more than `checkin_age` days ago. For negative values see `registered_age`. * `updated_age`: Integer, optional. Return servers loaded patches more than `updated_age` days ago. For negative values see `registered_age`. * `is_updated`: Boolean, optional. If `true` then return servers updated to latest available patches. If `false` return servers without latest patches. * `limit`: Integer, optional. Limit result to a specified number of entries. By default `limit` is 10. * `offset`: Integer, optional. Set result to a specified offset. `limit` and `offset` can be used to iterate through result. * `only_count`: Boolean, optional. Return server count only. * `tag`: String, optional. Adds filter by server tag. E.g `tag=env:test` or `tag=ubuntu`. **Response:** ```json { "count": 42, "limit": 10, "offset": 0, "result": [ { "id": "99c97tz44uKX13b5", "ip": "10.51.16.72", "hostname": "localhost.localdomain", "key": "some-key", "feed": "main", "registered": "2021-04-08 16:43:23.907671", "checkin": "2021-07-12 17:35:56.065077", "updated": "2021-06-01 16:37:03.000000", "euname": "3.10.0-1160.25.1.el7", // effective kernel version "release": "3.10.0-957.5.1.el7.x86_64", // installed kernel version "kernel_id": "9647204d2708cad906a75944ee56ac68fc5b5704", "patch_level": 49, "patch_type": "default", "tags": null, "uptime": 6394092, "version": "#1 SMP Fri Feb 1 14:54:57 UTC 2019", "virt": "kvm", "kcare_version": "2.44-2", "distro": "CentOS Linux", "distro_version": "7.6.1810", "machine": "x86_64", "processor": "x86_64" }, ... ] } ``` ## Register host **POST /admin/api/register** Registers host by provided key and hostname. **Form (urlencoded) parameters:** * `key`: String, required. ePortal key to use for registration. * `hostname`: String, optional. Server's hostname to use. **Success response (200):** ```json { "server_id": "some-server-id" } ``` **Error response (400):** ```json { "error": "error code" # invalid-key | key-limit-reached } ``` **Example:** ``` curl -X POST https://eportal.corp.com/admin/api/register -F key=test {"server_id":"lw1MO1Du5sF3Cj39"} ``` ## Unregister host **POST /admin/api/delete_server** Removes registered servers by IP, hostname or server_id Requires basic authorization with admin user permissions. **Query string parameters:** * `hostname`: String, optional. Server's hostname to delete. * `ip`: String, optional. Server's IP to delete. * `server_id`: String, optional. Server's id to delete. Endpoint requires at least one parameter `hostname`, `ip` or `server_id`. **Response:** Response contains number of deleted servers. ```json { "result": 1 } ``` For example: ``` curl --user admin:admin-password -X POST https://eportal.corp.com/admin/api/delete_server?ip=192.168.1.1 ``` Below are examples of using `/admin/api/delete_server` endpoint with various CM products. Take note, you need a host IP, a hostname or a server_id to delete it via API. It can be more convenient to use on of: * if you have an access to a host (it is alive) it's a way more simpler to call `kcarectl --unregister` to delete the host. * if host is already destroyed you can consider using bulk [inactive server cleanup](#clean-inactive-servers). ## Bulk unregister hosts **DELETE /admin/api/servers** Removes registered servers by the latest check-in age. Requires basic authorization with admin user permissions. **Query string parameters:** * `checkin_age`: Integer, required, greater or equal 1. Delete servers that sent latest check-in more than `checkin_age` days ago. **Response:** Response contains number of deleted servers. ```json { "result": 1200 } ``` For example: ``` curl --user admin:admin-password -X DELETE https://eportal.corp.com/admin/api/servers?checkin_age=15 ``` ## Create/modify feed **POST /admin/api/feeds/** If feed already exists request modifies it. Requires write permissions and accepts basic authorization. **Query string/Form/JSON parameters:** * `name`: String, required. Name of created or modified feed. * `auto`: Boolean, optional. Sets auto-update property. Default is false. * `deploy_after`: Integer, optional. Sets delayed period in hours. Default is 0 (not delayed). * `channel`: String, optional. Sets patchset channel to use. Default is `default`. Available channels: - `default`: stable patches. - `test`: testing patches. **Response:** ```json { "result": { "name": "test-feed", "auto": true, "deploy_after": 0 } } ``` **Example:** ``` curl -X POST -u admin -d name=test-feed -d auto=true https://eportal.corp.com/admin/api/feeds/ ``` ## List feeds **GET /admin/api/feeds/** Returns list of existing feeds. Take note: `main` feed is alway present and couldn't be modified. Requires read permissions and accepts basic authorization. **Response:** ```json { "result": [ { "auto": false, "deploy_after": 0, "name": "feed-name" }, ... ] } ``` **Example:** ``` curl -u admin https://eportal.corp.com/admin/api/feeds/ ``` ## Delete feed **DELETE /admin/api/feeds/:feed-name** Requires write permissions and accepts basic authorization. **Response:** ```json { "result": 1 // number of deleted records, 0 if there is no such feed. } ``` **Example:** ``` curl -X DELETE -u admin https://eportal.corp.com/admin/api/feeds/test-feed ``` ## Create/modify registration key **POST /admin/api/keys/** If key already exists request modifies it. Requires write permissions and accepts basic authorization. **Query string/Form/JSON parameters:** * `key`: String, optional. Name of created or modified key. If it's empty random key is generated. * `feed`: String, optional. Name of attached feed. `main` by default. * `note`: String, optional. Description of the key. * `server_limit`: Integer, optional. Advisory limit of a maximum number of hosts one can register on the key. **Response:** ```json { "result": { "key": "key", "feed": "feed-name", "note": "some-note", "server_limit": 0 } } ``` **Example:** ``` curl -X POST -u admin -d key=test-key -d feed=test-feed https://eportal.corp.com/admin/api/keys/ ``` ## List keys **GET /admin/api/keys/** Returns list of existing keys. Requires read permissions and accepts basic authorization. **Response:** ```json { "result": [ { "key": "test", "feed": "main", "note": null, "server_limit": 0 }, ... ] } ``` **Example:** ``` curl -u admin https://eportal.corp.com/admin/api/keys/ ``` ## Delete key **DELETE /admin/api/keys/:key** Requires write permissions and accepts basic authorization. **Response:** ```json { "result": 1 // number of deleted records, 0 if there is no such key. } ``` **Example:** ``` curl -X DELETE -u admin https://eportal.corp.com/admin/api/keys/test-key ``` ## List patchsets **GET /admin/api/patchsets/** Endpoint lists available patchsets for a specified feed and product, optionally filtered by distribution(s). The distro filter narrows results to only those patchsets that apply to the specified distributions. If no distro is provided, patchsets for all available distributions are returned. Results are returned from oldest to newest patchsets. Requires read permissions and accepts basic authorization. **Query string parameters:** * `feed`: String, optional. Name of the feed to list patchsets for. `main` by default. * `product`: String, optional. Possible values are: `kernel`, `user`, `qemu`, `db`. Selects a patchstore for a specified product. `kernel` by default. * `distro`: String (multi), optional. Filters results by one or more Linux distributions. Can be passed multiple times, e.g., `?distro=centos7&distro=almalinux8`. **Response:** ```json { "result": [ { "patchset": "patchset-name", "status": "enabled", // possible values are: enabled, disabled, not-downloaded, undeployed "distros": ["distro-1", "distro-2"] }, ... ] } ``` **Example:** ``` curl -u admin 'https://eportal.corp.com/admin/api/patchsets/?feed=main&product=kernel&distro=almalinux8' ``` ## Manage patchsets **POST /admin/api/patchsets/manage** Allows to perform deploy actions on the patchsets. Requires write permissions and accepts basic authorization. **Query string parameters:** * `patchset`: String, required. Name of the patchset to operate on. * `feed`: String, required. Name of the feed to operate on. Can be specified multiple times. * `action`: String, requred. Operartion to perform: - `enable`: enable specified patchset. - `disable`: disable specified patchset. - `enable-upto`: enable all patchset up to (older than) specified. - `undeploy-downto`: undeploy all patchsets down to (newer than) specified. * `product`: String, optional. Possible values are: `kernel`, `user`, `qemu`, `db`. Selects a patchstore for a specified product. `kernel` by default. **Response:** ```json { "result": "ok" } ``` **Example:** Enable libcare patchset `U20200506_01` in `main` and `test-feed` feeds: ``` curl -X POST -u admin 'https://eportal.corp.com/admin/api/patchsets/manage?patchset=U20200506_01&feed=main&feed=test-feed&product=user&action=enable' ``` ## List users **GET /admin/api/users/** Returns list of existing users. Requires read permissions and accepts basic authorization. **Response:** ```json { "result": [ { "id": 1, "username": "test", "description": "test user", "readonly": false }, ... ] } ``` **Example:** ``` curl -u admin https://eportal.corp.com/admin/api/users/ ``` ## Set tags **POST /admin/api/set_tags** Allows assign tags to server Requires write permissions and accepts basic authorization. **Query string parameters:** * `server_id`: String, required. ID of the server to attach tags. * `tags`: String, optional. String with semicolon divided tags. If the parameter is not presented, all tags will be removed These parameters can also be provided in the JSON body with the header `Content-Type: application/json` **Response:** ```json { "result": "ok" } ``` **Example:** Assign tags `test` and `stage` to server with id `test-centos` ``` curl -X POST -u admin 'https://eportal.corp.com/admin/api/set_tags?server_id=test-centos&tags=test;stage' ``` ## Configuration manager integration ### Ansible playbook Integrating ePortal API access with Ansible is now possible. Rather than calling the kernelcare agent to perform tasks, it is possible to replace it with direct calls to ePortal to achieve the same results. Unregister KernelCare agent through API playbook: ```json - hosts: kernelcare vars: eportal_srv: http://eportal.address.here[:port if needed] tasks: - name: unregister kernelcare agent through API uri: url: "{{ eportal_srv }}/admin/api/delete_server?ip={{ ansible_default_ipv4.address|default(ansible_all_ipv4_addresses[0]) }}" method: POST user: your-api-user password: your-api-user-password force_basic_auth: yes ``` Example: ```json - hosts: kernelcare vars: eportal_srv: http://192.168.246.110 tasks: - name: unregister kernelcare agent through API uri: url: "{{ eportal_srv }}/admin/api/delete_server?ip={{ ansible_default_ipv4.address|default(ansible_all_ipv4_addresses[0]) }}" method: POST user: api-user password: dummy force_basic_auth: yes ``` Example of server tagging: ```json - hosts: kernelcare vars: eportal_srv: http://192.168.246.110 eportal_tags: 'staging;location:Boston' tasks: - name: get systemid content slurp: src: /etc/sysconfig/kcare/systemid register: systemid_file - name: set server_id set_fact: eportal_server_id: "{{ systemid_file.content | b64decode | trim | regex_replace('^server_id=(\\w+)$', '\\1') }}" - name: set server tags using ePortal API uri: url: '{{ eportal_srv }}/admin/api/set_tags' method: POST headers: X-Api-Key: '{{ lookup("env", "EPORTAL_API_TOKEN") }}' body_format: form-urlencoded body: server_id: '{{eportal_server_id }}' tags: '{{ eportal_tags }}' ``` Ad hoc run with: ``` ansible-playbook -u ansible ./kernelcare.yml ``` This can be called during machine tear down to properly remove the server from ePortal. ### Chef recipe Having tighter integration with automation tools like Chef has always been a goal for KernelCare and related tools like ePortal. The following recipe demonstrates how to use the delete_server api to correctly remove a server from ePortal during tear down, and can be integrated with your other recipes to avoid manual operations. Unregister KernelCare agent through API recipe: ```json eportal_url = "EPORTAL URL" eportal_user = "EPORTAL API USER NAME" eportal_password = "EPORTAL API USER PASSWORD" # the ip to unregister can be pulled automatically from the system where the recipe is applied, or specified manually (by replacing the following line with a simple assignment) ip_to_unregister = "#{node['network']['interfaces'][node['network']['default_interface']]['addresses'].select{|k,v| v['family'] == "inet"}.keys.first}" http_request "kernelcare-unregister-api" do url "#{eportal_url}/admin/api/delete_server?ip=#{ip_to_unregister}" action :post headers({'AUTHORIZATION' => "Basic #{ Base64.encode64("#{eportal_user}:#{eportal_password}")}", }) end ``` Example (kernelcare-unregister-api.rb): ```json eportal_url = "http://192.168.246.110" eportal_user = "api-user" eportal_password = "dummy" ip_to_unregister = "#{node['network']['interfaces'][node['network']['default_interface']]['addresses'].select{|k,v| v['family'] == "inet"}.keys.first}" http_request "kernelcare-unregister-api" do url "#{eportal_url}/admin/api/delete_server?ip=#{ip_to_unregister}" action :post headers({'AUTHORIZATION' => "Basic #{ Base64.encode64("#{eportal_user}:#{eportal_password}")}", }) end ``` Example of server tagging (kernelcare-tag-server.rb): ```json eportal_url = "http://192.168.246.110" eportal_api_key = "Lgk5-qWeBypejSEc6nYmalGbv11Kh_OyWi2_vigrTro" tags = "staging;location:Boston" ruby_block 'get-server-id' do block do node.run_state['server_id'] = File::read('/etc/sysconfig/kcare/systemid').gsub(/server_id=(\w+)\s*/, '\1') end action :run end http_request 'kernelcare-set-server-tags' do url "#{eportal_url}/admin/api/set_tags" action :post message lazy {{'server_id' => "#{node.run_state['server_id']}", 'tags' => tags}.to_json} headers({'X-Api-Key' => eportal_api_key, 'Content-Type' => 'application/json'}) end ``` Ad hoc run with: ``` chef-apply kernelcare-unregister-api.rb ``` Output: ```json Recipe: (chef-apply cookbook)::(chef-apply recipe) * http_request[kernelcare-unregister-api] action post - http_request[kernelcare-unregister-api] POST to http://192.168.246.110/admin/api/delete_server?ip=192.168.246.40 ``` This can be called during machine tear down to properly remove the server from ePortal. ### Puppet task Puppet provides the framework to run tasks on target systems. The following is a bash script that can run as such a task and demonstrates how to use the delete_server api to correctly remove a server from ePortal during tear down. It can be integrated with your other removal scripts or tasks to avoid manual operations. Unregister KernelCare agent through API call: ``` #!/bin/bash EPORTAL_API_USERNAME= EPORTAL_API_PASSWORD= EPORTAL_URL='your ePortal URL' #this is taken from the primary ip in the system. If awk is available, it is used, but a fallback using other common tools is also provided if hash awk 2>/dev/null; then IP_TO_UNREGISTER=`ip route get 1 | awk '{print $(NF-2);exit}'` # using awk else IP_TO_UNREGISTER=`ip route get 1 | cut -f 3 -d" "| head -1` # simpler alternative for when awk is not available fi curl -kL -u "${EPORTAL_API_PASSWORD}"':'"${EPORTAL_API_PASSWORD}" -X POST "${EPORTAL_URL}"'/admin/api/delete_server?ip='"${IP_TO_UNREGISTER}" ``` Example (unregister_server.sh): ``` #!/bin/bash EPORTAL_API_USERNAME=admin EPORTAL_API_PASSWORD=admin EPORTAL_URL='http://192.168.246.110' #this is taken from the primary ip in the system. If you want to pick a different one, adjust the next line. if hash awk 2>/dev/null; then IP_TO_UNREGISTER=`ip route get 1 | awk '{print $(NF-2);exit}'` # using awk else IP_TO_UNREGISTER=`ip route get 1 | cut -f 3 -d" "| head -1` # simpler alternative for when awk is not available fi curl -kL -u "${EPORTAL_API_PASSWORD}"':'"${EPORTAL_API_PASSWORD}" -X POST "${EPORTAL_URL}"'/admin/api/delete_server?ip='"${IP_TO_UNREGISTER}" ``` Example of server tagging (tag_server.sh) ``` #!/bin/bash EPORTAL_URL='http://192.168.246.110' EPORTAL_TAGS='staging;location:Boston' EPORTAL_API_KEY='Lgk5-qWeBypejSEc6nYmalGbv11Kh_OyWi2_vigrTro' EPORTAL_SERVER_ID=$( grep -oP 'server_id=\K(.+)' /etc/sysconfig/kcare/systemid ) curl -kL -H "X-Api-Key: ${EPORTAL_API_KEY}" --data-urlencode "server_id=${EPORTAL_SERVER_ID}" --data-urlencode "tags=${EPORTAL_TAGS}" "${EPORTAL_URL}/admin/api/set_tags" ``` ### Puppet Plan If you prefer to have a plan rather than a task, then you can create one from this script with the following steps: * Create a new directory called `eportal_puppet` * Inside this directory, create a bolt project: ``` bolt project init ``` * Create a scripts directory inside it * Place the script above inside of it (call it `unregister_server.sh`) * Create the bolt plan using: ``` bolt plan new eportal_puppet::unregister_server --script eportal_puppet/scripts/unregister_server.sh ``` * Now your plan is ready and can be called directly with: ``` bolt plan run eportal_puppet:unregister_server -t ``` Ad hoc run example with: ``` bolt plan run eportal_puppet::unregister_server -t 192.168.246.110 ``` This can be called during machine tear down to properly remove the server from ePortal. ================================================================================ Source: https://docs.tuxcare.com/eportal/ ================================================================================ # ePortal TuxCare ePortal is the web management console dedicated to KernelCare Enterprise live patch management. ePortal software can help protect servers located behind the firewall (i.e. with no internet access) and can be installed both on-premises and in the cloud. ![Overview](/images/eportal-overview.svg) ## ePortal Hardware Requirements **Disk:** | Installation mode | Minimum | Recommended | |-------------------|---------|-------------| | Default (mirror all distros) | 1 TB | 2 TB | | With distro filter | Scales with the subset of mirrored distros | — | | [Cache mode](#cache-mode) | 25 GB | 50 GB | * SSD with at least 100 IOPS * Plan for additional growth of about 4–5 GiB/month SSD-based storage is a crucial requirement for ePortal server. If full mirroring is not required, the footprint can be reduced significantly by: * Enabling [cache mode](#cache-mode) during installation — patchsets are served on demand from TuxCare instead of stored locally. * Limiting the set of mirrored distros via the **Patch Source** configuration — only the selected distros are downloaded. * Running `kc.eportal --clean-releases` regularly to purge obsolete patchsets. See [Clean obsolete releases](#clean-obsolete-releases). **CPU:** As far as other requirements concerned, we have tested the following configuration and the following number of connected servers: * 10k of connected machines is the maximum for the following requirements: * VM * 1 VCPU * 1 GB RAM * 75k of connected machines is the maximum for the following requirements: * Core i5 * 1 CPU * 4 GB RAM ## Installation If you are installing for the first time, please confirm with our sales engineering team at [sales@tuxcare.com](sales@tuxcare.com) **BEFORE** trying the installation via the documentation below. Please note that support tickets resulting from not following this recommendation will not be accepted. ePortal is compatible with 64-bit versions of EL7/8/9 based distros like CentOS 7/8, AlmaLinux 8/9/10, Ubuntu 20.04/22.04/24.04 and Debian 11/12/13 ## Automated Installation Script TuxCare provides an automated installation script that simplifies the ePortal installation and configuration process. The script handles repository setup, package installation, and initial configuration. ### Supported Distributions The installer script supports the following distributions: **RHEL-based:** * AlmaLinux 8, 9, 10 * Red Hat Enterprise Linux (RHEL) 8, 9, 10 * Oracle Linux (OEL) 8, 9, 10 **Debian-based:** * Debian 11, 12, 13 * Ubuntu 20.04, 22.04, 24.04 ### Main Features The installer script automates the following: * **Repository Configuration**: Automatically configures the required repositories (Nginx and TuxCare ePortal) * **Package Installation**: Installs ePortal and all required dependencies * **Service Validation**: Verifies that ePortal service is properly installed and running * **Admin Password Setup**: Interactive configuration of the admin user password * **Cache Mode Configuration**: Optional configuration to enable patch caching mode (reduces disk space requirements) * **Business Units Configuration**: Optional setup for multi-tenant business unit isolation * **Proxy Configuration**: Optional proxy server configuration for environments requiring it * **SSL Certificate Setup**: Optional Let's Encrypt SSL certificate installation and configuration * **Firewall Configuration**: Automatically configures firewall rules for HTTP/HTTPS access ### Using the Installation Script Download and run the installer script: ```text # curl -O https://repo.cloudlinux.com/kcare-eportal/eportal_installer.sh # chmod +x eportal_installer.sh # ./eportal_installer.sh ``` The script will: 1. Detect your Linux distribution and version 2. Configure the necessary repositories 3. Install ePortal and dependencies 4. Guide you through interactive configuration steps 5. Optionally configure SSL certificates After installation, you can access ePortal at `http://YOUR_SERVER_IP/admin` using the admin credentials you configured during installation. The installer script requires root privileges and will prompt you to agree to the terms before proceeding. ## Manual Installation If you prefer to install ePortal manually or need more control over the installation process, follow the instructions below. ### RHEL-based distros For installation and workability of ePortal the Nginx web server is required. We recommend to use stable version from the official Nginx repository: ```text # cat > /etc/yum.repos.d/nginx.repo < /etc/yum.repos.d/kcare-eportal.repo < /etc/apt/sources.list.d/kcare-eportal.list < /etc/apt/sources.list.d/kcare-eportal.list < /etc/apt/sources.list.d/kcare-eportal.list < /etc/apt/sources.list.d/kcare-eportal.list < /etc/apt/sources.list.d/kcare-eportal.list < /etc/apt/sources.list.d/kcare-eportal.list < kernelcare/eportal:latest ``` The ePortal image uses several environment variables which are useful for the advanced configuration | Environment variable | Description | Default value | | ---------------------------------------- | ------------------------------------------------------------------------------------ | ------------- | | EPORTAL_SERVER_STATS_PERIOD | timeout in seconds when eportal send usage statistics | 1 day | | EPORTAL_AUTO_UPDATE_PERIOD | timeout in seconds when eportal tries to pull updates | 10 min | | EPORTAL_LIMIT_PATCHSETS | process at most N latest patchsets from patchserver | None (all) | | EPORTAL_PROXY | proxy connection string | unset | | EPORTAL_REDUCED_REPORT | do not send detailed stats to patchserver | False | | EPORTAL_NODE_URL | this node URL (replication setup) | unset | | EPORTAL_LEADER_URL | leader node URL (replication setup) | unset | | EPORTAL_REPLICATION_SHARED_KEY | shared secret for replicas (replication setup) | unset | | EPORTAL_REPLICATION_CHECK_CERT | whether to check node certificate | True | | EPORTAL_REPLICATION_CLEAN_AGE | replication log retention period in seconds | 7 days | | EPORTAL_REPLICATION_CLEAN_AGGRESSIVE_AGE | retention period for aggressive policy | 1 hour | | EPORTAL_REPLICATION_STANDBY | passive mode for node (only receiving changes) | False | | EPORTAL_CACHE_MODE | pass patch request directly to patchserver without preliminary downloading patchsets | False | | EPORTAL_PATCH_SOURCE_URL | patch source | https://downloads.kernelcare.com/patch-download/ | | EPORTAL_PATCH_SOURCE_USER | patch source user, if set, will overwrite patch source configuration in UI | unset | | EPORTAL_PATCH_SOURCE_PASSWORD | patch source password | unset | | EPORTAL_BUNITS | enable business units feature (multi tenancy) | False | | EPORTAL_BUNITS_LOGIN_SELECTOR | allows to select business unit when logging in | False | | EPORTAL_RADAR_PROXY_ENABLE | enable TuxCare RADAR proxying | False | | EPORTAL_RADAR_PROXY_BASEURL | TuxCare RADAR URL | https://radar.tuxcare.com | | EPORTAL_SEND_CHECKIN_PERIOD | servers check-ins report period in seconds | 1 day | | EPORTAL_ENABLE_ERROR_REPORTING | send application errors to the patchserver | False | For example, if you need to send reduced stats: ```text docker run -d --rm --network=host \ -e EPORTAL_REDUCED_REPORT=1 \ -v eportal-volume:/var/lib/eportal/data/ \ kernelcare/eportal:latest ``` Users management command should be executed in the running container. For example, to create an admin user: ```text docker exec kc.eportal -a admin -p AdminPassword ``` #### Image upgrade and downgrade Typically, upgrading or downgrading ePortal image does not require any additional actions. Special cases of downgrading: * Downgrade **from** versions <= 2.11-1 is not supported * Downgrade **to** versions <= 2.11-1 requires additional steps. For example, having data dir created with kernelcare/eportal:2.12-1, you want to downgrade to kernelcare/eportal:2.8-1. First, make a backup of eportal-volume, then proceed with ```text docker run --rm -v eportal-volume:/var/lib/eportal/data --entrypoint=python3.8 \ -it kernelcare/eportal:2.8-1 /var/lib/eportal/data/migration/migratedb.py ``` Then you can use kernelcare/eportal:2.8-1 image to run container as usual. ## Allowed hosts We must declare the list of allowed hosts in the configuration for security reasons. It help to avoid HTTP Host header attacks. According to your installation, you need to add this parameter into [ePortal config file](#config-files): ```text ALLOWED_HOSTS = ['node1-yourdomain.example.com', 'node2-yourdomain.example.com'] ``` Instead of an example, use the DNS name(s) of your ePortal server installation. Default value is `[]`. ## Cache mode Cache mode allows to greatly reduce disk usage requirements and speed up initial downloading step. In cache mode ePortal downloads only lightweight meta information about patchsets and proxies patch requests from KernelCare agent to the patch server (Patch Source). Downloaded patch binaries are cached for 2 weeks and accessible for following requests directly from ePortal and doesn't consume public internet bandwidth. ![Cache mode](/images/eportal-cache-mode.svg) ### Enable cache mode 1. add the following setting into the [ePortal config file](#config-files): ```text CACHE_MODE = True ``` 2. restart ePortal: ```text # systemctl restart eportal ``` For existing installations you have to refetch meta info for existing patchsets: ```text # kcare/kc.eportal cache-mode --fetch-meta ``` ### Disable cache mode 1. remove or comment the line below in the [ePortal config file](#config-files): ```text CACHE_MODE = True ``` 2. download missing patchests: ```text # kcare/kc.eportal kcare download-missing ``` 3. restart ePortal: ```text # systemctl restart eportal ``` ## Proxy configuration ePortal can fetch packages and patches via a customer's proxy server. ![Proxy](/images/eportal-with-proxy.svg) On the ePortal machine, you should define the same proxy settings as you use on the command line. To do so, add `PROXY = 'http://example.com:3128'` into the [ePortal config file](#config-files): ```text # echo "PROXY = 'http://example.com:3128'" >> /etc/eportal/config ``` ePortal also supports a SOCKS5 proxy via `socks5://` proxy scheme: ```text # echo "PROXY = 'socks5://example.com:1080'" >> /etc/eportal/config ``` Restart ePortal (see the [Stopping & Starting](#stopping-starting) section, choose a corresponding OS). ### URLs to allow If ePortal is deployed behind a proxy or a restrictive firewall, allow outbound **HTTPS (TCP 443)** to the following hosts: | URL | Purpose | Required | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- | | `https://downloads.kernelcare.com` | Patch source: downloads patchsets and update metadata, and sends usage statistics and error reports. Authenticated with your patch-source credentials. | Yes | | `https://repo.cloudlinux.com` | TuxCare package repository. Hosts the `kcare-eportal` package and the KernelCare agent installer/packages that ePortal proxies to client servers. | Yes | | `https://patches.kernelcare.com` | Patch server: ePortal proxies patch-server requests and agent doctor-report uploads here. | Yes | | `https://radar.tuxcare.com` | TuxCare RADAR (default endpoint; configurable via `RADAR_PROXY_BASEURL`). | When RADAR proxying is enabled (`RADAR_PROXY_ENABLE`) | | `https://repo.eportal.kernelcare.com` | Legacy ePortal package repository (older EL7 installations); also used by the `kc.eportal doctor` connectivity check. | Optional | The `downloads.kernelcare.com` and `radar.tuxcare.com` addresses are defaults. If you point ePortal at a different patch source (`PATCH_SOURCE_URL`) or RADAR endpoint (`RADAR_PROXY_BASEURL`), allow your configured URL instead. Installing ePortal's OS dependencies (for example, the Nginx web server) may additionally require access to your distribution's package repositories and the [official Nginx repository](https://nginx.org/). ## Auth configuration | Setting | Description | |---|---| | `AUTH_RESTRICTED_INDEX` | Allow access to the index page only for registered users | | `AUTH_PASSWORD_MIN_LENGTH` | Minimal password length, default 5 | | `AUTH_SESSION_LIFETIME` | Session lifetime in seconds, by default session will last till browser closing | | `AUTH_REFRESH_SESSION` | If `False` (default), expires session after lifetime seconds after login. If `True`, expires session after lifetime seconds of inactivity. | You can set configuration in [ePortal config file](#config-files). ## Managing Users You can manage portal using `kc.eportal user` utility: ```text usage: kc.eportal user [-h] [-a] [-c] [-d] [-p PASSWORD] [-r {admin,readonly}] [--note NOTE] [user] list available users by default positional arguments: user user name optional arguments: -h, --help show this help message and exit -a action: add new user -c action: change user -d action: delete user -p PASSWORD, --password PASSWORD -r {admin,readonly}, --role {admin,readonly} --note NOTE description ``` To add a user: ```text # kc.eportal user -a -p AdminPassword admin ``` To change user's password: ```text # kc.eportal user -c -p NewPassword admin ``` Set user as read-only: ```text # kc.eportal user -c -r readonly admin ``` ## Authentication using LDAP ePortal supports LDAP authentication via bind operation. Every user should have a DN with an ability to perform bind request. ePortal doesn't sync users so you don't need to set special DN/password to access LDAP server. ### Configuration LDAP configuration settings are available inside the `Settings / LDAP` navigation item. #### URL Specifies host, port, and protocol of the LDAP server to connect to. Format: `://[:port][?params]` * **scheme**: * `ldap`: a verified encrypted TLS connection, you can specify `tls=0` to use an insecure connection; * `ldaps`: an SSL connection; * **host**: hostname or ip of your LDAP server; * **port**: custom port, by default 389 for `ldap` and 636 for `ldaps` scheme; * **params**: * `strict_check=0`: enable/disable strict SSL certificate verification (enabled by default); * `tls=0`: enable/disable TLS handshake on connect (enabled by default); * `timeout=30`: LDAP server connection timeout (in seconds, 5 by default). For example: * `ldap://ldap.forumsys.com?tls=0&timeout=30`: use insecure connection with 30s connection timeout. #### Connection String (DN template) Connection string is a DN template used in LDAP bind operation. All `%s` template placeholders will be replaced with the username from the login form. For example: `uid=%s,dc=example,dc=com` Some LDAP implementations support additional templates for bind requests: * Active Directory accepts the `%s@example.com` template; * `cn=%s,dc=example,dc=com` or `email=%s,dc=example,dc=com` can be also valid. #### Filter Filter is an optional setting which specifies parameters for an additional LDAP search request to limit users who have access to ePortal. Usually it is a check of a group a user belongs to. If the search returns a non-empty result the user will be considered authenticated. Format: `???`, is a part of [The LDAP URL Format RFC](https://tools.ietf.org/html/rfc2255) * **base**: a search base, a root node to perform search from; * **scope**: a search scope; * `base`: search only for base (default); * `one`: search for direct ascendants only (one level deep from base); * `sub`: search in whole tree; * **filter**: search filter to apply. For example: `dc=example,dc=com??one?(&(ou=mathematicians)(uniqueMember=uid=%s,dc=example,dc=com))` You can use a `%s` placeholder in the `Filter` setting as well. It will be replaced with the username from the login form. ### Login process When a user logs in to ePortal, ePortal checks the user credentials in the local database at first. If the credentials are found, the user will be authenticated, and only if the user credentials are not found, ePortal redirects to LDAP. When you log in to ePortal with your LDAP credentials for the first time, a user with LDAP username, read-only permissions, and `LDAP` description is created in the database by default (`https:///admin/user/`). In the picture, you can see one user created with `kc.eportal` command line interface and two users logged in with LDAP credentials: ![ldap users](/images/eportalLDAPusers.png) All fresh LDAP users have read-only permissions. You can set admin rights on `User edit` page by turning off `Readonly` field. ### Basic setup example The following examples are based on the public test LDAP server [ldap.forumsys.com](https://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server/) Here is a list of our users: ```text ~$ ldapsearch -H ldap://ldap.forumsys.com -LLL -x -b 'dc=example,dc=com' '(objectClass=person)' dn dn: uid=tesla,dc=example,dc=com dn: uid=gauss,dc=example,dc=com ... ``` Basic setup only checks if the provided username/password can bind to your directory service. Note: all fresh users have read-only permission so you can safely allow them to login into eportal and set correct permissions individually. For a basic setup you should fill `Url` and `Connection string` settings: |Setting|Value| |-|-| |URL|ldap://ldap.forumsys.com?tls=0| |Connection string|uid=%s,dc=example,dc=com| After that you can login using `gauss:password` or `tesla:password` credentials. ### Filter setup example Filter allows you to limit a set of users permitted to login into ePortal, for example users belonging to the `mathematicians` group. Here are our example groups: ```text ~$ ldapsearch -H ldap://ldap.forumsys.com -LLL -x -b 'dc=example,dc=com' '(objectClass=groupOfUniqueNames)' dn dn: ou=mathematicians,dc=example,dc=com dn: ou=scientists,dc=example,dc=com ... ``` And `mathematicians` group attributes: ```text ~$ ldapsearch -H ldap://ldap.forumsys.com -LLL -x -b 'dc=example,dc=com' '(ou=mathematicians)' dn: ou=mathematicians,dc=example,dc=com uniqueMember: uid=euclid,dc=example,dc=com uniqueMember: uid=riemann,dc=example,dc=com uniqueMember: uid=euler,dc=example,dc=com uniqueMember: uid=gauss,dc=example,dc=com uniqueMember: uid=test,dc=example,dc=com ou: mathematicians cn: Mathematicians objectClass: groupOfUniqueNames objectClass: top ``` ePortal LDAP settings to limit allowed users: |Setting|Value| |-|-| |URL|ldap://ldap.forumsys.com?tls=0| |Filter|dc=example,dc=com??one?(&(ou=mathematicians)(uniqueMember=uid=%s,dc=example,dc=com))| |Connection string|uid=%s,dc=example,dc=com| The filter idea is to find the `mathematicians` group which has an attribute `uniqueMember` equal to DN of our user who tries to login. After that you can login using `gauss:password` but not `tesla:password` credentials. ## Accessing ePortal To access KernelCare.eportal management console, connect to **http://YOUR_IP/admin** and enter your login & password. ![login screen](/images/access_eportal.png) You can manage your login information using the [kc.eportal tool](#managing-users) ## PatchSet deployment ePortal has a built-in mechanism to download the latest patchsets. To start using it, click the _Settings_ link in the ePortal navigational bar and then click _Patch Source_. To get access, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com) and request your ePortal access credentials. ![patch source](/images/eportal-edit-patch-source.png) You can choose only a limited set of distros to fetch to reduce disk space and network bandwidth requirements. Once you set up patch source access info, you will get to a list of available patchsets. ![dashboard](/images/eportal-dashboard.png) * **Usage**: amount of servers using particular patchset on any feed. You can click on the number to see a list of servers using the patchset. You can filter the patchset list to show only patchsets that are in use by using the Usage column filter. * **Patchsets**: name of the patchset. Click on a name will show patchset changelog. * **Distribution**: shows the Linux distributions that this patchset supports. This column helps you identify which patchsets are relevant for your environment. You can use the [distribution filter](#filtering-patchsets) to view only patchsets for specific distributions. * **Feed name**: cells show patchset deployment and server usage status on particular feed. Numbers are also clickable to filter server list. * **Manage**: opens dialog to enable/disable the patchset. ### Patchset deployment statuses The dashboard displays different statuses for patchsets in each feed column: * **Enabled**: The patchset is enabled and available for servers to use. * **Disabled**: The patchset has been disabled by the administrator. It remains in the feed but is not available to servers. * **Blocked**: The patchset is blocked on the patchserver, indicating it should not be used (e.g., due to known issues). Blocked patchsets are automatically disabled in ePortal and cannot be managed through the UI. * **Undeployed**: The patchset has been downloaded but is not yet deployed to the feed. * **Not downloaded**: The patchset has not been downloaded to ePortal yet. * **Not available**: The patchset is unavailable for the feed (disabled on the patchserver but not blocked). * **Enabled (!)**: Warning status - the patchset is enabled in ePortal but has been disabled or is no longer available on the patchserver. This indicates a conflict between the local ePortal configuration and the patchserver state. Possible causes include: * The patchset was disabled on the patchserver after it was enabled in ePortal (e.g., due to discovered issues, deprecation, or replacement) * The patchset may have been removed from the patchserver for a specific feed or channel When you see this status, you should review the patchset and consider disabling it in ePortal or updating to a newer patchset if available. Servers using this patchset may encounter issues. ### Filtering patchsets You can filter patchsets on the dashboard page: * **Usage filter**: Filter to show only patchsets that are currently in use by servers (i.e., have at least one server actively using them). This helps you focus on active patchsets or identify which ones can be safely removed. See the [Usage column](#patchset-deployment) description above for more details. * **Distribution filter**: Filter patchsets based on Linux distribution. This allows you to view only patchsets relevant to specific distributions (e.g., Ubuntu, Debian, RHEL-based), making it easier to manage patchsets for your environment. The filter works with the [Distribution column](#patchset-deployment) to help you find relevant patchsets. * **Show unavailable patchsets**: By default, patchsets that became unavailable (disabled on the patchserver) are hidden from the dashboard. Enable this toggle to display all patchsets, including those that are unavailable. This can be useful for troubleshooting or viewing the complete list of patchsets. ### Manage patchset page ![manage patchsets](/images/eportal-manage.png) In this dialog you can control which patchsets will be enabled/disabled on corresponding feeds. * **Enable all up to this patchset**: action will enable all patchsets (excluding **disabled**) up to this patchset and mark them as **Enabled**. This action skips any patchsets that are currently disabled, so they remain disabled even when using this bulk enable action. * **Enable**: action will enable only the current patchset and mark it as **Enabled**. If the patchset is not yet deployed, it will be downloaded and deployed first. * **Disable**: action will disable only the current patchset and mark it as **Disabled**. Disabled patchsets are immune to auto-update and mass-enabling via **Enable all up to this patchset** action. The patchset remains in the feed but is marked as disabled. * **Undeploy down to this patchset**: action will undeploy the selected patchset and all newer patchsets in the feed and mark them as **Undeployed**. Older patchsets remain available in the feed. (see the [Patchset deployment statuses](#patchset-deployment-statuses) section for details about possible patchset statuses) To disable a patchset from the CLI, run: ```text # kc.eportal --unroll 16012017_1 ``` Or use the stream-specific commands: ```text # kc.eportal kcare unroll 16012017_1 # kc.eportal libcare unroll U20210129_02 ``` If you want to remove a patchset instead of just disabling it, you can use the `--delete` option: ```text # kc.eportal kcare unroll 16012017_1 --delete # kc.eportal libcare unroll U20210129_02 --delete ``` ### Automatic updates You can configure automatic updates by enabling Autoupdate on the desired feeds via LivePatching -> Feeds. The **default feed** cannot be configured via the Settings page to receive automatic updates. See the next section on configuring automatic updates for the **default feed**. ### Automatic updates on default feed It is possible to configure automatic updates on the **default feed** by creating a cron job. The following commands can be used to receive these updates. The command below determines if the latest patchsets are available and installs them to the **default feed**: ```text # kc.eportal --get-latest ``` ### Script to deploy release from a file If you have no opportunity to connect your ePortal server to the KernelCare patch server to download patchsets directly from it, you can do it manually. If you have a location with already downloaded patchsets, and would like to identify the latest patchset file to be moved, you can compare the lists of archives you have with the content of the `/usr/share/kcare-eportal/arch/` folder. After that, upload the selected patchsets to your ePortal server and run the `kc.eportal --deploy` command for each of them. #### Example Lets find out the difference between a test and a production ePortal instances: ```text $ comm -23 \ <(ssh eportal-test "ls /usr/share/kcare-eportal/arch/K*.tar.bz2" | sort -h) \ <(ssh eportal-prod "ls /usr/share/kcare-eportal/arch/K*.tar.bz2" | sort -h) | tee patchsets.diff ``` Upload patchsets to the production: ```text $ cat patchsets.diff | xargs -Phav {} rsync -iv eportal-test:{} /tmp/ $ rsync -Phav /tmp/K*.tar.bz2 eportal-prod:/tmp/ ``` Run the deployment tool with patchset file name as a parameter: ```text $ ssh eportal-prod 'ls /tmp/K*.tar.bz2 | sort -h | xargs -n1 kc.eportal kcare deploy' 2021-12-02 01:25:06,555 - eportal.patches - INFO - K04082020_1 was enabled in main ... ``` Please note that procedure above should be done for all other types of patchsets (like libcare) *separately*. Use corresponding file prefixes and commands like `kc.eportal libcare deploy`. ### Clean obsolete releases The list of provided patchsets is reduced once in a month (old patchsets that have newer versions are removed), but resources are not deleted from ePortal machine. The control of resource deletion is in charge of the ePortal administrator. To free disk space on ePortal old release resources could be removed. To check what releases will be removed: ```text # DRY_RUN=1 kc.eportal --clean-releases ``` To remove obsolete releases: ```text # kc.eportal --clean-releases ``` ## LibCare PatchSet Deployment Starting from version 1.18, ePortal supports the LibCare patchset management. It is accessible from the `Patches / LibCare` navigation item. LibCare patches use the same Patch Source credentials, and you don't need to perform additional configuration. ![libcare feed](/images/eportal-libcare-feed.png) ### Disable arbitrary patchset To disable a patchset, run the following command: ``` kc.eportal kcare unroll K20210129_02 ``` If you want to remove patchsets instead of disabling them, you can use the `--delete` option: ``` kc.eportal kcare unroll K20210129_02 --delete ``` ### CLI to install the latest patchsets To update the default feed, run the following command: ```text # kc.eportal libcare update ``` To update the `test` feed, run the following command: ```text # kc.eportal libcare update --feed test ``` To update all auto-feeds, run the following command: ```text # kc.eportal libcare auto-update ``` ### CLI to deploy patchset from archive ```text ~$ kc.eportal libcare deploy --help usage: kc.eportal libcare deploy [-h] [--feed FEED] [--disabled] archive positional arguments: archive path to archive optional arguments: -h, --help show this help message and exit --feed FEED feed to deploy archive to --disabled do not enable patchset after deploy ``` For example: ```text # kc.eportal libcare deploy --feed test /tmp/U20210129_02.tar.bz2 ``` This command will deploy and enable the `U20210129_02` patchset in to the `test` feed. ## QEMU PatchSet Deployment QemuCare is being deprecated. No new patchsets have been released since January 2025. Support for QemuCare will be removed in ePortal 2.23 and KernelCare 3.4 (February 2026). To continue using existing Qemu patchsets, use older versions of ePortal and KernelCare that include QemuCare support. Qemu patchsets are accessible from the `Patches / QEMUcare` navigation item. QEMU patchsets use the same Patch Source credentials, and you don't need to perform additional configuration. ![qemu feed](/images/eportal-qemu-feed.png) ### Command to install the latest patchsets To update the default feed, run the following command: ```text # kc.eportal qemu update ``` To update the `test` feed, run the following command: ```text # kc.eportal qemu update --feed test ``` To update all auto-feeds, run the following command: ```text # kc.eportal qemu auto-update ``` ### Command to deploy patchset from archive ```text ~$ kc.eportal qemu deploy --help usage: kc.eportal qemu deploy [-h] [--feed FEED] [--disabled] archive positional arguments: archive path to archive optional arguments: -h, --help show this help message and exit --feed FEED feed to deploy archive to --disabled do not enable patchset after deploy ``` For example: ```text # kc.eportal qemu deploy --feed test /tmp/U20210818_01-qemu.tar.bz2 ``` This command will deploy and enable the `U20210818_01-qemu` patchset in to the `test` feed. ## Managing Keys To register new servers you need to create a KernelCare key that will be used for server registration. To go to the list of keys, click the _Keys_ navigation item. ![keys](/images/key-menu_zoom70.png) * To edit a key, click ![edit keys](/images/eportal_keys_edit.png). The _Edit_ tab opens. * To remove a key, click ![remove keys](/images/eportal_keys_remove.png). Please note, that removing the key would remove all servers under that key. * Click a key to go to Servers tab with the list of [servers registered](#managing-servers) under that key. You can also remove servers on that tab. To create a new registration click _Create_ tab. ![create key](/images/key-creation_zoom70.png) Fill in the following fields: * **Key** - you can provide a key value or leave the field empty, so an automatically generated key will be used * **Description** - you can provide a description for the key * **Server Limit** - the amount of servers that can be registered under that key * **Feed** - select a specific feed or leave empty. * **Products** - limit allowed products can be used with the key. Available products: * **KernelCare**/**LibCare**/**QemuCare**/**DBCare**: allow only patches of selected type (QemuCare product is being depricated). * **Enterprise Support for AlmaLinux - ESU**: allow access to the Extended Security Updates and FIPS repositories. Products can be mixed to limit access to a particular set of patch types. For example: * **KernelCare** + **LibCare**: allow access only to kernel and lib patches. For Enterprise Support for AlmaLinux deployment instructions please see the [dedicated section](#deploying-enterprise-support-for-almalinux) Click _Save_ to add the key. The new registration key will be created and added to the list. The key itself will be used as a part of the registration command on an individual server. Click _Save and Add Another_ to save this key and add one more key. Click _Save and Continue Editing_ to add the key and open the key edit tab. Click _Cancel_ to return to the key list tab without adding a new key. ### CLI to manage keys ```text ~$ kc.eportal key --help usage: kc.eportal key [-h] [-a] [-c] [--note NOTE] [--server-limit SERVER_LIMIT] [--feed FEED] [--product {kernel,libcare,qemu,tuxcare-esu}] [--default-products] [key] list available keys by default positional arguments: key key name optional arguments: -h, --help show this help message and exit -a action: add new key -c action: change key --note NOTE key description --server-limit SERVER_LIMIT maximum number of servers allowed --feed FEED feed to associate key to --product {kernel,libcare,qemu,tuxcare-esu} products available for the key, can be specified multiple times --default-products set default product list (KernelCare, LibCare, QEMUCare) for the key ``` List keys: ```text # kc.eportal key ``` Autogenerate key: ```text # kc.eportal key -a ``` Create key with specified value: ```text # kc.eportal key -a test ``` Set feed to key: ```text # kc.eportal key -c test --feed test ``` ## Managing Servers You can see servers belonging to the key by clicking on the key itself in the [Managing Keys](#managing-keys) interface. ![server list](/images/server_list_1_zoom70.png) The screen shows servers registered under the key, their IP, hostname, effective kernel as well as the time of registration and last check in. The **Check-in** / **last check in** time is when the agent last completed a successful check-in to ePortal. With automatic updates enabled, that happens on the **same schedule** as the client’s periodic patch check (by default every four hours)—it is not a separate “heartbeat.” See [KernelCare Enterprise client config file](#kernelcare-enterprise-client-config-file) and [Config options](/live-patching-services/#config-options) for `AUTO_UPDATE` and related settings. To view the list of all servers IDs that are connected to the particular key, do the following: * In the UI go to the page with the list of keys. Then click the particular key. The list of servers connected to this key will be displayed. To view the list of all servers, use the _Servers_ menu on the navigation bar and select _Servers_ from the dropdown menu. The dropdown menu also provides access to _Server tags_ and _Overview_ pages. ![eportal servers](/images/eportal-servers.png) The counters displayed on the Servers page are clickable. Clicking on any counter will filter the server list to show only servers matching that criteria. For example, clicking on a counter showing "KCare active" will filter to show only servers with KernelCare actively reporting. This provides quick navigation and filtering capabilities. See also the [Overview page](#overview-page) for similar interactive features. Also you can use CLI to see pairs of key/number of servers run: ```text $ kc.eportal --list-servers Count | Key ----- + -------------------------------- 0 | 2shcolu7Y1x6885Q 2 | 6J89aS44j6OmTr05 ``` ### Clean inactive servers Servers inactive for more than 30 days can be removed using the followed command: ```text # kc.eportal server clean --inactive 2 servers were deleted ``` Clean-up of inactive servers can be performed automatically every day or rarer. To enable daily auto clean-up, you can add an option `CLEAN_INACTIVE_SERVERS_PERIOD = 3600 * 24` (value in seconds) in the [ePortal config file](#config-files) ### Show extended check-in statistics in admin UI A new table is added to the starting page. This table displays the following: * Total number of servers. * Number of servers that checked in for the past 48 hours. The number of servers for each key is listed on the _Keys_ page. ## Managing server tags You can use 'Server tags' page to deal with tags. ![server tags view](/images/tags_view.png) Tagging is a convenient way to group servers by any criteria. For example OS, deployment environment, location, etc. You need to create a tag and then it can be assigned to a server from the [Managing Servers](#managing-servers) interface. ![tag assignment](/images/tag_assignment.png) The tag may have an optional value. For example, this allows you to introduce a new geo location without creating a new tag for it. ### Using agent CLI to manage tags To add an extra Tag field for the server, run: ```text # kcarectl --tag command ``` where `command` is a parameter defined by a user. This parameter will be displayed in UI for the server. User could add multiple tags for each server. Each tag should be separated with `;` symbol. Example: ```text # kcarectl --tag "env:prod;ubuntu" ``` This server has two tags : `env:prod` and `ubuntu`. `env:prod` is a parameter that has tag name `env` and the value `prod`. ![tags](/images/addingextratagfield_zoom88.png) To remove all tags from a particular server, run: ```text # kcarectl --tag "" ``` Where `""` is a parameter to delete the previously defined tag. ## Feed Management Feeds are intended to manage patchsets on the server, and they provide a possibility to bind a set of patchsets to a specific key. Possible use cases: for preliminary testing of patchsets, for applying updates to groups of servers with the similar hardware, etc. To get into Feeds Management interface go to LivePatching -> Feeds: ![feeds](/images/feed-button_zoom70.png) On this page a user can manage the existing feeds: create, delete, edit. ![feed menu](/images/feed-menu_zoom70.png) Available options: * Name - a name of a feed. * Auto update - enable and disable automatic downloading of patchsets to this feed. * Deploy after X hours - a delay in hours between the moment the patchset is available for deployment and the moment it is installed to the feed. * Channel - a patch channel to use. * **Stable**: (default) stable patchsets marked with `eportal` label on [the patch server](https://patches.kernelcare.com/). * **Testing**: all patchsets available on [the patch server](https://patches.kernelcare.com/). * **Unstable**: patchsets from early-access feed (not recommended). Every 10 minutes ePortal checks for new patchsets on the main patch server. If a new patch is available, it is uploaded to the ePortal server. Note: it is uploaded but is not deployed. For information about configuring a client to periodically check and automatically download new patch sets, see [client configuration](#kernelcare-enterprise-client-config-file) The patch availability time is considered starting from the moment a new patch appears on the ePortal, and that time is taken into account in `Deploy after X hours` option. So, if a user sets `Deploy after X hours = 10`, the patch will be deployed to the feed 10 hours after it has been downloaded to the ePortal server. To make the feed auto-update immediately, so new patchsets are loaded to the feed immediately after they are available on ePortal, set `Deploy after X hours = 0`. A special case is a clean installation when ePortal is installed on a new server (there aren't any downloaded archives with patches and feeds with deployed patchsets, including default feed). In this case, if a user creates a new feed and sets Deployed after X hours option right away, then all patchsets (from the oldest to the latest available) will be deployed to the feed after the specified X hours. This is because the archives are downloaded from scratch and will be considered as "just appeared on ePortal" - that is, all patchsets will have the same appearance time on ePortal from which the option Deploy after X hours will repel. ![feed management](/images/feedmanagement3_zoom70.png) On the main ePortal page, a user can set the corresponding key <> feed pair. This is done in the key creation interface or when editing a key. ![edit key](/images/feedmanagement4_zoom70.png) By default, a new key is bound to the default feed, alternatively, a user can choose a desired feed from the drop-down menu. ![feed list](/images/feedmanagement5_01_zoom70.png) When removing a feed all keys attached to this feed will be moved to the default feed. ### CLI to manage feeds ```text ~$ kc.eportal feed --help usage: kc.eportal feed [-h] [-a] [-c] [--auto] [--no-auto] [--deploy-after hours] [--channel {default,test,unstable}] [feed] list available feeds by default positional arguments: feed feed name optional arguments: -h, --help show this help message and exit -a action: add new feed -c action: change feed --auto update feed automatically --no-auto don't update feed automatically --deploy-after hours deploy after specified hours --channel {default,test,unstable} patchset channel to use for this feed ``` List feeds: ```text $ kc.eportal feed ``` Add auto updated feed: ```text # kc.eportal feed -a test --auto ``` Change feed into delayed feed: ```text # kc.eportal feed -c test --deploy-after 12 ``` ## API keys Management An API key may be used as an alternative to password authentication when accessing public API endpoints. API tokens provide a more secure way to authenticate APIs because they can be easily revoked without affecting each other, and you don't need to share your credentials. To get into API keys Management interface go to Settings -> API keys: ![API keys](/images/api_key_list.png) On this page a user can manage the existing API keys: create, revoke (delete). ![API key edit](/images/api_key_create.png) Available options: * Key name - a name of the API key. * Expiration date - optional key expiration date. After generating the key, you will see a bar with a token, as in the picture below. ![API key generated](/images/api_key_generated.png) This token is not stored on the server, so you need to keep it in a safe place. Use this token in an API client as described in [ePortal API documentation](/eportal-api). The API key is personal, meaning it is tied to a specific user and inherits their permissions. A user with read-only permissions can only manage their own keys, while an administrator has access to any user's API keys. ## Overview page The Overview page provides a high-level summary of all selected servers. It includes data on server uptime, CPU architecture, OS and kernel distribution, and how many servers have KernelCare (KCare) or LibCare enabled. ### Uptime distribution This section shows the uptime of servers where our agent is installed. Uptime refers to how long the server has been running without a reboot. The donut chart categorizes server uptime into: - **under 6 months** - **6 to 12 months** - **12 to 18 months** - **over 18 months** Additional metrics: - **Max uptime** — the longest uptime among servers with a reporting agent - **Average uptime** — average uptime across these servers - **Median uptime** — median uptime across these servers You can click on any segment of the donut chart to drill down and filter the server list. This allows you to explore which servers fall into each uptime category and view detailed information about them. ![Uptime distribution](/images/overview_uptime_distribution.png) ### CPU arch distribution Shows the breakdown of CPU architectures detected on servers. If the architecture is not reported, it appears as `unknown`. Click on any segment of the donut chart to filter the server list and view servers with that specific architecture. See also the [Uptime distribution](#uptime-distribution) section for similar functionality. ![Architecture distribution](/images/overview_arch_distribution.png) ### OS distribution This table displays the top 10 most common operating system distributions among the selected servers, along with how many of those servers have KernelCare (KCare) or LibCare enabled: - **KCare active** — server has KCare enabled and is actively reporting - **KCare silent** — server has KCare enabled, but is not currently reporting - **LibCare active** — server has LibCare enabled and is actively reporting - **LibCare silent** — server has LibCare enabled, but is not currently reporting The LibCare usage statistics show how many servers have LibCare enabled and are actively using it versus those that have it enabled but are not currently reporting. This helps you understand LibCare adoption and usage across your infrastructure. If more than 10 OS types are detected, the rest are grouped under an **"Other"** row. A **Total** row summarizes all servers. ![OS distribution](/images/overview_os_distribution.png) ### Kernel distribution This section lists the top 10 kernel versions detected across the selected servers, along with how many servers are running each version with KCare enabled: - **KCare active** — server has KCare enabled and is actively reporting - **KCare silent** — server has KCare enabled, but is not currently reporting If more than 10 kernel versions are detected, the rest are grouped under an "Other" row. A **Total** row summarizes all servers. ![Kernel distribution](/images/overview_kernel_distribution.png) ### Effective kernels The Overview page also displays a list of **effective kernels** — the kernels that are actually in use across your servers. This differs from the [kernel distribution chart](#kernel-distribution) above in that it shows the complete list of active kernels rather than just the top 10, helping you identify all kernel versions that need patch coverage. ## How to setup ePortal to use HTTPS Some assumptions for a server where e-portal is deployed: ### Terminate TLS on ePortal public nginx web server 1. A firewall allows connections to 443 port. 2. Private and public keys are downloaded on the server. * Edit SSL configuration template according to your certificates: ```text # mv /etc/nginx/eportal.ssl.conf.example /etc/nginx/eportal.ssl.conf # vi /etc/nginx/eportal.ssl.conf ``` * Include this configuration into the main one: ```text # sed -e '3iinclude eportal.ssl.conf;' -i /etc/nginx/conf.d/eportal.conf ``` * Restart nginx: ```text # service nginx restart ``` ### Terminate TLS on external balancer You can use any reverse proxy server of choice to terminate TLS traffic and forward requests to ePortal instance. The only requirement is to provide correct `Host` and `X-Forwarded-Proto` headers. For example balancer nginx config: ```text server { listen 443 ssl; server_name your-eportal-domain; # ssl stuff ... # ssl_certificate ... # ssl_certificate_key ... location / { proxy_pass http://eportal-instance-address; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Proto https; } } ``` ### Update agent configuration In order to communicate with e-portal, updated to https, you need to modify KernelCare configuration file on all the servers if they have IPs hard coded servers settings. To do that, update `PATCH_SERVER` and `REGISTRATION_URL` options: ```text # vi /etc/sysconfig/kcare/kcare.conf ``` So, after editing your `/etc/sysconfig/kcare/kcare.conf` should contain updated `PATCH_SERVER` and `REGISTRATION_URL` environment variables like in the example below: ```text PATCH_SERVER=https://eportal_domain_name/ REGISTRATION_URL=https://eportal_domain_name/admin/api/kcare ``` As an alternative you can use ePortal's special endpoint to update patch server address: ```text # curl -s https://eportal_domain_name/set-patch-server | bash ``` ## High availability Starting from version 1.28, ePortal supports application level replication. It allows to propagate changes in both ways – from a leader to followers and from followers to the leader. Configuration settings related to replication and can be changed in [ePortal config file](#config-files): * `NODE_URL`: URL to the self instance, needed for auto-discovery purposes * `LEADER_URL`: URL to the instance from where to fetch changes * `REPLICATION_SHARED_KEY`: authorization key to access the replication data * `REPLICATION_CHECK_CERT`: use strict TLS cert check for replication requests. It can be useful to deploy self signed certificates on replicas and get encrypted replication traffic without getting proper TLS certificate. * `REPLICATION_CLEAN_AGE`: data age in seconds to leave during oplog cleanup. 7 days by default. * `REPLICATION_CLEAN_AGGRESSIVE_AGE`: data age in seconds to leave during oplog cleanup for not-important operations. 1 hour by default. A leader node discovers followers automatically and after that fetches the changes. You can use any convenient way to balance agent requests to the ePortal cluster. For example, you can add multiple IP addresses to the DNS name or use an HTTP balancer. ### Basic setup 1. Prepare two fresh ePortal instances and assign DNS name to IPs. For example: * eportal1.corp -> 192.168.1.11 * eportal2.corp -> 192.168.1.12 * eportal.corp -> 192.168.1.11, 192.168.1.12 2. Let's choose `eportal1` as a leader and `eportal2` as a follower. `eportal.corp` is a cluster hostname to use on servers with KernelCare agent. Please do not use a cluster hostname to perform operations with the ePortal admin UI. 3. On the `eportal1` define `NODE_URL` and `REPLICATION_SHARED_KEY` in the configuration file: ```text NODE_URL = 'http://eportal1.corp' REPLICATION_SHARED_KEY = 'secret' ``` 4. On the `eportal2` define `NODE_URL`, `LEADER_URL` and `REPLICATION_SHARED_KEY`: ```text NODE_URL = 'http://eportal2.corp' LEADER_URL = 'http://eportal1.corp' REPLICATION_SHARED_KEY = 'secret' ``` 5. That's it. After ePortal restart on both hosts, changes on the `eportal1` will be replicated to the `eportal2` instance and vice versa. You can change the KernelCare agent settings to point to a cluster hostname via: ```text # curl -s http://eportal.corp/set-patch-server | bash ``` ### Adding node to an existing ePortal instance If you already have a working ePortal instance, you can setup a second node, define `NODE_URL` and `LEADER_URL` on both instances and trigger full sync on the follower instance: ```text [root@eportal2.corp]$ kc.eportal replication --full-sync ``` ### Monitoring You can use `kc.eportal replication --short-status` CLI command to check replication status. It exits with code `1` if there are some issues with replication and outputs JSON: ```text { "ok": true, // overall health status "lag": 1, // overall replication lag in seconds "last_sync": 1, // overall sync delta in seconds (how many seconds ago was successful communication with an upstream) "upstream": { // per upstream metrics "node2": { "ok": true "lag": 1, "last_sync": 1, }, "node3": { "ok": true "lag": 1, "last_sync": 1, } } } ``` ### Other replication setups For one leader and two follower setup: ```text +-> leader <-+ | | | | follower1 follower2 ``` there is a chance to lose a `leader` node and `follower1`/`follower2` will not communicate with each other. To mitigate this issue, you can deploy a ring replication: ```text +-> node1 --+ | | | v node2 <---- node3 ``` where each instance follows another node. ### Caveats 1. Replication uses HTTP transport. If you deploy ePortal without SSL termination, the replication data will be transferred as-is unencrypted. 2. For a round-robin balancer setups (DNS or HTTP balancer round-robin) KernelCare agent can run onto replication lag in case of sequential registration and following update. You can introduce 10s timeout or repeat in your configuration management logic to mitigate the issue. 3. Replication log is kept for 7 days. If a node loses connectivity for more than 7 days it skips some changes. ## Deploying KernelCare Enterprise You can find instructions to install KernelCare agent on http://your-eportal-domain/admin/docs/. To install agent through ePortal you can use special endpoint `http://your-eportal-domain/install-kernelcare`: ```text # export KCARE_MAILTO=admin@mycompany.com # curl -s http://eportal.mycompany.com/install-kernelcare | bash # kcarectl --register my-key ``` Exporting `KCARE_MAILTO` is an optional step, it helps to configure corresponding entry in `/etc/cron.d/kcare-cron` to receive all notifications related to failed KernelCare updates. ### KernelCare Enterprise client config file KernelCare Enterprise client configuration file is located in `/etc/sysconfig/kcare/kcare.conf` Example: ```text AUTO_UPDATE=True PATCH_SERVER=http://10.1.10.115/ REGISTRATION_URL=http://10.1.10.115/admin/api/kcare ``` If `AUTO_UPDATE` is set to `True`, the client runs every 4 hours. Each run **checks in** to ePortal (this updates **Check-in** / **last check in** in the admin UI) and tries to download and apply the latest patchsets—so check-in frequency is the same as the automatic “look for updates” cadence, not an extra timer. `PATCH_SERVER` - server from which patchsets will be downloaded `REGISTRATION_URL` - URL used to register/unregister server ### Deployment Automation It is possible to use automation tools like Ansible/Puppet/Chef/Salt to install and operate KernelCare on a big number of systems. The deployment process includes: * Running `http://your-eportal-domain/install-kernelcare` script. You can pre-download it (verify checksum) or directly execute `curl -s http://your-eportal-domain/install-kernelcare | bash`. * Registering KernelCare agents using an activation key #### Ansible To start the automated deployment, you need to specify the following information: * ePortal server name (or IP) in the `eportal_srv` Ansible variable. Other config file options can be found at [Config Options](/live-patching-services/#config-options) and [KernelCare client config file](#kernelcare-enterprise-client-config-file) (ePortal). * an activation key in the `activation_key` Ansible variable. Activation keys can be generated in ePortal as described in [Managing Keys](#managing-keys) (ePortal). Ansible playbook for deployment phase may look like: ```text - hosts: kernelcare vars: eportal_srv: http://192.168.250.19 activation_key: my-key tasks: - name: Download the installation shell script get_url: url: "{{ eportal_srv }}/install-kernelcare" dest: /root/kc-install.sh mode: '0700' - name: Run the installation shell script command: /root/kc-install.sh - name: register KernelCare agents command: /usr/bin/kcarectl --register {{ activation_key }} ``` Ansible playbook file example for KernelCare agent removal: ```text - hosts: kernelcare tasks: - name: unregister KernelCare agents command: /usr/bin/kcarectl --unregister ignore_errors: yes args: removes: /usr/bin/kcarectl - name: remove kernelcare package package: name: kernelcare state: absent ``` ### Changing ePortal IP/domain You can change ePortal address at any moment by calling two special endpoints on hosts with KernelCare agent: ```text # curl -s http://your-eportal-domain/set-kernelcare-repo | bash # curl -s http://your-eportal-domain/set-patch-server | bash ``` * `set-kernelcare-repo` configures new package repo to download agent updates through ePortal. * `set-patch-server` configures new address of patch server. ## Deploying Enterprise Support for AlmaLinux You can find instructions on how to set up [Enterprise Support for AlmaLinux](https://docs.tuxcare.com/enterprise-support-for-almalinux/) on http://your-eportal-domain/admin/docs/ tuxctl is the setup tool for TuxCare's Extended Security Updates product for AlmaLinux. To set up `tuxctl` through ePortal you can use a special endpoint **http://your-eportal-domain/install-tuxcare**: ```text # curl -s http://eportal.mycompany.com/install-tuxcare | bash # tuxctl --license-key my-key ``` Where `my-key` should have the `Enterprise Support for AlmaLinux - ESU` product enabled. ## Migrate ePortal Here is a procedure to migrate feed/server/key configuration and patchsets data from one ePortal to another. ePortal version on a new host should be >=1.18 and equal or greater than on an old host. If you migrate from Debian-based to Debian-based system you can simply: * Stop ePortal on both hosts. * Copy `/var/lib/eportal` to a new host. Note: directory owner must stay as `eportal:eportal`. * Copy config `/etc/eportal/config` if it exists. * Run migration `/usr/share/kcare-eportal/migratedb.py` on a new host. * Start ePortal on a new host. Migration from RHEL-based distro is more elaborate. Later we refer to a `$BASE_DIR` variable in scripts. You can export it for RHEL-based distros: ```text # export BASE_DIR=/usr/share/kcare-eportal ``` or for Debian-based distros: ```text # export BASE_DIR=/var/lib/eportal ``` or for docker-based installation use corresponding data directory. For example if you run a container as `docker run -v /var/lib/eportal/data:/var/lib/eportal/data kernelcare/eportal` use /var/lib/eportal/data as `$BASE_DIR`: ```text # export BASE_DIR=/var/lib/eportal/data ``` * Stop ePortal on both hosts: ```text [old-host ~]# systemctl stop eportal ``` ```text [new-host ~]# systemctl stop eportal ``` * Remove db files on a new host: ```text [new-host ~]# rm $BASE_DIR/*.sqlite* ``` * Copy database files `$BASE_DIR/*.sqlite*` from an old host to a new host. * (Optional) copy runtime LDAP and Feed Source settings `$BASE_DIR/config/config.json`. * (Optional) copy ePortal web app settings `/usr/share/kcare-eportal/config/local.py` or for new ePortal `/etc/eportal/config` to `/etc/eportal/config` on a new host if it exists. * Copy `$BASE_DIR/instance-id` so our billing can know that the new ePortal was migrated and to avoid double billing. * Copy patch data `$BASE_DIR/{arch,resources,user-resources}` to a new host. * Set file owner. For RHEL-based distros: ```text [new-host ~]# chown -R nginx:nginx $BASE_DIR ``` For Debian-based distros: ```text [new-host ~]# chown -R eportal:eportal $BASE_DIR ``` * Run migration `/usr/share/kcare-eportal/migratedb.py` on a new host. * Start ePortal on the new host: ```text [new-host ~]# systemctl start eportal ``` ### Migration to docker container Let's suppose that we're going to use dockerized eportal on the same host. The easiest way to migrate is to reuse the data directory. It can be mounted when the container starts. ```text docker run -d --rm --network=host -v /var/lib/eportal:/var/lib/eportal/data kernelcare/eportal:latest ``` If you prefer to use a named volume for data-dir then all data should be copied from ```/var/lib/eportal``` to the volume (see [Docker docs](https://docs.docker.com/reference/cli/docker/container/cp/)) If you have custom configuration at ```/etc/eportal/config``` you can pass it using environment variables or mount this configuration file directly into the container like this ```-v /etc/eportal/config:/etc/eportal/config:ro``` ## Backup and restore ### Create backup kc.eportal utility have an option to create a data backup `kc.eportal backup ` - creates an archive with a backup. ```text # kc.eportal backup /var/lib/eportal/backups/eportal_$(date '+%Y-%m-%d').tar.gz ``` ### Backup databases only To backup only the databases without patchset files: ```text # kc.eportal backup-db /var/lib/eportal/backups/db_backup ``` Use the `-v` or `--verbose` flag to see operation progress: ```text # kc.eportal backup-db -v /var/lib/eportal/backups/db_backup ``` This is useful when you only need to backup configuration and server data without the large patchset files. For full backups including patchsets, use the [backup command](#create-backup) instead. ### Restore data from a backup IMPORTANT: ePortal should be stopped before restore process. The restore command supports several options to control what gets restored: * `--db` - restore database data only * `--config` - restore config.json only * `--instance-id` - restore instance ID only * `--data` - restore database and config.json (default) * `--full` - restore all data (databases, config, instance ID, and patchset files) See the [backup section](#backup-and-restore) for information on creating backups. For example, to restore everything: ```text # systemctl stop eportal # kc.eportal restore --full /var/lib/eportal/backups/eportal_backup.tar.gz # kc.eportal kcare download-missing # kc.eportal libcare download-missing # systemctl start eportal ``` To restore only the database and configuration: ```text # systemctl stop eportal # kc.eportal restore --data /var/lib/eportal/backups/eportal_backup.tar.gz # systemctl start eportal ``` `download-missing` commands ensure patchset state on disk corresponds with a state in db. ### Backup and restore for ePortal docker container Volume backup process can be performed according to the instructions given [here](https://docs.docker.com/engine/storage/volumes/#back-up-restore-or-migrate-data-volumes). For example: ```text docker run --rm --volumes-from eportal -v $(pwd):/backup ubuntu tar cvf /backup/backup.tar /var/lib/eportal/data/ ``` or if you want to make a backup without patchsets (only configs and the database) ```text docker run --rm --volumes-from eportal -v $(pwd):/backup ubuntu tar --exclude '/var/lib/eportal/data/patches' --exclude '/var/lib/eportal/data/arch' --exclude '/var/lib/eportal/data/resources' -cvf /backup/backup.tar /var/lib/eportal/data/ ``` That backup could be restored like this ```text docker run --rm --volumes-from eportal2 -v $(pwd):/backup ubuntu bash -c "cd / && tar xvf /backup/backup.tar" ``` ## Config files * ePortal config: `/etc/eportal/config`. Config for old versions (<1.35): `/usr/share/kcare-eportal/local.py`. * Web Server (nginx) config: `/etc/nginx/conf.d/eportal.conf`. * Data directory: `/var/lib/eportal`. * Legacy data directory (RHEL based distros for old versions <2.6): `/usr/share/kcare-eportal`. ## Stopping & starting To stop/start/reload/restart configuration of nginx server: ```text # systemctl stop|start|reload|restart nginx ``` To stop/start/restart ePortal (Python): ```text # systemctl stop|start|restart eportal ``` ## Log files ePortal log: `journalctl -u eportal` Nginx ePortal access log: `/var/log/nginx/access.log` Nginx error log: `/var/log/nginx/error.log` ### Log rotation By default there is no predefined parameters for ePortal's logs rotation. If you want to enable it for the files listed above: * Install `logrotate` package * Create/edit `/etc/logrotate.d/eportal` configuration file Example logrotate config: ```text /var/log/nginx/kcare-eportal.log { daily rotate 5 # keep 5 last archives missingok # it's ok if there is no such file notifempty # do nothing if file is empty compress } ``` ## Nagios & Zabbix support KernelCare.ePortal since version 1.2 supports server monitoring similar to [Nagios](/kc-agent-monitoring/#nagios-plugin) & [Zabbix](/kc-agent-monitoring/#zabbix-template) monitoring. You can curl the API directly to receive the information: ```text https://yourserver/admin/api/kcare/nagios/KCAREKEY ``` or you can use [https://patches.kernelcare.com/downloads/nagios/check_kcare](https://patches.kernelcare.com/downloads/nagios/check_kcare) script by modifying KEY_KCARE_NAGIOS_ENDPOINT in it to point to your server (change [https://cln.cloudlinux.com/clweb](https://cln.cloudlinux.com/clweb) (link to old UI) or [https://cln.cloudlinux.com/console/auth/login](https://cln.cloudlinux.com/console/auth/login) (link to new UI) with [https://yourserver/admin](https://yourserver/admin) ). Access using `PARTNER_LOGIN/TOKEN` is not supported by KernelCare.ePortal ## Usage reports In common case, usage reports are sending automatically but when it's not possible, ePortal will try to send report as an email. That requires configured Sendmail (SSMTP) on the host. You can find a short instruction below. If mail sending attempt fails, ePortal will save the reports in `/usr/share/kcare-eportal/reports` which should be sent manually. ### How to configure Sendmail (SSMTP) First of all you need to install `ssmtp`: ```text # yum install -y ssmtp ``` Edit `/etc/ssmtp/ssmtp.conf` file in accordance with your SMTP server configuration. Here is a simple config file describing a common way to connect to Gmail accounts: ```text root=username@gmail.com mailhub=smtp.gmail.com:587 hostname=localhost UseSTARTTLS=YES AuthUser=username@gmail.com AuthPass=xxxxxxxxxxxxxxxxxxx FromLineOverride=YES TLS_CA_File=/etc/ssl/certs/ca-certificates.crt ``` Actual location of a TLS_CA_Files depends on Linux distribution: ```text "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc. "/etc/pki/tls/certs/ca-bundle.crt", // Fedora/RHEL 6 "/etc/ssl/ca-bundle.pem", // OpenSUSE "/etc/pki/tls/cacert.pem", // OpenELEC "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7 ``` Also you could get if from: ```text # curl-config --ca ``` Now you can test a connection: ```text $ echo -n 'Subject: test\n\nTesting ssmtp' | sendmail -v some-recipient@gmail.com ``` ## Custom environment variables You can define your own environment variables for ePortal process. There is the `/usr/share/kcare-eportal/environment` folder, which is basically daemon tools compatible envdir. For example, to disable the default https verification you can set the `PYTHONHTTPSVERIFY` environment variable to `0` as follows: ```text # echo 0 > /usr/share/kcare-eportal/environment/PYTHONHTTPSVERIFY` ``` ## Authentication using Single Sign On ePortal supports Single Sign On authentication by "OAuth 2.0" standard, "Authorization Code" flow. ### SSO Configuration To enable SSO you need to configure OAuth2 authentication service provider and ePortal. #### Okta Application setup example You set up your OpenID Connect application inside the Okta Admin Console: 1. In the Admin Console, go to **Applications** > **Applications**. 2. Click **Create App Integration**. 3. On the Create a new app integration page, select **OIDC - OpenID Connect** for the **Sign-in method** and then select **Web Application** as the **Application type**. 4. Fill in the **Application Settings**. | **Setting** | **Value** |-----------------------|------------------------------------------- | Sign-in redirect URI | http://eportal_ip/admin/sso/login/callback | Sign-out redirect URI | http://eportal_ip/admin/login 5. Obtain *Client ID*, *Client secret*, the full URL to the `/authorize`, `/token`, `/userinfo` endpoints. #### ePortal setup On the ePortal machine, configure SSO settings. Edit [ePortal config file](#config-files): ```text OIDC_AUTH_URL="https://dev-61441893.okta.com/oauth2/v1/authorize" OIDC_TOKEN_URL="https://dev-61441893.okta.com/oauth2/v1/token" OIDC_USERINFO_URL="https://dev-61441893.okta.com/oauth2/v1/userinfo" OIDC_LOGOUT_URL="https://dev-61441893.okta.com/oauth2/v1/logout" OIDC_CLIENT_ID="0Aa134lzhUKj8jDMo5d7" OIDC_CLIENT_SECRET="AoBNuWRLRu2dxIR3Q0btO53N1entmGxBjQqwmjVL" ``` Restart ePortal (see the [Stopping & Starting](#stopping-starting) section, choose a corresponding OS). If all settings configured correctly the new **Sign In with SSO** button has to appear on login page `http://eportal_ip/admin/login` ![sso eportal](/images/sso_eportal.png) ## Custom patchsets storage By default patchsets and databases are stored in `/var/lib/eportal`. You can configure it to use split storage, for example to keep patchsets on external block device. For ePortal installations prior to version 2.6-1, patchsets and databases were stored in `/usr/share/kcare-eportal` by default on RHEL-based systems. When upgrading these installations to newer ePortal versions, the original storage location is preserved and continues to be used. Edit [ePortal config file](#config-files): ```text PATCHES_DIR = '/path/to/patchsets/storage' ``` Run: ```text # kc.eportal sync-nginx-conf ``` It initializes storage and makes corresponding modifications to nginx config to serve patchsets from a new place. And restart `nginx` and `eportal` services to apply changes: ```text # systemctl restart eportal nginx ``` ## Troubleshooting If you have any questions regarding setting up and operating ePortal, please reach out to the support team. To simplify the analysis of a problem, it is often necessary to provide additional information about the system environment. It is recommended to use the ePortal CLI to collect this information and submit it to support. Run: ```text # kc.eportal doctor ``` In order for the auto-submission to work, you need to configure patch source (see [PatchSet deployment](#patchset-deployment)). If you experience problems configuring the patch source or have problems accessing the Internet, you can generate a report and submit it manually. ```text # kc.eportal doctor --no-send ``` The above command will create an archive with the collected data and output the path to it. You can inspect the contents of the archive if necessary and then send it to the support team. ================================================================================ Source: https://docs.tuxcare.com/kernelcare-for-iot/ ================================================================================ # KernelCare for IOT Provides live security patching for ARM64-based embedded systems for enterprise IoT users and original equipment manufacturers. For the list of supported distributions and chipsets, [visit this page](https://tuxcare.com/live-patching-services/kernelcare-iot/). ### How KernelCare IoT works * The KernelCare team is constantly monitoring security mailing lists to check for vulnerabilities. As soon as one is found, the team prepares a patch and then sends it to distribution servers. * An agent will run a process on your device, checking with the distribution servers every 4 hours until it finds a new patch and then safely apply it to the running kernel without needing to stop it. * A special kernel module is used to apply the patches. It first loads the update into the kernel address space, then it places relocations on the original code/data to make sure the code block doesn’t execute during the update. Once finished, it will safely switch the execution path from the original to the updated code and then make sure the old code will never run again. * KernelCare does all of this instantly, automatically, and without service interruptions. For more information about KernelCare for IOT, [visit this page](https://tuxcare.com/live-patching-services/kernelcare-iot/). ================================================================================ Source: https://docs.tuxcare.com/live-patching-services/ ================================================================================ # KernelCare ## KernelCare **KernelCare Plus** was the former name for this product. It reached end-of-life in March 2023 and was replaced by **KernelCare**, which was the previous supported offering. KernelCare includes everything KernelCare Plus provided, plus additional capabilities such as controlled patch rollout via ePortal, air-gapped environment support, and access to add-ons such as LibCare. If you see references to "KernelCare Plus" on invoices or in the CLN portal, these refer to the same product now marketed as KernelCare. KernelCare live patching enhances customers' vulnerability patching programs by providing live patches to the Linux kernel and, optionally (with an add-on), to critical userspace components. The systems are patched according to your patch deployment policy, allowing you to customize your patch management to align with the needs of your unique environment, whether online or air-gapped. KernelCare can be extended with the LibCare add-on for live patching of critical userspace components. The sections below describe KernelCare and LibCare live patching in more detail. ### KernelCare (kernel live patching) #### Introduction KernelCare is a live kernel patching product that provides security patches for a range of popular Linux kernels that can be installed without rebooting the system. It supports kernels of Enterprise Linux operating systems, i.e., RHEL, Oracle, Rocky, AlmaLinux, and CentOS, as well as Ubuntu and Debian. Each individual kernel receives new live patches for as long as the kernel vendor releases security updates for the series. The KernelCare offering consists of the client application, the live patching service hosted by TuxCare, and an optional on-prem management server. The client application runs on machines, periodically checks for available patches, downloads, verifies, and installs them. At the same time, complex enterprise environments often follow policies that require a gradual roll-out of updates to reduce risk or have high-security isolated environments that need to be updated. ePortal is an on-prem management server allowing organizations to define their rollout policy and remain in full control of which machines will get updated and when. #### The live patching process When a new vulnerability is detected in the Linux kernel, TuxCare creates a live patch addressing the vulnerability. After the live patch is made available, it is tested in TuxCare’s internal server farm and then promoted gradually to a series of testing tiers, ensuring that any released live patch has been tested sufficient time on live systems. Once the patch is released, systems that enable the KernelCare client will receive the patch over an authenticated channel and apply it. #### ePortal Many organizations have a gradual patch roll-out policy or maintain a strict policy on which systems get upgraded and when. With ePortal, an on-prem management server, you can use the patch roll-out policy of your choice while automatically deploying patches in your air-gapped environment - all with a simple user interface. #### Live patching testing tiers KernelCare delivers live patches to “tiers”. A tier is a target audience for the delivery of a patch. Your tier depends on whether your systems receive updates directly from the TuxCare Portal repository or use ePortal as a proxy to gradually roll out patches according to your patching policy. The differences are outlined below. | TIER | DESCRIPTION | |---|---| | Internal | For internal TuxCare use. Updates are first tested and then applied across TuxCare infrastructure to decrease the odds of a faulty patch making it to customer machines. | | TuxCare Portal | Patches are delivered to these machines next. | | ePortal Customers | Patches become available in the ePortal last. However, ePortal customers can customize the updates to receive them as soon as they become available in the test feed. | Our kernel team closely monitors the patch health internally before promoting it to the TuxCare Portal and further monitoring is done before promoting the patch to ePortal servers. #### Kernel patching lifetime KernelCare offers live patches for each individual kernel for as long as the kernel vendor releases security updates for the series. This allows you to enjoy continuous protection for your existing kernels without being bound by the kernel vendor’s release schedule when planning your maintenance windows. #### Vulnerability coverage During the lifecycle of an operating system, TuxCare makes commercially reasonable efforts to provide live patches for all vulnerability fixes provided by the vendor, irrespective of their vulnerability rating. We may also address vulnerabilities that haven't been addressed by the OS vendor if they gained significant attention and were being actively discussed, exploited (according to the [CISA list](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)), or researched by the cybersecurity community. #### Target response rates TuxCare is committed to delivering timely security updates. We aim to deliver live patches for all CVEs patched by the vendor within 10 days from when the vulnerability is publicly disclosed. This rapid response time significantly reduces the opportunity window for a potential attack and meets most security regulation requirements. However, a live patch for a vulnerability can be significantly more complex than an ordinary kernel patch, and due to the additional complexity, can take more time to develop and test. #### Supported architectures KernelCare is available for both x86-64 (Intel and AMD) and ARM64 architectures. #### Supported Linux distros and kernels Customers can find detailed information about supported kernels, Linux distributions, specific vulnerabilities, and live patches provided by KernelCare and LibCare for each of the supported Linux distributions at [https://patches.kernelcare.com/](https://patches.kernelcare.com/). #### End-of-life (EOL) policy TuxCare will stop supporting live patching for specific distros if there are no security advisories provided by the distro's vendor for the last 365 days. In this case, all customers running the affected distributions are notified about the upcoming EOL. Existing live patches for EOL distributions are available for the next 6 years after the EOL date. #### Technical Support All TuxCare live patching products include technical support provided according to the [TuxCare support policy](https://tuxcare.com/TuxCare-support-policy.pdf). It delivers 24/7/365 access to our engineers through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to our online knowledge base. #### Getting a trial license You will need a trial activation key to be able to use the KernelCare. The trial license subscription will work for 30 days. You can request your free trial here [https://tuxcare.com/free-trial/](https://tuxcare.com/free-trial/). If you have any questions regarding using your trial subscription, contact [sales@tuxcare.com](mailto:sales@tuxcare.com) and we will help. #### Installation KernelCare is compatible with 64-bit versions of CloudLinuxOS/CentOS 6, 7 and 8, AlmaLinux/RHEL 6, 7, 8 and 9, Oracle Linux 6 and 7, Amazon Linux 1 and 2, Virtuozzo/PCS/OpenVZ 2.6.32, Debian 8, 9 and 10, Proxmox VE 5 and 6, Virt-SIG/Xen4CentOS 6 and 7, Ubuntu 14.04, 15.04, 16.04, 18.04 and 20.04 kernels. The list of compatible kernels can be found at the following link: [https://patches.kernelcare.com/](https://patches.kernelcare.com/) To install KernelCare, run the following as root: ```text # curl -s -L https://kernelcare.com/installer | bash ``` or: ```text # wget -qq -O - https://kernelcare.com/installer | bash ``` If you are using an IP-based license, nothing else is required to be done. If you are using a key-based license, run: ```text # kcarectl --register ``` Where `KEY` is the registration key code string provided when you sign up for purchase or trial of the product. If you are experiencing a `Key limit reached` error after the end of the trial period, you should first unregister the server by running: ```text # kcarectl --unregister ``` To check if patches applied, run: ```text # kcarectl --info ``` The software will automatically check for new patches every 4 hours. If you would like to run update manually: ```text # kcarectl --update ``` To check current kernel compatibility with KernelCare, use the following [script](https://raw.githubusercontent.com/iseletsk/kernelchecker/master/py/kc-compat.py) by running: ```text $ curl -s -L https://kernelcare.com/checker | python ``` or: ```text $ wget -qq -O - https://kernelcare.com/checker | python ``` #### Update To update the agent package to the latest version use: * For rpm-based distributions (CentOS, RedHat, etc): ```text # yum install -y kernelcare ``` or: ```text # dnf install -y kernelcare ``` * For apt-based distributions (Debian, Ubuntu, etc): ```text # apt-get install kernelcare ``` or: ```text # apt install kernelcare ``` #### Uninstalling To uninstall KernelCare, run the following as root: * For CloudLinux, CentOS, RHEL, Virtuozzo, OpenVZ: ```text # yum remove kernelcare ``` or: ```text # dnf remove kernelcare ``` * For Ubuntu, Debian, Proxmox VE: ```text # apt-get remove kernelcare ``` or: ```text # apt purge kernelcare ``` This will also unlink the system from its activation key (provided there is network connectivity to the CLN Portal). However, you'll need to remove the license from the CLN Portal manually if you don't plan to use the service anymore. #### Switching from Ksplice To switch from Ksplice to KernelCare, use the following script that uninstalls Ksplice and installs KernelCare instead. It will automatically detect and abort if the system is not 64-bit (as KernelCare doesn't support it). It will also detect when the Ksplice module cannot be uninstalled and retries multiple times. Download the script here: [https://patches.kernelcare.com/ksplice2kcare](https://patches.kernelcare.com/ksplice2kcare) Run the command: ```text # bash ksplice2kcare ``` The key can be created/retrieved in KernelCare Keys section of CLN. If you want to use IP based licenses, run: ```text # bash ksplice2kcare IP ``` You have to add an IP license for that server, and it is just the two letters `IP`, not your actual IP address. By default the script will attempt 3 times to uninstall Ksplice, waiting 60 seconds in between. You can run it using `nohup` if you don't want to wait. You can change that by editing the script and changing `RETRY` and `SLEEP` values. The script will exit with exit code `0` and message `Done` on success. Otherwise, it will produce exit code `-1` The complete log file can be found at `/var/log/ksplice2kcare.log` ##### Canonical Livepatch KernelCare is not compatible with Canonical Livepatch and should not be used on the same system. #### Basic management To disable automatic updates, edit the file `/etc/sysconfig/kcare/kcare.conf` ```text AUTO_UPDATE=False ``` To check the updated 'effective' version, run: ```text # kcarectl --uname ``` We provide a convenience script `/usr/bin/kcare-uname` that has same syntax as `uname` To see applied patches, run: ```text # kcarectl --patch-info ``` #### Command line tools `/usr/bin/kcarectl` - Manage KernelCare patches for your kernel. `/usr/bin/kcare-uname` - Print certain system information. ##### kcarectl | | | |-|-| |`-i, --info` | Display information about patches installed by KernelCare.| |`-u, --update` | Download latest patches, and apply them to current kernel.| |`--smart-update [since 1.6]` | The same as --update, but uses [UPDATE_POLICY](/live-patching-services/#config-options) to decide where to get patches.| |`--unload` | Unload patches.| |`--auto-update` | Check if update is needed and update.| |`--patch-info` | Lists applied patches.| | `--status` | Return a status of an update. Refer to the exit code: `0` - host is updated to latest patch level, `1` - there are no applied patches, `2` - there are new not applied patches, `3` - kernel is unsupported | |`--force [since 2.3]` | When used with update, forces applying the patch even if unable to freeze some threads.| |`--uname` | Prints safe kernel version.| |`--license-info` | Output current license info.| |`--register KEY` | Register using KernelCare Key.| |`--register-autoretry [since 2.5]` | If registration fails retries registration indefinitely.| |`--unregister` | Unregister from KernelCare for Key based servers.| |`--userspace-update [PATCHES]` | Download latest patches and apply them to the corresponding userspace processes. Сan be set so that only certain types of patches are applied.| |`--test` | Try test builds instead of production builds (deprecated, use --prefix=test instead).| |`--prefix` | Patch source prefix, used to test different builds, by downloading builds from a different location, based on prefix (v2.2+)| |`--version` | Print KernelCare version.| |`--import-key PATH` | Import gpg key.| |`--set-monitoring-key` | Set monitoring key for IP based licenses. 16 to 32 characters, alphanumeric only [version 2.1+]| |`--freezer [since 2.3]` | none: don't freeze any threads; full: freeze all threads; smart: freezes only threads that need to be frozen for patching. If option is not selected, best freezer method is chosen automatically.| |`--check [since 2.4-1]` | Check if new patchset is available, without updating. Exit code 0 means there is a new kernel. 1 when there is no new kernel.| |`--doctor [since 2.6]` | Send a report to the TuxCare support staff for diagnostics.| |`--set-patch-type extra` | To enable extra patches.| |`--set-patch-type free` | To enable free patches.| |`--set-sticky-patch SET_STICKY_PATCH` | Set patch to stick to date in format DDMMYY or retrieve it from KEY if set to KEY (no support for ePortal). Empty to unstick. More info at [Sticky Patches](/live-patching-services/#sticky-patches).| |`--tag COMMAND` | Adds an extra _Tag_ field for a server. COMMAND is a user-defined parameter.| Currently available userspace patch type is `libs`. To apply patches only for shared libraries, use `--userspace-update libs`. ##### kcare-uname Print certain system information. Default is `-s` | | | |-|-| |`-a, --all` | print all information in the following order, except omit `-p` and `-i` if unknown| |`-s, --kernel-name` | print the kernel name| |`-n, --nodename` | print the network node hostname| |`-r, --kernel-release` | print the kernel release| |`-v, --kernel-version` | print the kernel version| |`-m, --machine` | print the machine hardware name| |`-p, --processor` | print the processor type or `unknown`| |`-i, --hardware-platform` | print the hardware platform or `unknown`| |`-o, --operating-system` | print the operating system| |`--help` | display this help and exit| |`--version` | output version information and exit| ##### kernelcare doctor This tool collects essential information about the KernelCare environment and sends it to the support team. ```text # kcarectl --doctor Generating report... Uploading... Key: FRWf74Zw11111111.83991334-1111-1111-1111-681ddd653e5f Please, provide above mentioned key to KernelCare Support Team ``` The command generates a report and prints out the ID which could be linked to a support ticket. If there was a connection problem during uploading the report, the report will be stored locally as `/root/cl-report`. This file should be sent to the support team manually. #### Config options `kcarectl` behavior can be configured using `/etc/sysconfig/kcare/kcare.conf` | | | |-|-| |`AUTO_UPDATE=YES\|NO` | `YES` - enable auto-update; `NO` - disable auto-update.| |`PATCH_METHOD=normal\|nofreeze\|smart` | `Normal` - (default) use freezer;
`Nofreeze` - don't use freezer to freeze processes;
`Smart` - smart freezer freezes only threads that need to be frozen for patching [kernelcare 2.3+].| |`PATCH_SERVER` | Server to use to download patches.| |`REGISTRATION_URL` | Licensing server.| |`PREFIX=prefix` | Patch source prefix, used to test different builds, by downloading builds from a different location, based on prefix [kernelcare 2.2+]| |`UPDATE_POLICY=REMOTE\|LOCAL\|LOCAL_FIRST` | Depending on the policy, on server startup, use:
`REMOTE` - (default) patches from patch server.
`LOCAL` - only locally cached patches, if none cached (caching is done automatically) - do nothing.
`LOCAL_FIRST` - see if locally cached patches exist, and load them. If not, try getting them from remote server.| |`IGNORE_UNKNOWN_KERNEL=True\|False` | Don't provide notification if unknown kernel on auto-update. [kernelcare 2.5+]| |`LOAD_KCARE_SYSCTL` | Controls if `/etc/sysconfig/kcare/sysctl.conf` will be loaded on patchset load. True by default. [kernelcare 2.7+]| |`STICKY_PATCH=KEY` | Retrieve sticky patch from `KEY` (see CLN, Key Edit); not supported for IP based servers or ePortal.| |`STICKY_PATCH=DDMMYY` | Stick patch to a particular date. More info at [Sticky Patches](/live-patching-services/#sticky-patches).| |`[AUTO_]UPDATE_DELAY=h\|d` | Use patchsets not newer than specified time. For example `24h` or `2d`. `AUTO_UPDATE_DELAY` works for `auto` and `smart` modes. `UPDATE_DELAY` works for all modes. [kernelcare 2.82+]| |`[AUTO_]STICKY_PATCHSET=`| Use patchsets not newer than specified value. For example `K20230908_02`. `AUTO_STICKY_PATCHSET` works for `auto` and `smart` modes. `STICKY_PATCHSET` works for all modes. [kernelcare 2.82+]| |`REPORT_FQDN=True\|False` | Force using Fully Qualified Domain as a hostname. False by default.| |`FORCE_GID=N`|Use this group ID for symlink protection patch. By default, it's 48 (default Apache user GID) or 99 (`nobody` user)| |`USERSPACE_PATCHES=libs`| Define which userspace patches will be applyed by default| #### Disabling some patches Some patches might affect the functioning of the system, and we created a way to disable them. This is done via the `sysctl` command. When new patchsets load, KernelCare sysctl options get reset. To prevent that we added a file: `/etc/sysconfig/kcare/sysctl.conf` Options in this file will be loaded automatically on new patchset load. To disable loading these options, specify `LOAD_KCARE_SYSCTL=0` in `/etc/sysconfig/kcare/kcare.conf` To disable the patch, set the corresponding kcare option to `1` Patches that can be disabled: | | | |-|-| |Patch | _sysctl_ option| |CVE-2015-5157 | kcare_modify_ldt| #### Extra patchset KernelCare 2.12-5 or higher KernelCare Extra patchset includes all the security fixes from KernelCare for AlmaLinux, CentOS 6, CentOS 7, and CentOS 8 as well as symlink protection and the IPSet bugfix for CentOS 6. To enable extra patches and apply updates, run: ```text # kcarectl --set-patch-type extra --update ``` To enable extra patches without an update, run: ```text # kcarectl --set-patch-type extra ``` The 'extra' patch will be applied on the next automatic update. To see details, run: ```text # kcarectl --patch-info ``` You should see something similar to: ```text OS: centos6 kernel: kernel-2.6.32-696.6.3.el6 time: 2017-07-31 22:46:22 uname: 2.6.32-696.6.3.el6 kpatch-name: 2.6.32/symlink-protection.patch kpatch-description: symlink protection // If you see this patch, it mean that you can enable symlink protection. kpatch-kernel: kernel-2.6.32-279.2.1.el6 kpatch-cve: N/A kpatch-cvss: N/A kpatch-cve-url: N/A kpatch-patch-url: https://gerrit.cloudlinux.com/#/c/16508/ kpatch-name: 2.6.32/symlink-protection.kpatch-1.patch kpatch-description: symlink protection (kpatch adaptation) kpatch-kernel: kernel-2.6.32-279.2.1.el6 kpatch-cve: N/A kpatch-cvss: N/A kpatch-cve-url: N/A kpatch-patch-url: https://gerrit.cloudlinux.com/#/c/16508/ kpatch-name: 2.6.32/ipset-fix-list-shrinking.patch kpatch-description: fix ipset list shrinking for no reason kpatch-kernel: N/A kpatch-cve: N/A kpatch-cvss: N/A kpatch-cve-url: N/A kpatch-patch-url: https://bugs.centos.org/view.php?id=13499 ``` To enable Symlink Owner Match Protection, add `fs.enforce_symlinksifowner=1` to `/etc/sysconfig/kcare/sysctl.conf` and run: ```text # sysctl -p /etc/sysconfig/kcare/sysctl.conf ``` #### Sticky patches This functionality is not available for ePortal customers. If you are using ePortal, please use [Feeds](/eportal/#feed-management) instead. Since v2.82 there is a more convenient way to specify the latest available release via the `[AUTO_]STICKY_PATCHSET` and `[AUTO_]UPDATE_DELAY` configuration options. It also works with recent ePortal versions (v2.3+). Sometimes you don't want to use the latest patches, and you'd like to control which patches are get installed instead. For example, you have tested the patch released on 25th of May 2018 and want to use that patch across all servers. You can do it by setting `STICKY_PATCH=25052018` (DDMMYYYY format, DDMMYY and YYYY-mm-dd are also valid) in `/etc/sysconfig/kcare/kcare.conf`, this guarantees that when `kcarectl --update` or `kcarectl --auto-update` is called, you will get patches from that date and not the newest patches. Alternatively, you can set `STICKY_PATCH=KEY`, this way you can control the date from which patches will be applied using KernelCare keys in CLN. On update, the actual date will be retrieved from CLN (from Key settings) for the key used to register a particular server (not supported for IP based servers). This is very useful if you want to test patches in QA first and later roll them out to production without doing any changes on the systems. Here is how you can do that: * Set `STICKY_PATCH=KEY` on all your servers. * Register QA servers with one KEY, and Production servers with ANOTHER key. * Then, stop new updates for Production servers. In CLN set `Sticky Tag` to `yesterday`. You can do it by editing KEY in CLN in DDMMYY format. * Now, for example, let's use patches as of 03052018 (DDMMYYYY format). Set them for your QA server key. On the next auto-update, your QA servers will get those patches (auto-updates are typically every 4 hours). Once you are happy with these patches, set the same Sticky Tag for Production servers key. In 4 hours your production servers should be updated to the same patches that QA servers were. ##### How to find a proper sticky patch name Let's assume that you have a kernel patch that you want to "stick" with. All you need is to find a proper label for that patch. ![sticky-proper-label](/images/sticky-proper-label.png) As you can see, the patch was released at 2020-09-16 (16th September 2020). And if you apply a supported date format, it becomes `16092020`, that will be the sticky patch value. #### Scanning for vulnerabilities Identifying the vulnerabilities that apply to your systems is an important task for IT and InfoSec teams, and at TuxCare we make it easy. KernelCare live patching is integrated natively with vulnerability scanners including Tenable Nessus, Qualys, Rapid7 and many others. ##### How to use a vulnerability scanner with KernelCare It's rather simple. New scan results after installing a package and applying a patchset should not show any kernel CVEs that are handled by KernelCare. For example, Nessus for an old kernel shows a lot of detected CVEs before apply live patches: ![before](/images/scanner-manipulation-before.png) After the live patches were applied, there are no kernel-related CVEs: ![after](/images/scanner-manipulation-after.png) ##### What if my scanner is producing false positives? If your scanner produces incorrect results due to not being KernelCare aware, we have a solution that works at the OS level to report the correct information to the rpm/dpkg/uname commands; namely `kcare-scanner-interface` If you are using a scanner agent the defaults usually work and you can configure the scanner interface like so: ```text # kcare-scanner-interface init Resetting. Setting up scanner agents Done. ``` If you are using SSH credentials-based scanning, then you can configure the scanner interface like so - where user1 and user2 are the usernames your vulnerability scanner will ssh/sudo as: ```text # kcare-scanner-interface init user1 user2 Resetting. Setting up a scanner-interface for user1 Setting up a scanner-interface for user2 Setting up scanner agents Done. ``` To disable the scanner interface run: ```text # kcare-scanner-interface disable ``` We don't recommend enabling the scanner interface as root, as the root user's command output should not be changed in this way. If your scanner elevates privileges after logging in via SSH, only `sudo` can be used and not `su` sudo is not installed by default on some distributions like CentOS 6 but is the default privilege escalation method for all Ubuntu versions. If you do install sudo, be sure to review the configuration in /etc/sudoers and any `@include` files. ##### How to use OpenSCAP with KernelCare OpenSCAP is an open source vulnerability scanner and compliance tool and it can be used to scan a system protected by KernelCare. The following commands show how to use OpenSCAP to produce a vulnerability report for a system. ```text $ source /etc/os-release $ wget https://patches.kernelcare.com/oval/com.kernelcare.${ID}.${VERSION_ID}.xml $ oscap oval eval --report report.htm com.kernelcare.${ID}.${VERSION_ID}.xml ``` #### UEFI Secure Boot Support KernelCare supports systems with Secure Boot enabled in UEFI firmware. The KernelCare Agent uses a certificate that must be added to the Secure Boot trust chain to sign kernel modules. You can use the automated setup method (recommended), which uses a certificate embedded in a Microsoft-signed helper binary, or manually add a public certificate to the MOK database. #### Automated Setup (Recommended) The automated setup method uses a Microsoft-signed helper binary that automatically injects the KernelCare certificate into the Secure Boot trust chain at boot time. This eliminates the need for manual MOK enrollment. The KernelCare Agent package (version 3.0-2 or later) includes this helper binary and a setup script that configures it. **Supported Distributions:** The automated setup method is supported on RPM-based distributions (RHEL, CentOS, AlmaLinux, Rocky Linux, Oracle Linux, CloudLinux, Amazon Linux) with EFI boot, shim installed, and Secure Boot enabled. Not available for Debian/Ubuntu. **Setup steps:** 1. Update the KernelCare Agent to version 3.0-2 or later. 2. Run the setup script as root: ```bash $ /usr/share/kcare/secure_boot/setup_kcare_certs.sh ``` The script verifies the EFI system partition and shim bootloader are present, then places the helper binary in the appropriate location. 3. Reboot the system. The helper binary will automatically inject the certificate during the boot process. #### Manual Setup **Supported Distributions:** This method of adding a certificate with `mokutil` is supported on systems that use UEFI Secure Boot with the standard shim and MOK stack. If you need to set up the certificate manually or are using an older KernelCare Agent version: 1. The latest KernelCare Agent package contains a public certificate at `/usr/libexec/kcare/kernelcare_pub.der`. For older versions, download it to that location: ```bash curl -o /usr/libexec/kcare/kernelcare_pub.der https://patches.kernelcare.com/kernelcare_pub.der ``` 2. Use `mokutil` as root to add this MOK to the UEFI firmware: ```bash $ mokutil --import /usr/libexec/kcare/kernelcare_pub.der input password: input password again: ``` If you don't have a MOK password, `mokutil` will ask you to create one. The password is temporary and will be used on the next boot. 3. Reboot your machine to enter the MOK manager EFI utility. First, go down to the 'Enroll Mok': ![alt text](/images/uefi-enroll-mok.png "Select Enroll MOK") Then the firmware gives you the option of viewing the new MOK or continuing. Let's continue. ![alt text](/images/uefi-continue.png "Select Continue") It then asks you to confirm the enrollment. ![alt text](/images/uefi-yes.png "Select Yes") Then you will need to enter the password you used when running `mokutil --import`. ![alt text](/images/uefi-password.png "Enter the password") Finally, the firmware will ask you to reboot. ![alt text](/images/uefi-ok.png "Select OK") #### Verification After completing either setup method and rebooting, verify the certificate was enrolled successfully: ```bash $ mokutil --list-enrolled | egrep -i 'SHA1|Issuer' ``` In some cases, the enrolled key may not appear in the mokutil output but can be verified with: ```bash $ dmesg | grep -i 'cloud linux' [ 0.722149] EFI: Loaded cert 'Cloud Linux Software, Inc: Kernel Module Signing Key: 12ff0613c0f80cfba3b2f8eba71ebc27c5a76170' linked to '.system_keyring' ``` After successful verification, KernelCare should be able to apply patches as usual on systems with Secure Boot enabled. #### Live patching and FIPS compliance The FIPS-140 certification of a Linux kernel validates that the cryptography contained within a Linux kernel complies with the US government FIPS-140 data protection standard. Meaning that algorithms like AES, the random generator and other cryptographic aspects of the kernel are implemented as the standard defines. At the same time the certification is a lengthy process --a typical validation can take almost a year-- and for that reason only some of each vendor's kernels are validated. That is because vendors release new kernels with security and feature updates on a regular cadence some as often as weekly, irrespective of their FIPS validation status. This means users of FIPS validated kernels need to choose between: (a) strict compliance by staying on the same kernel without updating until the next validated kernel is available and (b) reducing their security risk by installing new kernels with security updates even if they are not validated. The same story applies to the vendor's live patching solutions. With KernelCare it is possible to live patch FIPS-140 validated Linux kernels, for example at the Red Hat Enterprise Linux operating system. The live patches applied to these kernels, in this example, consist of the same RHEL kernel patches but are limited to the ones addressing security vulnerabilities. That way, a live patched kernel contains the same security fixes as a vendor update without any feature or bug-fix updates, e.g. updates that may change the cryptographic subsystem for performance or other non-security related reasons. **In this way, security-conscious users of FIPS-validated Linux kernels that today apply their vendor's security patches can rely on KernelCare live patching the same way they do with their vendor's security updates**. Furthermore, KernelCare live patching applies the minimum possible updates to the validated kernel by explicitly excluding any non-security updates. #### Firewall and Proxy Settings ##### Patching servers through firewall As long as your servers have access to the Internet, even behind NAT - you will be able to use KernelCare patch server without any problems. Generally, KernelCare requires connection to only two servers to work: ```text cln.cloudlinux.com patches.kernelcare.com ``` An additional address is used for KernelCare agent installation/update: ```text repo.cloudlinux.com ``` ![through firewall](/images/patchingthroughfirewall.png) ##### Patching servers through proxy If your servers don't have direct Internet access but can gain access to the Internet using proxy, the configuration is not that different. KernelCare can pick up standard environment variables for a proxy. Make sure you have environment settings for proxy setup, and everything else will be the same as if servers were directly connected to the Internet: ```text # export http_proxy=http://proxy.domain.com:port # export https_proxy=http://proxy.domain.com:port ``` Settings defined by `export` are case-insensitive, so the example above could be as follows for certain software: ```text # export HTTP_PROXY=http://proxy.domain.com:port # export HTTPS_PROXY=http://proxy.domain.com:port ``` You can define these settings in the KernelCare config `/etc/sysconfig/kcare/kcare.conf`, for example: ```text $ cat /etc/sysconfig/kcare/kcare.conf AUTO_UPDATE=True HTTPS_PROXY=http://myproxy.com:59794 ``` If you define these settings in the config, you don't need to export them each `kcarectl` launch and don't need to edit cron jobs. All `kcarectl` launches will be aware of proxy settings from the config. In this case, you need to set proxy settings only once. ![through proxy](/images/patchingthroughproxy.png) #### KernelCare on AWS - Deployment User Guide ##### Introductory Material The Linux kernel is the most important piece of software on your server, as a security flaw in it can expose all of your services and customer data. KernelCare is a technology that allows you to keep the Linux kernel safe at all times, automatically, without ever having to stop the server and rebooting it causing downtime and inconvenient scheduling of maintenance windows. This improves availability, security, stability, operational costs, and customer satisfaction. It works with almost all mainstream distributions of Linux. It is simple, fast, and very easy to deploy while being able to handle very complex patches and customized kernels if you need them. ##### Prerequisites and Requirements KernelCare can be installed on any x86_64 compatible server or VM running one of the following distributions: * Amazon Linux 1, 2 * CentOS 6, 7, Xen4CentOS, CentOS-Plus, ElRepo * CloudLinux 6, 7 * Debian 7, 8, 9, 8-backports * Oracle Linux 6, 7 * ProxmoxVE 3,4,5 * RedHat EL 6, 7 * Ubuntu 14.04, 16.04, 18.04 * Virtuozzo 6 The exact list of compatible kernels can be found at the following link: [https://patches.kernelcare.com/](https://patches.kernelcare.com/) Standard OS kernels are required in most cases unless the custom kernel is supported. The software can be installed on a running server and doesn't require a reboot. Basic Linux skills are sufficient to deploy KernelCare on AWS. Simple deployments involve just an EC2 instance. KernelCare is available using the BYOL model. You need to register in our [customer portal](https://cln.cloudlinux.com) to get a trial license. Once you get the trial license, you need to register your running EC2 instance with the activation key. ##### Architectural Design As long as your servers have access to the Internet, even behind NAT - you will be able to use KernelCare without any problems. Generally, KernelCare requires connection to only two servers to work: ```text cln.cloudlinux.com patches.kernelcare.com ``` ![aws arch](/images/AWS_arch2.png) If your servers don't have direct Internet access but can gain access to the Internet using a proxy, the configuration is not that different. KernelCare can pick up standard environment variables for proxies. ![aws proxy](/images/AWS_proxy_arch2.png) Make sure you have environment settings for your proxy setup, and everything else will be the same as if the servers were directly connected to the Internet: ```text # export http_proxy=http://proxy.domain.com:port # export https_proxy=http://proxy.domain.com:port ``` ##### Security The only thing you need to be able to install/control your KernelCare deployment is SSH access (root credentials, key-based authentication/sudo or similar mechanisms are preferred). ##### Costs KernelCare is billed as a subscription service, for volume pricing please contact [sales@cloudlinux.com](mailto:sales@cloudlinux.com) ##### Sizing KernelCare agent has a tiny RAM footprint - binary patches usually require less than 1 MB. ##### Deployment Guidance To install KernelCare, run: ```text # curl -s -L https://kernelcare.com/installer | bash ``` or: ```text # wget -qq -O - https://kernelcare.com/installer | bash ``` If you are using IP-based license, nothing else required to be done. If you are using key-based license, run: ```text # kcarectl --register ``` Where `KEY` is the registration key code string provided when you signed up for a trial or pruchased the product. You can easily automate KernelCare deployment with Ansible, Puppet, Chef or other orchestration tools. Here are the steps that may be automated: 1. Distribute KernelCare agent package (optional - required only for servers with no access to the Internet) and a KernelCare agent configuration file (`/etc/sysconfig/kcare/kcare.conf`); 2. Set required environmental variables (optional); 3. Install KernelCare agent from either locally available package or central KernelCare download location; 4. Register KernelCare with either license key or IP-based license. ##### Health Check Systems protected by KernelCare can be monitored by means of CloudLinux Network (CLN) portal available at [https://cln.cloudlinux.com](https://cln.cloudlinux.com). Registered KernelCare installations are grouped by license keys. Kernels that are marked with the exclamation sign in amber do not have the latest patches installed. ![monit](/images/KC-Ent-monit.png) In either case, you can check whether the latest available patch has been applied by running the following command on a system protected by KernelCare: ```text # kcarectl --check ``` ##### Backup and Recovery There is no reason to backup KernelCare. KernelCare doesn't store any data. You can always re-install and re-register KernelCare. To backup the configuration file of KernelCare if you have modified it, backup the `/etc/sysconfig/kcare/` folder. ##### Routine Maintenance KernelCare is packaged in RPM/DEB packages (depending on Linux distribution) and will update any time system packages are updated. No additional maintenance is needed. ##### Emergency Maintenance If one of your instances degraded, once you start another instance based on EBS or snapshot - KernelCare will continue working as before, no additional work is needed. If you set up a new server instead, re-register KernelCare on the new server. If you decide to uninstall patches, run the command: ```text # kcarectl --unload ``` Or to completely remove the kernelcare package run one of the following commands: * on RPM-based systems: ```text # yum remove kernelcare ``` * or on DEB-based systems: ```text # apt-get remove kernelcare ``` #### Patch Feed Advanced Options ##### Test and Delayed Feeds The KernelCare Patch Server has several patch feeds available in addition to the standard (production) feed: * **Test feed** - the newest patches (test builds) that have not undergone the complete testing process. Test feed makes it possible to start testing new patches earlier. * **Delayed feeds** - instructs KernelCare to skip loading patches that were released within the last 12/24/48 hours. The alternate feed option is enabled by setting `PREFIX` variable in `/etc/sysconfig/kcare/kcare.conf` to one of `test`/`12h`/`24h`/`48h`. ##### Feed Management With Sticky Patch Feature The best way to handle QA and Production environments is to use Sticky tag feature of KernelCare license keys issued from CloudLinux Network (CLN) portal. To use this tag, go to CLN portal -> KernelCare tab -> click on the target key -> Edit Key Info window. ![activation keys](/images/KC-Ent-list.png) ![key details](/images/KC-Ent-edit.png) You should provide a separate key for each environment and set them to a particular sticky tag which is actually the date to which all the servers in an environment have to be patched. ![edit key](/images/KC-Ent-sticky.png) The date in the Sticky tag field can be any date from May 28, 2018 up to one day before today. To use the Sticky tag feature on the servers to be patched, run: ```text $ kcarectl --set-sticky-patch=KEY ``` Alternatively, you can do the same by adding `STICKY_PATCH=KEY` to the `/etc/sysconfig/kcare/kcare.conf` file. **Do Not** replace the `KEY` word with the actual KernelCare license key used to register the server, you should just use the word `KEY` When the Sticky tag feature is enabled for particular servers, all such servers will get patches only released before the date specified in the Sticky tag field. This way, you can add new patches to all the servers in an environment (i.e. registered with the same KernelCare license key) by updating only a single field in the CLN portal. ##### Support We offer unlimited, 24x7x365 support. Submit a direct support request using [this form](https://support.tuxcare.com/hc/requests/new). * We answer all support questions within one business day and most within a couple of hours. To expedite the support, run the following command on your server (as root): ```text # kcarectl --doctor ``` Then paste the generated key into the support request. ##### Support Costs Your KernelCare subscription includes free 24/7 support. ##### Reference Materials * KernelCare website: [https://tuxcare.com/enterprise-live-patching-services/kernelcare-enterprise/](https://tuxcare.com/enterprise-live-patching-services/kernelcare-enterprise/) * KernelCare Patch Server: [https://patches.kernelcare.com](https://patches.kernelcare.com) * CloudLinux Network - CLN (Billing Portal): [https://cln.cloudlinux.com](https://cln.cloudlinux.com) * CloudLinux 24/7 online support system: [https://tuxcare.zendesk.com](https://tuxcare.zendesk.com) ##### Localization KernelCare is available in the English language only. #### Reseller Partner UI Once you have got the reseller partner access, in the IP Reseller Partner UI you can view and manage IP licenses, billing options and profile details. Here you can track your balance, license count and license prices as well as using an IP address search to find customers. You can find more information about KernelCare licensing [here](https://www.kernelcare.com/pricing/). ##### Server Section As soon as you have added funds (See **Billing Info/Add Funds** below) to your account you can immediately add new licenses for clients. To add an IP KernelCare license: 1. Enter IP address in the **Add IP License** field, choose a license type in the pull-down menu (KernelCare) and click **Add license**. ![reseller ui](/images/reseller001.jpg) 2. To delete a license click **Delete** in front of the needed IP address. 3. To add a KernelCare Key license go to the **KernelCare Keys** tab, enter the number of servers allowed for the license in **Max Servers**, add a description if needed and click **Add**. The key will be generated and appear in the list below. In the **Operations List** you are able to edit or delete the key. ![reseller ops](/images/reseller007_zoom96.png) ##### Billing Info/Add Funds To add funds: 1. Click **Add Funds** near your balance or go to **Billing Info/Add Funds** on the top of the starting page of your account. 2. Click **Add** to add credit card details, then enter funds amount and click **TopUp** or **Process to Checkout** to pay via PayPal. ![reseller billing](/images/reseller002.jpg) While adding credit card details, you can also choose the **Auto add funds** option - the funds amount you choose in the pull down menu will be automatically added when your balance is below $100. If you choose **Auto repay**, your card will be automatically charged when your balance becomes negative. The minimum charge is $20 (e.g. for a balance of -$15 you will be charged at $20, for a balance of -$134.2 you will be charged at $134.2). ![add funds](/images/reseller003.jpg) If your balance is shown as negative, it means that you have to deposit more funds. ##### API Section CloudLinux and KernelCare IP license adding and removing is compatible with different hosting and domain management and billing systems and platforms. You can find comprehensive information on all possible CloudLinux modules and plug-ins APIs in API Section. ![reseller api](/images/reseller004.jpg) ##### Profile You can edit your profile information by clicking on **Profile** section. Edit the necessary info and click **Update Account**. ![profile](/images/reseller5.jpg) ![contacts](/images/reseller006.jpg) #### How To ##### How to disable HyperThreading (SMT) without reboot: KernelCare case This article explains how to disable or enable SMT (Simultaneous multithreading) without rebooting using KernelCare, to help mitigate the recent MDS/Zombieload vulnerability. Disabling CPU simultaneous multithreading (SMT) is one of the mitigations needed to counter the recent MDS vulnerability (also known as ‘Zombieload'). There is a performance impact that depends on the configuration of the hosting platform and its workload patterns. You should also consider the impact of other mitigation strategies, such as assigning dedicated cores to guests (e.g. VMs). You can control and get the status of SMT with the kernel's `sysfs` interface. There are two files, both in the `/sys/devices/system/cpu/smt` directory: * `control` * `active` If you cannot find the `/sys/devices/system/cpu/smt` directory, this means your running kernel does not support SMT. In this case, you need to apply KernelCare patches so the SMT controls become available to your system. Use the `kcarectrl` command: ```text # kcarectl --update Kernel is safe ``` ```text # ls -l /sys/devices/system/cpu/smt -r--r--r-- 1 root root 4096 May 17 13:06 active -rw-r--r-- 1 root root 4096 May 17 13:06 control ``` As soon as you have these files in place, it is possible to proceed with disabling SMT. ##### SMT Control `/sys/devices/system/cpu/smt/control` This file lets you enable or disable SMT, and shows its state. There are three values: 1. `on`: The CPU supports SMT and it is enabled. All logical CPUs can be taken offline or online without restriction. 2. `off`: The CPU supports SMT but it is disabled. Only so-called primary SMT threads can be taken offline/online without restriction. Attempts to put a non-primary sibling thread online will be rejected. 3. `notsupported`: The CPU does not support SMT. You will not be able to write to the control file. ##### SMT Status `/sys/devices/system/cpu/smt/active` The contents of this file show the status of SMT (e.g. if two or more sibling threads are active on the same physical core the contents of this file is 1, if not: 0). Here are some commands to control SMT support (root permissions are required): ##### Check the SMT state ```text $ cat /sys/devices/system/cpu/smt/active ``` ##### Enable SMT ```text # echo on > /sys/devices/system/cpu/smt/control ``` ##### Disable SMT ```text # echo off > /sys/devices/system/cpu/smt/control ``` Disabling SMT, [updating microcode](/how-to/#how-to-update-microcode-without-reboot-with-vendor-provided-package), and applying KernelCare patches will protect your systems against the ZombieLoad vulnerability. Note, only the latter action is applicable to virtual systems (e.g. VMs, VPS and other cloud instance types). ##### How to update Microcode without reboot with vendor-provided package This article shows how to update the microcode of Intel CPUs running Linux. To avoid possible issues with Microcode updating, enable SMT before the update. This article is subject to change and will be updated with instructions for other distributions. * These steps must be done as root. * The examples shown are for Debian. * If you have doubts your systems are fully protected against CPU- and kernel-related vulnerabilities, please [get in touch with us](mailto:sales@cloudlinux.com). ##### Updating microcode on Ubuntu and Debian 1. Find the microcode package download link for your platform * Ubuntu: [https://usn.ubuntu.com/3977-1/](https://usn.ubuntu.com/3977-1/) * Debian: [https://packages.debian.org/search?keywords=intel-microcode](https://packages.debian.org/search?keywords=intel-microcode) 2. Download the package Example shown for Debian 9 ```text $ cd $ mkdir firmware $ cd firmware $ wget http://security.debian.org/debian-security/pool/updates/non-free/i/intel-microcode/intel-microcode_3.20190514.1~deb9u1_amd64.deb ``` 3. Check the downloaded package ```text $ md5sum intel-microcode_3.20190514.1~deb9u1_amd64.deb c7bc9728634137453e0f4821fb6bb436 intel-microcode_3.20190514.1~deb9u1_amd64.deb ``` A list of checksums is on [the Debian packages download page](https://packages.debian.org/stretch/amd64/intel-microcode/download). 4. Unpack the package ```text $ dpkg -x intel-microcode_3.20190514.1~deb9u1_amd64.deb ``` 5. Check the unpacked files ```text $ ls -l total 1896 drwxr-xr-x 5 root root 53 May 15 04:18 etc -rw-r--r-- 1 root root 1940140 May 17 11:42 intel-microcode_3.20190514.1~deb9u1_amd64.deb drwxr-xr-x 3 root root 22 May 15 04:18 lib drwxr-xr-x 3 root root 19 May 15 04:18 usr ``` 6. Create a backup of existing microcode: ```text # test -d /lib/firmware/intel-ucode/ && mv /lib/firmware/intel-ucode/ /lib/firmware/intel-ucode.backup ``` 7. Copy the new microcode and check it ```text # cp -r lib/firmware/intel-ucode/ /lib/firmware/ # ls -l /lib/firmware/ | grep intel-ucode drwxr-xr-x 2 root root 4096 May 17 11:47 intel-ucode drwxr-xr-x 2 root root 4096 May 16 20:54 intel-ucode.backup ``` 8. Check the current microcode version ```text # dmesg | grep microcode [ 2.254717] microcode: sig=0x306a9, pf=0x10, revision=0x12 [ 2.254820] microcode: Microcode Update Driver: v2.01 , Peter Oruba ``` 9. (Optional) Double check the current microcode versions (revisions per core) ```text $ grep microcode /proc/cpuinfo microcode : 0x12 microcode : 0x12 microcode : 0x12 microcode : 0x12 ``` 10. Check the microcode reload file exists ```text $ ls -l /sys/devices/system/cpu/microcode/reload --w------- 1 root root 4096 May 17 11:54 /sys/devices/system/cpu/microcode/reload ``` 11. Force the kernel to load the new microcode ```text # echo 1 > /sys/devices/system/cpu/microcode/reload ``` 12. Check the new microcode ```text # dmesg | grep microcode [ 2.254717] microcode: sig=0x306a9, pf=0x10, revision=0x12 [ 2.254820] microcode: Microcode Update Driver: v2.01 , Peter Oruba [ 1483.494573] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 [ 1483.495985] microcode: updated to revision 0x21, date = 2019-02-13 [ 1483.496012] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 [ 1483.496698] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 [ 1483.497391] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 ``` 13. (Optional) Double check the new microcode version (revisions per core) ```text $ grep microcode /proc/cpuinfo microcode : 0x21 microcode : 0x21 microcode : 0x21 microcode : 0x21 ``` ##### Updating Microcode on Red Hat and CentOS For RHEL-based distributions, you can use the `microcode_ctl utility` to update microcode. 1. Get the latest microcode by updating the `microcode_ctl` package ```text # yum update microcode_ctl ``` 2. Create a force file Create a `force-late-intel-06-4f-01` inside the firmware directory. ```text # touch /lib/firmware/`uname -r`/force-late-intel-06-4f-01 ``` 3. Run the microcode update ```text # /usr/libexec/microcode_ctl/update_ucode ``` 4. Force the kernel to load the new microcode ```text # echo 1 > /sys/devices/system/cpu/microcode/reload ``` 5. Check the new microcode ```text # dmesg | grep microcode [ 2.254717] microcode: sig=0x306a9, pf=0x10, revision=0x12 [ 2.254820] microcode: Microcode Update Driver: v2.01 , Peter Oruba [ 1483.494573] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 [ 1483.495985] microcode: updated to revision 0x21, date = 2019-02-13 [ 1483.496012] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 [ 1483.496698] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 [ 1483.497391] platform microcode: firmware: direct-loading firmware intel-ucode/06-3a-09 ``` 6. (Optional) Double check the new microcode version (revisions per core) ```text $ grep microcode /proc/cpuinfo microcode : 0x21 microcode : 0x21 microcode : 0x21 microcode : 0x21 ``` ##### Updating Microcode on CentOS 6 1. Get the latest microcode by updating the `microcode_ctl` package ```text # yum update microcode_ctl ``` 2. If `yum update microcode_ctl` outputs the following: ```text Package(s) microcode_ctl available, but not installed. No Packages marked for Update ``` you need to install the package manually. 3. To install `microcode_ctl` package, run the command: ```text # yum install microcode_ctl ``` The command should output: ```text Installed: microcode_ctl.x86_64 2:1.17-33.11.el6_10 Complete! ``` 4. Check CPU microcode version: ```text $ grep microcode /proc/cpuinfo microcode : 9 microcode : 9 microcode : 9 microcode : 9 ``` 5. Try to update microcode ```text # microcode_ctl -u ``` If you see the output: ```text microcode_ctl: writing microcode (length: 2370560) microcode_ctl: cannot open /dev/cpu/microcode for writing errno=2 (No such file or directory) ``` You need to load driver microcode. 6. Load driver microcode ```text # modprobe microcode ``` 7. Try to update microcode again: ```text # microcode_ctl -u ``` If you see the output: ```text microcode_ctl: writing microcode (length: 2370560) microcode_ctl: microcode successfully written to /dev/cpu/microcode ``` then the update is successful. 8. Check version: ```text $ grep microcode /proc/cpuinfo microcode : 17 microcode : 17 microcode : 17 microcode : 17 ``` #### Plesk related ##### How to get a KernelCare activation key from the extended Plesk license Often our clients purchase KernelCare licenses through Plesk/Odin and in such cases, they get a universal key which includes the KernelCare license and other additional keys for Plesk plugins. Such a key has the following syntax - `A00B00-0CDE00-F0G000-HIGK00-LM0N00`, and initially, it is installed through Plesk automatically and the license gets activated successfully. However, if it is required to re-register the agent for some reason or simply get the KernelCare activation key separately, it would be impossible to apply the above-mentioned one - we would need to deal with the KernelCare service separately. To get the KernelCare activation key from the extended Plesk license key, you will need to proceed with the following. 1. Navigate to *Tools & Settings -> Plesk -> License Management -> Additional License Keys* ![plesk keys](/images/LicenseManagement.png) ![more keys](/images/AdditionalLicenseKeys.png) 2. Click *Download key* next to the KernelCare license listed on the page and open the file downloaded in some text editor 3. Find the following abstract: ```text YOUR_BASE64_ENCODED_LICENSE_KEY== ``` 4. This is your base64-encoded key, and it should be decoded using a CLI utility or an online base64 decoder into UTF-8, e.g. [https://www.base64decode.org](https://www.base64decode.org). The new license key should have the following format: `xxxxxxxxxxxxxxxx`. It will contain lower and upper case letters and numbers. 5. Use the new key decoded to activate the service: ```text # kcarectl --register DECODED_KEY_HERE ``` That's it! ### LibCare LibCare enables security patching of critical userspace shared libraries in-memory without restarting or disrupting the applications using them. It provides security updates for the OpenSSL and glibc libraries on many operating systems including CentOS, AlmaLinux, Oracle Linux, Debian, and Ubuntu. #### Library Patching Lifetime Each individual OpenSSL and glibc library covered by LibCare receives live patches for the same time period as the operating system (including the extended lifecycle support phase). LibCare tracks all releases of OpenSSL and glibc linked in memory at any given time and patches them forward. #### Supported Architectures LibCare is available only for x86-64 (Intel and AMD) architecture. #### Installation and upgrade Userspace processes patching feature is available in the KernelCare package. #### Usage To apply the available patches to all userspace processes, run the following command: ```text # kcarectl --lib-update ``` To gather information about what processes were patched, run the following command: ```text # kcarectl --lib-info ``` To gather information about applied patches, run the following command: ```text # kcarectl --lib-patch-info ``` To unpatch all processes, run the following command: ```text # kcarectl --lib-unload ``` ##### Blacklisting Applying a live patch may clash with software such as anti-viruses that detect or prevent memory updates. While the majority of software is compatible with live patching, for the software that may misbehave, LibCare comes with a default blacklist. The blacklist is located in the /var/lib/libcare/blacklist and contains the list of known applications that may misbehave when live patched. You can override those values by creating the file `/var/cache/kcare/userspace/blacklist`. The format of the file is as follows. Patterns should be specified line by line prefixed with pattern type and a colon. Comments start with a hash (#). For example: ```text # Symantec Antivirus path: /opt/Symantec/* filename:symcfgd filename:rtvscand filename:smcd ``` Specifying `path` means that the whole path to binary will be taken into account, while using `filename` allows you to blacklist a process irrespective of the full path to the binary. Wildcards are also supported: ```text filename:docker* path:/usr/libexec/docker/docker-* ``` Also POSIX regular expressions could be used as follows: ```text regex:/usr/bin/[[:alnum:]]+ ``` ##### Auto update Userspace patching cron job is disabled by default. To enable it, run the following command: ```text # libcare-cron init ``` #### Usage in containers LibCare supports containers natively, including docker, LXC and other containerization technologies. When run on the host it operates on all processes that are running, including processes present in containers. At the same time there are two ways to use LibCare with containers and each has its own advantages and disadvantages. Let's go through them. ##### Disposable container servers Disposable container servers are services that are run within a container for a limited time and are refreshed periodically, e.g. daily to get the latest security updates. The recommended way to run LibCare with disposable containers is by installing `kernelcare` on the host, and it will automatically patch all processes libraries in the containers. ##### Persistent container servers Persistent container servers are services that are run in containers the same way as a traditional physical server, i.e. the LXC approach. Although LibCare can run the same way as with disposable containers, it is also possible to install `kernelcare` within each container and that will enable live patching of the processes of each container individually. That approach enables accurate patching information within each containerized server that can be used by the available vulnerability scanner. When using this approach userspace patching must be disabled on the host using `kcarectl --disable-libcare`. #### Troubleshooting ##### Auditd logs The LibCare tools heavily use the `ptrace` syscall, and if `auditd` is configured to trace it's calls there will be a lot of records in the logs. There is a rule that is provided by the kernelcare package and is located at `/etc/audit/rules.d/kernelcare.rules` that will exclude the kernelcare processes from auditd. **Note**: no such rule is provided for EL6 due to old `autditd` restrictions. There is a command that will add such a rule at runtime: ```text # auditctl -l | grep kcare | cut -d' ' -f2- | xargs -t -L1 -r auditctl -d && pgrep libcare-server | \ xargs -t -n1 -i auditctl -A exit,never -F arch=b64 -S ptrace -F pid="{}" -k kcarever | \ xargs -t -n1 -i auditctl -A exit,never -F arch=b64 -S ptrace -F pid="{}" -k kcare ``` It removes all currently enabled KernelCare rules and adds a new one by LibCare's process ID. #### Unpatched Library Detector (UChecker) ##### Description UChecker is a scanner that checks network Linux servers and detects out-of-date libraries both on disk and in memory. KernelCare's open-source scanner will find false negatives by correctly reporting vulnerable libraries running in memory that could be reported as updated by other scanners. The UChecker (originated from "userspace checker") works with all modern Linux Distributions, it is free and open-source, distributed under the GNU General Public License. ##### How UChecker works This activity diagram shows how UChecker works: ![uchecker](/images/uchecker.jpg) ##### UChecker Usage To scan your systems, run the following command: ```text $ curl -s -L https://kernelcare.com/uchecker | sudo python ``` You will receive the following output: ```text [*] Process httpd[15516] linked to the `libc-2.17.so` that is not up to date. You may want to update libraries above and restart corresponding processes. KernelCare+ allows to resolve such issues with no process downtime. To find out more, please, visit https://lp.kernelcare.com/kernelcare-early-access? ``` The following information is available in the output: * Process ID * Process Name ##### UChecker Troubleshooting To see verbose output, you can choose a logging level: `ERROR`, `WARNING`, `INFO`, and `DEBUG`. For example: ```text $ curl -s -L https://kernelcare.com/uchecker | sudo LOGLEVEL=debug python ``` To learn more, visit the [UChecker Github page](https://github.com/cloudlinux/kcare-uchecker). ### Vulnerability Scanner Integration with KernelCare This document is made for developers of vulnerability scanners to correctly report live patched vulnerabilities as delivered by KernelCare. There are several approaches that vendors might take to identify vulnerabilities patched by KernelCare correctly. #### Easiest: Identifying correctly the effective kernel KernelCare provides "effective kernel" information in ```text /proc/kcare/effective_version ``` Security scanners can check if the file is present, and if it is, use it instead of /proc/version to identify the kernel. This will provide an effective kernel version from a security standpoint. Alternatively, the command `/usr/bin/kcarectl --uname` can be run instead of the `uname` command to detect effective kernel version ### Comprehensive: Using OVAL data KernelCare comes with OVAL data that provides instructions to the scanner to identify the vulnerabilities addressed by the installed live patches. OVAL data are available for the operating systems supported by KernelCare, including AlmaLinux, Red Hat Enterprise Linux, Oracle Linux, CentOS, Debian, and Ubuntu. The OVAL data cover all KernelCare products and LibCare. The OVAL data for KernelCare live patching are available at [patches.kernelcare.com/oval](https://patches.kernelcare.com/oval/). #### Comprehensive & local: Using the local CVELIST file on each scanned node KernelCare provides two files listing the vulnerabilities the currently installed live patches address. These files contain a list of CVEs separated by a new line. The list of vulnerabilities addressed by Kernel live patches is available at: ```text /proc/kcare/cvelist ``` The list of vulnerabilities addressed by system live patching (LibCare) is available at: ```text /var/cache/kcare/libcare_cvelist ``` ================================================================================ Source: https://docs.tuxcare.com/local-mirror-els/ ================================================================================ # Installation instructions of a local mirror with ELS updates We provide the ability to create local mirrors of Endless Lifecycle Support and Extended Security Updates repositories. ## Prerequisites Before creating a local mirror, ensure the following requirements are met: * **Access**: To obtain access to the local mirroring facility, provide your external IP address to your Account Manager or send it to [sales@tuxcare.com](mailto:sales@cloudlinux.com) * **Connection**: The mirroring uses rsync over TCP port 873 (not port 22) * **Disk Space**: The minimum required free disk space for the mirror is 100 GB ## Mirroring Instructions To create a local mirror, use one of the following sets of instructions based on your operating system. ### CentOS 6 ELS To create a local mirror of the centos6-els repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/CENTOS6ELS/ ``` To create a local mirror of the CentOS 6 mirrors, use the following: ``` rsync://repo.cloudlinux.com/CENTOS6/ ``` For example: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/CENTOS6ELS/ . rsync -avSHP --delete rsync://repo.cloudlinux.com/CENTOS6/ . ``` ### CentOS 7 ELS To create a local mirror of the [centos7-els](https://repo.tuxcare.com/centos7-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/CENTOS7ELS/ ``` To create a local mirror of the CentOS 7 repository, use the following: ``` rsync://repo.tuxcare.com/CENTOS7/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/CENTOS7ELS/ . rsync -avSHP --delete rsync://repo.tuxcare.com/CENTOS7/ . ``` ### CentOS 8 ELS To create a local mirror of the CentOS 8 ELS repository with security updates via `rsync`, use the following: CentOS 8.4: ``` rsync://repo.cloudlinux.com/CENTOS84_ELS/ ``` CentOS 8.5: ``` rsync://repo.cloudlinux.com/CENTOS85_ELS/ ``` For example: CentOS 8.4: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/CENTOS84_ELS/ . ``` CentOS 8.5: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/CENTOS85_ELS/ . ``` ### CentOS Stream 8 ELS To create a local mirror of the [centos8stream-els](https://repo.tuxcare.com/centos8stream-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/CENTOS8STREAMELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/CENTOS8STREAMELS/ . ``` ### Debian 10 ELS To create a local mirror of the [debian10-els](https://repo.tuxcare.com/debian10-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/DEBIAN10ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/DEBIAN10ELS/ . ``` ### OracleLinux 6 ELS To create a local mirror of the oraclelinux6-els repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/ORALINUX6ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ORALINUX6ELS/ . ``` ### OracleLinux 7 ELS To create a local mirror of the [oraclelinux7-els](https://repo.tuxcare.com/oraclelinux7-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/ORACLELINUX7ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/ORACLELINUX7ELS/ . ``` ### Red Hat Enterprise Linux 7 ELS To create a local mirror of the [rhel7-els](https://repo.tuxcare.com/rhel7-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/RHEL7ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/RHEL7ELS/ . ``` ### Red Hat Enterprise Linux 8 ELS To create a local mirror of the [rhel8-els](https://repo.tuxcare.com/rhel8-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/RHEL8ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/RHEL8ELS/ . ``` ### Amazon Linux 2 ELS To create a local mirror of the [amazonlinux2-els](https://repo.tuxcare.com/amazonlinux2-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/AMAZONLINUX2ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/AMAZONLINUX2ELS/ . ``` ### Ubuntu 16.04 ELS To create a local mirror of the ubuntu16_04-els repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/UBUNTU1604ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/UBUNTU1604ELS/ . ``` ### Ubuntu 18.04 ELS To create a local mirror of the [ubuntu18_04-els](https://repo.cloudlinux.com/ubuntu18_04-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/UBUNTU1804ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/UBUNTU1804ELS/ . ``` ### Ubuntu 20.04 ELS To create a local mirror of the [ubuntu20_04-els](https://repo.tuxcare.com/ubuntu20_04-els/) repository with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/UBUNTU2004ELS/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/UBUNTU2004ELS/ . ``` ### AlmaLinux 9.2 ESU To create a local mirror of the [tuxcare-base and tuxcare-esu](https://repo.tuxcare.com/tuxcare/9.2/) repositories with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/ALMALINUX92ESU/ ``` To create a local mirror of the AlmaLinux 9.2 repository, use the following: ``` rsync://repo.tuxcare.com/ALMALINUX/9.2/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/ALMALINUX92ESU/ . rsync -avSHP --delete rsync://repo.tuxcare.com/ALMALINUX/9.2/ . ``` ### TuxCare 9.6 ESU These instructions apply to AlmaLinux 9.6 ESU and Rocky Linux 9.6 ESU. To create a local mirror of the [tuxcare-base and tuxcare-esu](https://repo.tuxcare.com/tuxcare/9.6/) repositories with security updates via `rsync`, use the following: ``` rsync://repo.tuxcare.com/TUXCARE96ESU/ ``` For example: ``` rsync -avSHP --delete rsync://repo.tuxcare.com/TUXCARE96ESU/ . ``` When configuring machines to use a local mirror for the TuxCare 9.6 ESU repository, set `priority=1` in the `tuxcare-esu` repo so ESU packages override the standard repos. Below is an example `/etc/yum.repos.d/tuxcare-esu.repo` file for TuxCare 9.6 ESU: ``` [tuxcare-esu96] name=TuxCare Enterprise Support for AlmaLinux 9.6 - ESU (local mirror) baseurl=https://mirror.corp.lan/tuxcare/9.6/esu/x86_64/ enabled=1 gpgcheck=1 skip_if_unavailable=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TuxCare priority=1 ``` Vulnerability scanners will often look for the information stored in /etc/tuxcare-release, however if you're using a local mirror you may not have installed the tuxcare-release package, so you should create the file with the correct OS name and version info like so: ``` source /etc/os-release echo "TuxCare Enterprise Support for ${NAME} release ${VERSION_ID}" > /etc/tuxcare-release ``` Or simply hardcode it as one of these (if using Ansible to roll out config for example): * `TuxCare Enterprise Support for AlmaLinux release 9.2` * `TuxCare Enterprise Support for AlmaLinux release 9.6` * `TuxCare Enterprise Support for Rocky Linux release 9.6` ================================================================================ Source: https://docs.tuxcare.com/local-mirror-for-els-nodejs/ ================================================================================ # Installation instructions of a local mirror for ELS Node.js We provide the ability to create local mirrors of Node.js for ELS updates. **To obtain access to the local mirroring, provide your External IP address to your Account Manager or send it to [sales@tuxcare.com](mailto:sales@tuxcare.com).** * To create a local mirror of the repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/ALT_COMMON/ ``` and ``` rsync://repo.cloudlinux.com/ALT_NODEJS_ELS/ ``` * Example of creating a local mirror for all supported OS versions: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_NODEJS_ELS/ alt-nodejs-els ``` * Example of creating a local mirror for a specific OS version: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/rpm/el/8/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_NODEJS_ELS/rpm/el/8/ alt-nodejs-els ``` * Use one of the suggested options to specify the OS: | Option | OS | | :---------------: | :------------------------------------------------------------------------: | | rpm/el/7/ | CentOS 7, CloudLinux 7, OracleLinux 7, etc. | | rpm/el/8/ | AlmaLinux 8, CentOS 8, CentOS 8 Stream, CloudLinux 8, Oracle Linux 8, etc. | | rpm/el/9/ | AlmaLinux 9, CloudLinux 9, Oracle Linux 9, etc. | | rpm/el/10/ | AlmaLinux 10, CloudLinux 10, Oracle Linux 10, etc. | | deb/ubuntu/16.04/ | Ubuntu 16.04 | | deb/ubuntu/18.04/ | Ubuntu 18.04 | | deb/ubuntu/20.04/ | Ubuntu 20.04 | | deb/ubuntu/22.04/ | Ubuntu 22.04 | | deb/ubuntu/24.04/ | Ubuntu 24.04 | | deb/debian/10/ | Debian 10 | | deb/debian/11/ | Debian 11 | | deb/debian/12/ | Debian 12 | | deb/debian/13/ | Debian 13 | | apk/alpine/3.22/ | Alpine Linux 3.22 | ================================================================================ Source: https://docs.tuxcare.com/local-mirror-for-els-php/ ================================================================================ # Installation instructions of a local mirror for ELS PHP We provide the ability to create local mirrors of PHP for ELS updates. **To obtain access to the local mirroring, provide your External IP address to your Account Manager or send it to [sales@tuxcare.com](mailto:sales@tuxcare.com).** * To create a local mirror of the repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/ALT_COMMON/ ``` and ``` rsync://repo.cloudlinux.com/ALT_PHP_ELS/ ``` * Example of creating a local mirror for all supported OS versions: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_PHP_ELS/ alt-php-els ``` * Example of creating a local mirror for a specific OS version: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/rpm/el/8/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_PHP_ELS/rpm/el/8/ alt-php-els ``` * Use one of the suggested options to specify the OS: | Option | OS | | :---------------: | :------------------------------------------------------------------------: | | rpm/el/7/ | CentOS 7, CloudLinux 7, OracleLinux 7, Amazon Linux 2, etc. | | rpm/el/8/ | AlmaLinux 8, CentOS 8, CentOS 8 Stream, CloudLinux 8, Oracle Linux 8, etc. | | rpm/el/9/ | AlmaLinux 9, CloudLinux 9, Oracle Linux 9, etc. | | rpm/el/10/ | AlmaLinux 10, CloudLinux 10, Oracle Linux 10, etc. | | deb/ubuntu/16.04/ | Ubuntu 16.04 | | deb/ubuntu/18.04/ | Ubuntu 18.04 | | deb/ubuntu/20.04/ | Ubuntu 20.04 | | deb/ubuntu/22.04/ | Ubuntu 22.04 | | deb/ubuntu/24.04/ | Ubuntu 24.04 | | deb/debian/10/ | Debian 10 | | deb/debian/11/ | Debian 11 | | deb/debian/12/ | Debian 12 | | deb/debian/13/ | Debian 13 | | apk/alpine/3.22/ | Alpine Linux 3.22 | ================================================================================ Source: https://docs.tuxcare.com/local-mirror-for-els-python/ ================================================================================ # Installation instructions of a local mirror for ELS Python We provide the ability to create local mirrors of Python for ELS updates. **To obtain access to the local mirroring, provide your External IP address to your Account Manager or send it to [sales@tuxcare.com](mailto:sales@tuxcare.com).** * To create a local mirror of the repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/ALT_COMMON/ ``` and ``` rsync://repo.cloudlinux.com/ALT_PYTHON_ELS/ ``` * Example of creating a local mirror for all supported OS versions: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_PYTHON_ELS/ alt-python-els ``` * Example of creating a local mirror for a specific OS version: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/rpm/el/8/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_PYTHON_ELS/rpm/el/8/ alt-python-els ``` * Use one of the suggested options to specify the OS: | Option | OS | | :---------------: | :------------------------------------------------------------------------: | | rpm/el/7/ | CentOS 7, CloudLinux 7, OracleLinux 7, etc. | | rpm/el/8/ | AlmaLinux 8, CentOS 8, CentOS 8 Stream, CloudLinux 8, Oracle Linux 8, etc. | | rpm/el/9/ | AlmaLinux 9, CloudLinux 9, Oracle Linux 9, etc. | | rpm/el/10/ | AlmaLinux 10, CloudLinux 10, Oracle Linux 10, etc. | | deb/ubuntu/16.04/ | Ubuntu 16.04 | | deb/ubuntu/18.04/ | Ubuntu 18.04 | | deb/ubuntu/20.04/ | Ubuntu 20.04 | | deb/ubuntu/22.04/ | Ubuntu 22.04 | | deb/ubuntu/24.04/ | Ubuntu 24.04 | | deb/debian/10/ | Debian 10 | | deb/debian/11/ | Debian 11 | | deb/debian/12/ | Debian 12 | | deb/debian/13/ | Debian 13 | | apk/alpine/3.22/ | Alpine Linux 3.22 | ================================================================================ Source: https://docs.tuxcare.com/local-mirror-for-els-ruby/ ================================================================================ # Installation instructions of a local mirror for ELS Ruby We provide the ability to create local mirrors of Ruby for ELS updates. **To obtain access to the local mirroring, provide your External IP address to your Account Manager or send it to [sales@tuxcare.com](mailto:sales@tuxcare.com).** * To create a local mirror of the repository with security updates via `rsync`, use the following: ``` rsync://repo.cloudlinux.com/ALT_COMMON/ ``` and ``` rsync://repo.cloudlinux.com/ALT_RUBY_ELS/ ``` * Example of creating a local mirror for all supported OS versions: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_RUBY_ELS/ alt-ruby-els ``` * Example of creating a local mirror for a specific OS version: ``` rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_COMMON/rpm/el/8/ alt-common rsync -avSHP --delete rsync://repo.cloudlinux.com/ALT_RUBY_ELS/rpm/el/8/ alt-ruby-els ``` * Use one of the suggested options to specify the OS: | Option | OS | | :---------------: | :------------------------------------------------------------------------: | | rpm/el/7/ | CentOS 7, CloudLinux 7, OracleLinux 7, etc. | | rpm/el/8/ | AlmaLinux 8, CentOS 8, CentOS 8 Stream, CloudLinux 8, Oracle Linux 8, etc. | | rpm/el/9/ | AlmaLinux 9, CloudLinux 9, Oracle Linux 9, etc. | | rpm/el/10/ | AlmaLinux 10, CloudLinux 10, Oracle Linux 10, etc. | | deb/ubuntu/16.04/ | Ubuntu 16.04 | | deb/ubuntu/18.04/ | Ubuntu 18.04 | | deb/ubuntu/20.04/ | Ubuntu 20.04 | | deb/ubuntu/22.04/ | Ubuntu 22.04 | | deb/ubuntu/24.04/ | Ubuntu 24.04 | | deb/debian/10/ | Debian 10 | | deb/debian/11/ | Debian 11 | | deb/debian/12/ | Debian 12 | | deb/debian/13/ | Debian 13 | | apk/alpine/3.22/ | Alpine Linux 3.22 | ================================================================================ Source: https://docs.tuxcare.com/radar/ ================================================================================ # TuxCare Radar This guide describes [TuxCare Radar](https://tuxcare.com/radar/) and how to install and use it. ## What is TuxCare Radar? TuxCare Radar is an intelligent vulnerability scanner for Linux systems, fully integrated with TuxCare's live patching and ELS technologies. It swiftly uncovers vulnerabilities and ensures their effective prioritization using a unique algorithm that assesses the risk to your company based on a comprehensive set of risk factors. ## Installation First you need to install our repository configuration: RPM-based distributions (AlmaLinux, RHEL etc): ```text cat > /etc/yum.repos.d/tuxcare-radar.repo < /etc/apt/sources.list.d/tuxcare-radar.list ``` You should now be able to install Radar as simply as running one of the following: RPM-based distributions (AlmaLinux, RHEL etc): ```text yum install tuxcare-radar ``` APT-based distributions (Debian, Ubuntu etc): ```text apt-get update apt-get install tuxcare-radar ``` If you do an in-place upgrade of your APT-based OS, you should change the version number in `/etc/apt/sources.list.d/tuxcare-radar.list` beforehand. ## Configuration You should have received your initial API key (something like `bc061b2b-c330-49f6-8953-849637d593ac`) along with your password. You will need to edit /etc/tuxcare-radar/radar.yaml on each server you wish to scan using Radar and insert your API key. In most instances we would recommend doing this via a centralised config-management tool such as Ansible or Puppet, but you could of course use `vim` or `sed` on the server itself, for example: ```text sed -i 's/apikey:.*/apikey: bc061b2b-c330-49f6-8953-849637d593ac/' /etc/tuxcare-radar/radar.yaml ``` By default the file will look like this, where `FILLME` should be replaced with your API key: ```text base-url: https://radar.tuxcare.com logfile: /var/log/tuxcare-radar/radar.log statefile: /var/cache/tuxcare-radar/radar.json time-between-runs: 23h enabled: true apikey: FILLME ``` If you are registered to the EU instance instead of the default US one, you should also change the `base-url` like so: ```text base-url: https://eu.radar.tuxcare.com ``` ## Cloning VM's You should always ensure that you `truncate -s 0 /etc/machine-id` before cloning a Linux VM, otherwise you'll have various problems with `dbus`, `systemd` and other key subsystems. If you have failed to do so and Radar won't allow you to scan your clones, you can work around this by using the `--node-id` commandline argument or more permanently by setting the `node-id` flag in /etc/tuxcare-radar/radar.yaml like so: ```text node-id: true ``` This will generate an ID using a different method that doesn't look at /etc/machine-id so your clones will now work. ## Tagging Tags are a powerful feature that let you easily identify and filter hosts based on tags. You can create tags to describe your environment, for example `prod`, `dev`, `staging` or the TuxCare products such as `esu`, `esa`, `kce`, or maybe location, such as `eu`, `us`, `apac`. To use tags, simply add them to /etc/tuxcare-radar/radar.yaml like so: ```text tags: esu,prod,us-east-1 ``` The next time a scan is run, the tags will appear in the asset overview. ## Firewall and Proxy Settings TuxCare Radar requires outbound connectivity on tcp/443 (TLS) to `radar.tuxcare.com` (default US instance) or `eu.radar.tuxcare.com` (EU instance). IPv6 or IPv4 can be used. No inbound connectivity is required, tuxcare-radar does not open any listening ports. To use via a proxy, set the `https_proxy` environment variable based on your infrastructure. For running the service from cron, you can use this: ```text echo "https_proxy=http://proxy.domain.com:port" >> /etc/environment ``` For running manually, you may need to set it in the user profile like so (or simply via the CLI): ```text echo "export https_proxy=http://proxy.domain.com:port" > /etc/profile.d/proxy.sh ``` ## Proxying via ePortal If you are an [ePortal](/eportal) user, you can proxy Radar via ePortal instead of configuring a dedicated proxy as above. In /etc/tuxcare-radar/radar.yaml change the `base-url` to point to your eportal server with a trailing `/radar`, for example: ```text #base-url: https://radar.tuxcare.com base-url: https://eportal.example.com/radar ``` Then on your ePortal server, update /etc/eportal/config with the following: ```text RADAR_PROXY_ENABLE = True ``` If you are registered to the EU instance instead of the default US one, you should also add the following (remove/comment the line to revert to the US instance): ```text RADAR_PROXY_BASEURL = 'https://eu.radar.tuxcare.com' ``` Then restart ePortal: ```text systemctl restart eportal ``` When it is working, you will see messages like the following, mentioning the ePortal URL in /var/log/tuxcare-radar/radar.log on your TuxCare Radar client: ```text radar INFO: fetching oval file from https://eportal.example.com/radar/oval/alma/9.5?fips=false&oval=0 radar INFO: fetching oval file from https://eportal.example.com/radar/oval/alma/9.5?fips=false&oval=1 radar INFO: sending output to https://eportal.example.com/radar ``` ## Usage The installer should have created an /etc/cron.d/tuxcare-radar file that will run from a randomized time every 6 hours, it will check if a scan has been run in the last 23 hours (`time-between-runs` in radar.yaml) and if not, it will run a scan. If you need to manually run a scan instantly for any reason, you can run: ```text su -s /bin/bash nobody -c "tuxcare-radar --config /etc/tuxcare-radar/radar.yaml" ``` If you would like to run a CIS benchmark compliance scan, you can run the following as root: ```text tuxcare-radar securescan --config /etc/tuxcare-radar/radar.yaml ``` Then visit [https://radar.tuxcare.com](https://radar.tuxcare.com/) (US) or [https://eu.radar.tuxcare.com](https://eu.radar.tuxcare.com/) (EU) to view the results. ================================================================================ Source: https://docs.tuxcare.com/securechain/ ================================================================================ # SecureChain for Open Source Software ## What SecureChain Covers * Verified, signed builds from trusted sources * Coverage that continues after upstream end of life * A single registry your developers and CI already know how to talk to ## Vulnerability Coverage and Target Response Times TuxCare employs the Common Vulnerability Scoring System (CVSS) to assess the severity of security vulnerabilities. Our severity rating system for patching vulnerabilities integrates both NVD scoring and vendor scoring (when available). When the vendor's score is lower than the NVD score, we prioritize the NVD score. Aligning with many industry standards and regulatory requirements, TuxCare is committed to delivering timely security updates. For instance, the Payment Card Industry Data Security Standard (PCI DSS) mandates that all 'High' vulnerabilities (CVSS score of 7.0+) must be addressed within 30 days. Other regulations and standards, such as the Health Insurance Portability and Accountability Act (HIPAA) for healthcare or the Federal Information Security Management Act (FISMA) for government agencies, uphold similar requirements. * **Vulnerability coverage.** TuxCare provides security patches for critical (CVSS 9.0+), high (CVSS 7.0–8.9), medium (CVSS 4.0–6.9), and low (CVSS below 4.0) vulnerabilities. TuxCare reserves the right to offer a mitigation strategy as an alternative to a direct code fix. * **Response time.** Target response times depend on where a package sits in its lifecycle — whether upstream is still releasing fixes, or TuxCare is maintaining the package after upstream activity has stopped. TuxCare will make commercially reasonable efforts to adhere to the following guidelines: | Severity | Maintenance *(from upstream fix)* | Sustained *(from CVE publication)* | Endless Lifecycle Support *(from CVE publication)* | | :-- | :-: | :-: | :-: | | Critical (CVSS 9.0+) | 7 days | 14 days | 14 days | | High (CVSS 7.0–8.9) | 14 days | 21 days | 14 days | | Medium (CVSS 4.0–6.9) | 30 days | 60 days | 60 days | | Low (CVSS below 4.0) | 60 days | 90 days | 90 days | These cycles reflect how a package is supported over time: * **Maintenance** — upstream is actively releasing fixes (an upstream release within the last 180 days). Response times are measured from the upstream fix. * **Sustained** — once there have been 90 days with no upstream release, TuxCare maintains the package directly. Response times are measured from CVE publication. * **Endless Lifecycle Support (ELS)** — from day 181 of no upstream release onward, TuxCare provides continued patching under ELS. Response times are measured from CVE publication. ## Incident Reporting and Response Timeframe Customers can report vulnerabilities by submitting a ticket through the [TuxCare Support Portal](https://tuxcare.com/support-portal/). TuxCare commits to providing an initial response to any reported issue within 3 days. Requests for customer-directed security patches for CVEs that are outside of the SecureChain scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 60 days. Handling Multiple Vulnerabilities: In cases where several CVEs are reported simultaneously for fixing, TuxCare will discuss and agree upon resolution timelines separately with the customer. ## Enhanced Transparency & Visibility TuxCare's commitment to transparency and visibility is foundational to our SecureChain offering. We provide verifiable metadata that helps customers understand package composition, software provenance, and vulnerability impact across the software supply chain. * **SLSA Compliance**: TuxCare packages are built and signed to support verifiable Supply-chain Levels for Software Artifacts (SLSA) compliance at Level 2 at launch, with Level 3 on the roadmap. Builds run from vetted sources, include attestations for dependencies, and undergo continuous testing to maintain integrity and trust. * **Software Bill of Materials (SBOM)**: Machine-readable SBOMs provide visibility into package composition and dependencies, supporting software supply chain transparency and accountability. Depending on the package, SBOMs are provided in industry-standard formats — SPDX and CycloneDX. See [Machine-Readable Security Data](./machine-readable-security-data/) for current availability. Note: SBOM availability for certain components is still expanding and may vary by package. Contact [sales@tuxcare.com](mailto:sales@tuxcare.com) for current availability details. * **Vulnerability Exploitability eXchange (VEX)**: Machine-readable VEX documents provide contextual vulnerability information, helping teams understand which known CVEs affect specific package versions and reduce remediation noise. VEX is published in standard formats, including CycloneDX VEX. See [Machine-Readable Security Data](./machine-readable-security-data/) for the feed URL and details. * **Verifiable Integrity and Provenance**: Packages and metadata provide end-to-end provenance information, helping customers verify how software was built, tested, and distributed. * **Secure Distribution**: Signed packages and associated metadata are distributed through TuxCare-managed infrastructure to ensure authenticity and integrity. ## Support Duration TuxCare provides continuous security patching for all SecureChain-supported open-source packages for as long as your organization requires them, eliminating the need for rushed or disruptive upgrades. All updates are delivered at a fixed price for the full term of your contract, ensuring predictable costs and uninterrupted protection. ## Technical Support TuxCare provides technical support according to the standard [support policy](https://tuxcare.com/TuxCare-support-policy.pdf). It delivers 24/7/365 access to TuxCare's support team through the [TuxCare Support Portal](https://tuxcare.com/support-portal/) and to TuxCare's online knowledge base. * ![](/images/shield-alert.webp) [Machine-Readable Security Data](./machine-readable-security-data/) — SBOM and VEX feeds, formats, and consumption guidance * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates ================================================================================ Source: https://docs.tuxcare.com/securechain/javascript/ ================================================================================ # JavaScript SecureChain delivers verified, signed, continuously patched JavaScript packages from a TuxCare-managed npm registry. Packages install with standard `npm` tooling and continue to receive CVE patches after upstream end of life. ## Installation * TuxCare SecureChain registry token — contact [sales@tuxcare.com](mailto:sales@tuxcare.com) * An npm project with `package.json`. If you're starting from scratch, run `npm init -y` in your project directory to create one. * To browse available packages, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:js-securechain) and sign in. You may need to refresh the page after logging in. 1. Connect to the SecureChain registry In the root directory of your project, create or edit `.npmrc` to point npm at the SecureChain registry and provide your token: ```text registry=https://nexus.repo.tuxcare.com/repository/js-securechain/ //nexus.repo.tuxcare.com/repository/js-securechain/:_auth= always-auth=true ``` Replace `` with your SecureChain registry token (see [Prerequisites](#prerequisites) above). 2. Install your dependencies Run this command from the project root directory, where the package.json file containing your dependencies is located: ```text npm install ``` You can keep the package names and versions in `package.json` as they are. `npm` is now pointed at SecureChain from the previous step, so the packages are pulled automatically from the TuxCare Nexus. For the list of available packages and versions, visit TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:js-securechain). ## Troubleshooting If `npm install` resolves to the public registry instead of SecureChain, use the commands below to verify that npm is reading your `.npmrc` and that the token is accepted. * **Confirm the active registry** ```text npm config get registry ``` The output must be `https://nexus.repo.tuxcare.com/repository/js-securechain/`. If it returns `https://registry.npmjs.org/`, npm is not reading your project `.npmrc` - check that you are running npm from the project root and that no user-level `~/.npmrc` is overriding it. * **Confirm authentication and connectivity** ```text npm whoami npm ping ``` `npm whoami` confirms the token resolves to a Nexus user. `npm ping` confirms the registry is reachable with that token. Failures here usually mean a missing, malformed, or revoked `_auth` value in `.npmrc`. ## What's Next? * ![](/images/shield-alert.webp) [VEX feed](https://security.tuxcare.com/vex/cyclonedx/) — Vulnerability Exploitability eXchange feed * ![](/images/eye.webp) [CVE Tracker](https://tuxcare.com/cve-tracker/) — Track vulnerability fixes and updates * ![](/images/wrench.webp) [Managing the SecureChain repository](/securechain/managing-securechain-repository/) — Upgrade to a newer version ================================================================================ Source: https://docs.tuxcare.com/securechain/managing-securechain-repository/ ================================================================================ # Managing the SecureChain repository This page describes how to upgrade an already-installed SecureChain package to a newer release. ## How to Upgrade to a Newer Version 1. Check your TuxCare [Nexus](https://nexus.repo.tuxcare.com/#browse/browse:js-securechain) account for the latest version available for each SecureChain package. 2. To upgrade, install the new version of the package — `npm install` will replace the previously installed release: ```text npm install @ ``` If `npm install` does not pick up the new version, clear the npm cache and reinstall: ```text rm -rf node_modules package-lock.json && npm cache clean --force npm install ``` ================================================================================ Source: https://docs.tuxcare.com/service-descriptions/ ================================================================================ # Service Descriptions ## Essential and Enhanced Support The description of Essential and Enhanced Support can be found [here](/enterprise-support-for-almalinux/#essential-and-enhanced-support). ================================================================================ Source: https://docs.tuxcare.com/service-descriptions/tam/ ================================================================================ # Technical Account Manager ## Technical Account Manager (TAM) A Technical Account Manager (TAM) is an extension to TuxCare products to enhance product and support experience. * TuxCare provides a technical account manager who can perform the following tasks for up to 8 hours per week. * Provides best-in-practice configuration assistance. * Provides product presentation and training. * Participate in calls every other week identifying and addressing the customer's operational issues related to the TuxCare products. * Organise multi-vendor issue coordination through TuxCare's partners when applicable. * The TAM is available for customer requests during regular working hours for the TAM. Outside working hours support is provided through regular TuxCare support. ## Dedicated Technical Account Manager (dTAM) A dedicated Technical Account Manager (dTAM) is an extension to TuxCare products to enhance the product and support experience. * TuxCare provides a dedicated technical account manager who can perform the following tasks for up to 40 hours per week. * Acts as a primary point of contact for all TuxCare product-related requests from the customer. * Provides best-in-practice configuration assistance. * Provides product presentation and training. * Can assume maintenance and configuration tasks of TuxCare products on the agreement. * Participate in calls every other week identifying and addressing the customer's operational issues related to the TuxCare products. * Organise multi-vendor issue coordination through TuxCare's partners when applicable. * Facilitate integration of customer's ticketing system with TuxCare's when applicable. * Attend applicable TuxCare training and development activities. * The dTAM is available for customer requests during regular working hours for the dTAM and is subject to TuxCare leave policies. Outside working hours support is provided through regular TuxCare support. * The dTAM will visit the customer's site annually or twice per year according to the agreement. * If the dTAM is on annual leave for more than 5 consequent days, TuxCare will assign a temporary account manager. ================================================================================ Source: https://docs.tuxcare.com/tuxcare-cln/ ================================================================================ # Subscription management portal The TuxCare subscription management portal is designed to easily manage your licenses of TuxCare products and services by means of a user-friendly interface. ## Introduction The following are available in TuxCare portal: * Add, delete and edit licenses * Add, delete and edit servers * Choose payment methods and buy licenses * Track all the associated costs ### Create new account If you are a first time user, go to [https://portal.tuxcare.com](https://portal.tuxcare.com/register/customer?originUrl=%2Fdashboard%2Fproducts) and fill in the simple registration form to create your account. You will find your login and password in your welcome email. ### Log in Go to [https://portal.tuxcare.com](https://portal.tuxcare.com/auth/login?originUrl=%2Fdashboard%2Fproducts) and sign in with your credentials. ## Dashboard Dashboard helps quickly navigate to your _Products_. It has the following tabs: * [Products](/tuxcare-cln/#products) * [Servers](/tuxcare-cln/#servers) ### Products Click _Dashboard_. You will be redirected to the _My Products_ page. ![](/images/dashboard.png) The following actions are available: * **Manage licenses and billing cycle**. Click the link to contact our Sales team to change license quantity and product quota, and to manage the billing cycle. * **Manage activation keys**. Shortcut to the [Extended Support Services | Activation Keys](/tuxcare-cln/#activation-keys) page. ### Servers Click _Dashboard → Servers_ to go to _All Servers_ page. A list of all servers with installed products belonged to this account is available. ![](/images/allservers.png) The table includes all servers that have been activated in all products within the account. The table contains the following columns: * **Server name** — server hostname * **IP** — server IP address * **Registered** — a date when a server was activated. A server sends this information to TuxCare portal * **Group** – server group (please refer to the [TuxCare portal documentation](https://docs.cln.cloudlinux.com/dashboard/#server-groups) to find more information about server group) * **Installed products** — shows a logo of a product activated on a server * **Actions** * To remove an item, click on ![](/images/remove.png) Click the server name to show server details: * **Installed products** – the full name of the installed products * **Last check-in** — the last date when a server successfully responded to check-in The following filters are available: * **Product** — click _Product_ button and select one or more products * **Registered date** — click _Registered date_ to display a calendar where you can pick a date or a period to filter by * **Search** — type a query. A search is performed in _Server name_ and _Activation key_ entities ## Live Patching Services Click _Live Patching Services_ You will be redirected to the _Server License Types_ page. ![](/images/serverlicensetypes.png) Here you can see the number of server licenses and manage licenses and billing cycle by contacting TuxCare Sales team. ## Extended Support Services Click _Extended Support Services_ You will be redirected to the _Server License Types_ page. ![](/images/serverlicensetypes1.png) ### Server License Types Here you can see the the number of server licenses for each product. * **Manage servers** – shortcut to the [Servers | Selected product](/tuxcare-cln/#servers-2) page * **Manage activation keys** – shortcut to the [Activation Keys | Selected product](/tuxcare-cln/#activation-keys) page ### Activation Keys Click _Extended Support Services → Activation Keys_. You will be redirected to the _Activation Keys_ page. ![](/images/activationkeys.png) **Activation Key** is a string of numbers and letters used to activate a product. The table includes all activation keys for all products within the account. The table contains the following columns: * **Activation key** – is a string of numbers and letters used to activate a product * **License type** — a type of server license that is used and determines a limit of server users * **Note** — any information you’ve added to this activation key * **Servers (used/limits)** – a number of servers that have already been activated with this key (used) and a total number of servers that can be registered with this particular key (limits) * **Tick** – tick an activation key or keys to perform a remove action (use ![](/images/delete.png)) The default activation key cannot be deleted. The following filters are available: * **Server limits** — filter by server limit/unlimited * **License type** — filter by license type Click an activation key to go to this [Activation Key Details](/tuxcare-cln/#activation-key-details) page. #### Activation Keys by product Click _Extended Support Services → Activation Keys → Product_. You will be redirected to the _Product Activation Keys_ page. ![](/images/productactivationkeypage.png) * If there are no activation keys for the product, you can create one by clicking the _Create activation key_. * If there is the default activation key for the product, you can generate a new one by clicking the _Generate new activation key_. A new key will be created automatically and added to the table. * You can copy an activation key by clicking _Copy_. The table includes all activation keys for the product. The table contains the following columns: * **Activation key** – is a string of numbers and letters used to activate a product * **Note** — any information you’ve added to this activation key * **Servers (used/limits)** – a number of servers that have already been activated with this key (used) and a total number of servers that can be registered with this particular key (limits) To remove a key, select it and click ![](/images/delete.png). The following filters are available: * **Server limits** — filter by server limit/unlimited * **Search** Click a key to go to the _Activation Key Details_ page for this key. #### Activation Key Details ![](/images/activationkeydetails.png) Here you can: * See the activation key complete information * Edit key. Click _Edit key_ * Remove key. Click ![](/images/delete1.png) * Review _Servers List_ The table includes all servers registered with the key. The table contains the following columns: * **Server name** — server hostname * **IP** — server IP address * **Registered** — a date when a server was activated. A server sends this information to TuxCare portal * **Last check-in** — the last date when a server successfully responded to check-in The following filters are available: * **Server limits** — filter by server limit/unlimited * **Search field** ### Servers Click _Extended Support Services → Servers_. You will be redirected to the _Servers_ page. ![](/images/servers.png) The table includes all servers activated for all products within Extended Lifecycle Support. The table contains the following columns: * **Server name** — server hostname * **IP** — server IP address * **Registered** — a date when a server was activated. A server sends this information to TuxCare portal * **Installed products** — shows a logo of a product activated on a server * **Actions** * To remove an item, click on ![](/images/remove.png) Click the server name to show server details: * **Installed products** – the full name of the installed products * **Last check-in** — the last date when a server successfully responded to check-in The following filters are available: * **Product** — click _Product_ button and select one or more products * **Registered date** — click _Registered date_ to display a calendar where you can pick a date or a period to filter by * **Search** — type a query #### Servers by product Click _Extended Support Services → Servers → Product_. You will be redirected to the _Product Servers_ page. ![](/images/productservers.png) The table includes all servers activated for the product within Extended Lifecycle Support. The table contains the following columns: * **Server name** — server hostname * **IP** — server IP address * **Registered** — a date when a server was activated. A server sends this information to TuxCare portal * **Installed products** — shows a logo of a product activated on a server * **Actions** * To remove an item, click on ![](/images/remove.png) Click the server name to show server details: * **Installed products** – the full name of the installed products * **Last check-in** — the last date when a server successfully responded to check-in The following filters are available: * **Registered date** — click _Registered date_ to display a calendar where you can pick a date or a period to filter by * **Search** — type a query You can download the servers list by clicking the _Get servers list_. ## Billing ### Balance and Top up Click _Billing_, you will be redirected to the _Balance and Top up_ page. ![](/images/billingmain.png) Here you find the following: * your current plan and prices * your balance You can top up your account by entering the amount and clicking _Top up_. ### Payment methods Click _Billing → Payment methods_, you will be redirected to the _Payment methods_ page. The following tabs are available: * **Billing information** * **Payment methods** * **Autopayment** #### Billing information ![](/images/billingcontacts.png) Here, you can change your email for billing. Click _Save_ to apply changes. #### Payment methods ![](/images/paymentmethods.png) Here, you can manage your payment method. Click _Save_ to apply changes. #### Autopayment ![](/images/autopayment.png) Here, you can change your autopayment type: * Auto add funds * Auto repay * Do not add funds automatically Click _Save_ to apply changes. ### Invoices ![](/images/invoices.png) The table contains the followings columns: * **Invoice id** – unique invoice number * **Created** — invoice issue date. * **Type** – type of payment: invoice or payment received * **Pay period** – the start date of the period for which the invoice was issued * **Total** — a total amount received/need to pay * **Balance** – the current balance * **Actions** — the following actions are available: * **View invoice** — click ![](/images/eye.png) to view invoice in-details. It opens in a new popup. * **Download invoice** — click ![](/images/download.png) to download an invoice. Click ![](/images/details.png) to view the invoice details. ## Settings To go to account details, click _User_ icon → _Settings_ in the top right corner. You will be redirected to the _Account details_ page. ![](/images/accountsettings.png) ### Account details The following tabs are available: * Personal information * Company information * Billing contact information #### Personal information ![](/images/personalinformation.png) All fields marked * are required. * **API secret key** – use this key with TuxCare portal API * **IM Upgrade URL** – URL for upgrade Imunify products if it is not the default one To change the password, click _Change password_. To enable two-factor authentication, move the slider to _On_. Click _Save_ to apply changes. #### Company information ![](/images/companyinformation.png) Click _Save_ to apply changes. #### Billing contact information ![](/images/billinginformation.png) Click _Save_ to apply changes. ### Account sublogins You can create additional logins for your account in the form of the email address. The sub login can have any role with different permissions listed below. A master Server Administrator account has the full scope of permissions; this role can create account sub logins. ![](/images/accountsublogins.png) Click _Save_ to apply changes. #### Roles #### Full Access/Admin * View products * View servers/licenses information * Reporting * Add/delete servers * Create activation keys * Order/delete licenses * View invoices * View billing information * Edit credit cards information * Edit account information * Edit billing information/top up for reseller * View prices * View account information * Change password #### Billing * View products * View server's/licenses information * View invoices * View billing information * Edit credit cards information * Edit account information * Edit billing information/top up for reseller * View prices * View account information #### Server and License Management * View products * View server's/licenses information * Reporting * Add/delete servers * Create activation keys * Order/delete licenses #### Server Management Only * View products * View server's/licenses information * Reporting * Add/delete servers * Create activation keys #### Read Only — Billing * View products * View server's/licenses information * Reporting * View invoices * View billing information #### Read Only — Server Management * View products * View server's/licenses information * Reporting ### Reports It is possible to set reports receiving for an account to the desired email address. ![](/images/reports.png) To add a new report configuration, click _Add config_. ================================================================================ Source: https://docs.tuxcare.com/tuxcare/ ================================================================================ # TuxCare The TuxCare services automate, simplify, and enhance Linux operations, giving organizations more flexibility in managing Linux distro choices and versions, significant maintenance cost reductions, and greatly enhanced security and compliance postures. TuxCare, which is an expansion of the CloudLinux’s KernelCare and Extended Lifecycle Support brands, helps organizations take care of support, maintenance, and security for Enterprise Linux systems. With [TuxCare Live Patching Services](/live-patching-services/), Linux kernels, libraries, databases, virtualizations and IoT devices receive automated security patches applied with zero downtime. Using the [TuxCare Endless Lifecycle Support](/endless-lifecycle-support/) services, you can migrate to the newest version of Linux at your own pace while maintaining protection from the common risks of running an end-of-life distro. [TuxCare Enterprise Support](/enterprise-support-for-almalinux/) provides a TuxCare-vetted repository of AlmaLinux and Rocky Linux updates with 16 years of support coverage. It also delivers an extended lifecycle with FIPS-compliant security patches for select minor versions and helps avoid costly upfront support package fees with pay-as-you-go hourly support bundles. Users requiring FIPS-certified Linux deployments can download and install our [Community FIPS packages for AlmaLinux 9.2](https://docs.tuxcare.com/enterprise-support-for-almalinux/fips/) (kernel and openssl) for free for non-commercial use. Commercial applications should use our [Extended Security Updates](https://docs.tuxcare.com/enterprise-support-for-almalinux/#extended-security-updates) product, which offers the full suite of five FIPS 140-3 modules (kernel, openssl, libcrypt, nss and gnutls), FIPS-compliant security updates, and technical support.