Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 25, 2022

Mend Renovate

This PR contains the following updates:

Package Update Change
node minor 18.6.0 -> 18.12.1

Release Notes

nodejs/node

v18.12.1: 2022-11-04, Version 18.12.1 'Hydrogen' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable changes

The following CVEs are fixed in this release:

  • CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
  • CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
  • CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.

Commits

v18.12.0: 2022-10-25, Version 18.12.0 'Hydrogen' (LTS), @​ruyadorno and @​RafaelGSS

Compare Source

Notable Changes

This release marks the transition of Node.js 18.x into Long Term Support (LTS)
with the codename 'Hydrogen'. The 18.x release line now moves into "Active LTS"
and will remain so until October 2023. After that time, it will move into
"Maintenance" until end of life in April 2025.

v18.11.0: 2022-10-13, Version 18.11.0 (Current), @​danielleadams

Compare Source

Notable changes
watch mode (experimental)

Running in 'watch' mode using node --watch restarts the process when an imported file is changed.

Contributed by Moshe Atlow in #​44366

Other notable changes
  • fs:
    • (SEMVER-MINOR) add FileHandle.prototype.readLines (Antoine du Hamel) #​42590
  • http:
    • (SEMVER-MINOR) add writeEarlyHints function to ServerResponse (Wing) #​44180
  • http2:
    • (SEMVER-MINOR) make early hints generic (Yagiz Nizipli) #​44820
  • lib:
    • (SEMVER-MINOR) refactor transferable AbortSignal (flakey5) #​44048
  • src:
    • (SEMVER-MINOR) add detailed embedder process initialization API (Anna Henningsen) #​44121
  • util:
    • (SEMVER-MINOR) add default value option to parsearg (Manuel Spigolon) #​44631
Commits

v18.10.0: 2022-09-28, Version 18.10.0 (Current), @​RafaelGSS

Compare Source

Notable changes
  • doc:
    • (SEMVER-MINOR) deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #​44588
    • add legendecas to TSC list (Michael Dawson) #​44662
    • move policy docs to the permissions scope (Rafael Gonzaga) #​44222
  • gyp:
    • libnode for ios app embedding (chexiongsheng) #​44210
  • http:
    • (SEMVER-MINOR) throw error on content-length mismatch (sidwebworks) #​44588
  • stream:
    • (SEMVER-MINOR) add ReadableByteStream.tee() (Daeyeon Jeong) #​44505
Commits

v18.9.1: 2022-09-23, Version 18.9.1 (Current), @​RafaelGSS

Compare Source

This is a security release.

Notable changes

The following CVEs are fixed in this release:

  • CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
    • Insufficient fix for macOS devices on v18.5.0
  • CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
  • CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
    • Insufficient fix on v18.5.0
  • CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
    • Insufficient fix on v18.5.0
  • CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
  • CVE-2022-35255: Weak randomness in WebCrypto keygen

More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.

llhttp updated to 6.0.10

llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities.

  • HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
  • HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
  • HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
Commits

v18.9.0: 2022-09-08, Version 18.9.0 (Current), @​RafaelGSS

Compare Source

Notable changes
  • doc
    • add daeyeon to collaborators (Daeyeon Jeong) #​44355
  • lib
    • (SEMVER-MINOR) add diagnostics channel for process and worker (theanarkh) #​44045
  • os
    • (SEMVER-MINOR) add machine method (theanarkh) #​44416
  • report
    • (SEMVER-MINOR) expose report public native apis (Chengzhong Wu) #​44255
  • src
    • (SEMVER-MINOR) expose environment RequestInterrupt api (Chengzhong Wu) #​44362
  • vm
    • include vm context in the embedded snapshot (Joyee Cheung) #​44252
Commits

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from prisis as a code owner October 25, 2022 01:35
@renovate renovate bot force-pushed the renovate/node-18.x branch 5 times, most recently from d00591b to 4d28a9f Compare October 26, 2022 00:12
@renovate renovate bot changed the title chore(deps): update node.js to v18.11.0 chore(deps): update node.js to v18.12.0 Oct 26, 2022
@renovate renovate bot force-pushed the renovate/node-18.x branch 11 times, most recently from 1c412a8 to 2dccef9 Compare November 2, 2022 02:20
@renovate renovate bot force-pushed the renovate/node-18.x branch 6 times, most recently from d6d704b to fc92e7c Compare November 4, 2022 20:35
@renovate renovate bot changed the title chore(deps): update node.js to v18.12.0 chore(deps): update node.js to v18.12.1 Nov 4, 2022
@renovate renovate bot force-pushed the renovate/node-18.x branch from fc92e7c to 15dbe74 Compare November 4, 2022 23:46
@renovate renovate bot force-pushed the renovate/node-18.x branch from 15dbe74 to 18909a4 Compare November 6, 2022 10:04
@github-actions github-actions bot added the Stale label Nov 29, 2022
@github-actions github-actions bot closed this Dec 7, 2022
@renovate
Copy link
Contributor Author

renovate bot commented Dec 7, 2022

Renovate Ignore Notification

As this PR has been closed unmerged, Renovate will now ignore this update (18.12.1). You will still receive a PR once a newer version is released, so if you wish to permanently ignore this dependency, please add it to the ignoreDeps array of your renovate config.

If this PR was closed by mistake or you changed your mind, you can simply rename this PR and you will soon get a fresh replacement PR opened.

@renovate renovate bot deleted the renovate/node-18.x branch December 7, 2022 00:20
@github-actions
Copy link
Contributor

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using our GitHub Discussions tab for questions.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 26, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant