Skip to content

Commit

Permalink
chore(deps): update node.js to v20.8.1 (#546)
Browse files Browse the repository at this point in the history
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [node](https://togithub.com/nodejs/node) | final | patch |
`20.8.0-alpine3.17` -> `20.8.1-alpine3.17` |
| [node](https://togithub.com/nodejs/node) | stage | patch |
`20.8.0-alpine3.17` -> `20.8.1-alpine3.17` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v20.8.1`](https://togithub.com/nodejs/node/releases/tag/v20.8.1):
2023-10-13, Version 20.8.1 (Current), @&#8203;RafaelGSS

[Compare
Source](https://togithub.com/nodejs/node/compare/v20.8.0...v20.8.1)

This is a security release.

##### Notable Changes

The following CVEs are fixed in this release:

-
[CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487):
`nghttp2` Security Release (High)
-
[CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143):
`undici` Security Release (High)
-
[CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332):
Path traversal through path stored in Uint8Array (High)
-
[CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331):
Permission model improperly protects against path traversal (High)
-
[CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):
Integrity checks according to policies can be circumvented (Medium)
-
[CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333):
Code injection via WebAssembly export names (Low)

More detailed information on each of the vulnerabilities can be found in
[October 2023 Security
Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/)
blog post.

##### Commits

- \[[`c86883e844`](https://togithub.com/nodejs/node/commit/c86883e844)]
- **deps**: update nghttp2 to 1.57.0 (James M Snell)
[#&#8203;50121](https://togithub.com/nodejs/node/pull/50121)
- \[[`2860631359`](https://togithub.com/nodejs/node/commit/2860631359)]
- **deps**: update undici to v5.26.3 (Matteo Collina)
[#&#8203;50153](https://togithub.com/nodejs/node/pull/50153)
- \[[`cd37838bf8`](https://togithub.com/nodejs/node/commit/cd37838bf8)]
- **lib**: let deps require `node` prefixed modules (Matthew Aitken)
[#&#8203;50047](https://togithub.com/nodejs/node/pull/50047)
- \[[`f5c90b2951`](https://togithub.com/nodejs/node/commit/f5c90b2951)]
- **module**: fix code injection through export names (Tobias Nießen)
[nodejs-private/node-private#461](https://togithub.com/nodejs-private/node-private/pull/461)
- \[[`fa5dae1944`](https://togithub.com/nodejs/node/commit/fa5dae1944)]
- **permission**: fix Uint8Array path traversal (Tobias Nießen)
[nodejs-private/node-private#456](https://togithub.com/nodejs-private/node-private/pull/456)
- \[[`cd35275111`](https://togithub.com/nodejs/node/commit/cd35275111)]
- **permission**: improve path traversal protection (Tobias Nießen)
[nodejs-private/node-private#456](https://togithub.com/nodejs-private/node-private/pull/456)
- \[[`a4cb7fc7c0`](https://togithub.com/nodejs/node/commit/a4cb7fc7c0)]
- **policy**: use tamper-proof integrity check function (Tobias Nießen)
[nodejs-private/node-private#462](https://togithub.com/nodejs-private/node-private/pull/462)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/UK-Export-Finance/mdm-api).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xOS4yIiwidXBkYXRlZEluVmVyIjoiMzcuMTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
  • Loading branch information
renovate[bot] committed Oct 17, 2023
1 parent 0edb6ce commit 8f012d5
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# 1. BUILD
###################

FROM node:20.8.0-alpine3.17 AS build
FROM node:20.8.1-alpine3.17 AS build

# Alpine Linux install packages
RUN apk add bash curl
Expand Down Expand Up @@ -35,7 +35,7 @@ USER node
# 2. PRODUCTION
###################

FROM node:20.8.0-alpine3.17 AS production
FROM node:20.8.1-alpine3.17 AS production

WORKDIR /app

Expand Down

0 comments on commit 8f012d5

Please sign in to comment.