Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update node.js #43

Merged
merged 1 commit into from
Dec 5, 2019
Merged

chore(deps): update node.js #43

merged 1 commit into from
Dec 5, 2019

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Nov 11, 2018

This PR contains the following updates:

Package Type Update Change
node engines minor 9.4.0 -> 9.11.2
node final minor 9.4.0-alpine -> 9.11.2-alpine

Release Notes

nodejs/node

v9.11.2

Compare Source

Notable Changes
  • Fixes memory exhaustion DoS (CVE-2018-7164): Fixes a bug introduced in 9.7.0 that increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream.
  • buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang
  • http2
    • (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup
    • (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0
  • tls (CVE-2018-7162): Fixes Denial of Service vulnerability by updating the TLS implementation to not crash upon receiving
Commits

v9.11.1

Compare Source

Notable Changes

No additional commits.

An infrastructure issue caused a non-functioning msi installer for x64 to be promoted.
The patch release is to ensure that all binaries and installers work as expected.

v9.11.0

Compare Source

Notable Changes
  • deps:
    • Updated ICU to 61.1 (Steven R. Loomis) #​19621
      Includes CLDR 33 (many new languages and data improvements).
  • fs:
    • Emit 'ready' event for ReadStream and WriteStream (Sameer Srivastava) #​19408
  • n-api:
    • Bump version of n-api supported (Michael Dawson) #​19497
  • net:
    • Emit 'ready' event for Socket (Sameer Srivastava) #​19408
  • Added new collaborators
Commits

v9.10.1

Compare Source

Notable Changes

No additional commits.

Due to incorrect staging of the upgrade to the GCC 4.9.X compiler, the latest releases for PPC little
endian were built using GCC 4.9.X instead of GCC 4.8.X. This caused an ABI breakage on PPCLE based
environments. This has been fixed in our infrastructure and we are doing this release to ensure that
the hosted binaries are adhering to our platform support contract.

Note that Node.js versions 10.X and later will be built with version 4.9.X or later of the GCC compiler,
and it is possible that Node.js version 9.X may be built on the 4.9.X compiler at a later
time as the stated minimum compiler requirement
for Node.js version 9.X is 4.9.4.

v9.10.0

Compare Source

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes
  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.

  • Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6.

  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.

  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.

  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

  • cluster:

    • Add support for NODE_OPTIONS="--inspect" (Sameer Srivastava) #​19165
  • crypto:

    • Expose the public key of a certificate (Hannes Magnusson) #​17690
  • n-api:

    • Add napi_fatal_exception to trigger an uncaughtException in JavaScript (Mathias Buus) #​19337
  • path:

    • Fix regression in posix.normalize (Michaël Zasso) #​19520
  • stream:

    • Improve stream creation performance (Brian White) #​19401
  • Added new collaborators

Commits

v9.9.0

Compare Source

Notable Changes
  • assert:
    • From now on all error messages produced by assert in strict mode will produce a error diff. (Ruben Bridgewater) #​17615
    • From now on it is possible to use a validation object in throws instead of the other possibilities. (Ruben Bridgewater) #​17584
  • crypto:
    • allow passing null as IV unless required (Tobias Nießen) #​18644
  • fs:
    • support as and as+ flags in stringToFlags() (Sarat Addepalli) #​18801
  • tls:
    • expose Finished messages in TLSSocket (Anton Salikhmetov) #​19102
  • tty:
    • Add getColorDepth function to determine if terminal supports colors. (Ruben Bridgewater) #​17615
  • util:
    • add util.inspect compact option (Ruben Bridgewater) #​17576
  • Added new collaborators
Commits

Renovate configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "rebase!".

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

Newsflash: Renovate has joined WhiteSource, and is now free for all use. Learn more or view updated terms and privacy policies.

@renovate renovate bot changed the title Update Node.js to v9.11.2 chore(deps): update node.js to v9.11.2 Nov 11, 2018
@renovate renovate bot changed the title chore(deps): update node.js to v9.11.2 chore(deps): update node.js Jun 19, 2019
@cheezenaan cheezenaan merged commit 47b8884 into master Dec 5, 2019
@renovate renovate bot deleted the renovate/node-9.x branch December 5, 2019 14:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants