Updated Node To v18.16.1

[JamieB-gu]

Why?

Bringing Node to the latest version of v18.x.x as described in the changelog¹. Used the changes in #7948 as a reference. I'll also be bumping the two AMIs, but no changes are reflected here as the recipe names will remain the same.

Changes

• Updated .nvmrc and Containerfile for local development and CI.
• Also updated @types/node to latest. The patch version doesn't match the node patch version because DefinitelyTyped packages don't synchronise their patch versions with packages².

Footnotes

1. https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md ↩

2. https://github.com/DefinitelyTyped/DefinitelyTyped#how-do-definitely-typed-package-versions-relate-to-versions-of-the-corresponding-library ↩

[github-actions]

Size Change: 0 B

Total Size: 571 kB

ℹ️ View Unchanged

Filename	Size
dotcom-rendering/dist/1238.modern.********************.js	3.07 kB
dotcom-rendering/dist/1813.modern.********************.js	6.52 kB
dotcom-rendering/dist/2006.modern.********************.js	3.84 kB
dotcom-rendering/dist/2243.modern.********************.js	3.08 kB
dotcom-rendering/dist/2854.modern.********************.js	3.3 kB
dotcom-rendering/dist/3250.modern.********************.js	3.56 kB
dotcom-rendering/dist/3398.modern.********************.js	20 kB
dotcom-rendering/dist/3577.modern.********************.js	4.51 kB
dotcom-rendering/dist/3911.modern.********************.js	3.16 kB
dotcom-rendering/dist/3993.modern.********************.js	6.21 kB
dotcom-rendering/dist/4331.modern.********************.js	3.36 kB
dotcom-rendering/dist/5153.modern.********************.js	2.28 kB
dotcom-rendering/dist/516.modern.********************.js	17.5 kB
dotcom-rendering/dist/5182.modern.********************.js	3.9 kB
dotcom-rendering/dist/5237.modern.********************.js	2.44 kB
dotcom-rendering/dist/6297.modern.********************.js	21.3 kB
dotcom-rendering/dist/6633.modern.********************.js	3.22 kB
dotcom-rendering/dist/6814.modern.********************.js	5.4 kB
dotcom-rendering/dist/6939.modern.********************.js	5.36 kB
dotcom-rendering/dist/7392.modern.********************.js	2.49 kB
dotcom-rendering/dist/7844.modern.********************.js	4.8 kB
dotcom-rendering/dist/7872.modern.********************.js	1.89 kB
dotcom-rendering/dist/8012.modern.********************.js	4.66 kB
dotcom-rendering/dist/8326.modern.********************.js	2.55 kB
dotcom-rendering/dist/8452.modern.********************.js	4.28 kB
dotcom-rendering/dist/8780.modern.********************.js	3.16 kB
dotcom-rendering/dist/8888.modern.********************.js	2.75 kB
dotcom-rendering/dist/9463.modern.********************.js	543 B
dotcom-rendering/dist/9470.modern.********************.js	28.8 kB
dotcom-rendering/dist/9500.modern.********************.js	10.8 kB
dotcom-rendering/dist/9571.modern.********************.js	3.91 kB
dotcom-rendering/dist/9861.modern.********************.js	3.5 kB
dotcom-rendering/dist/9874.modern.********************.js	5.06 kB
dotcom-rendering/dist/AlreadyVisited-importable.modern.********************.js	410 B
dotcom-rendering/dist/AnimatePulsingDots-importable.modern.********************.js	389 B
dotcom-rendering/dist/atomIframe.modern.********************.js	516 B
dotcom-rendering/dist/AudioAtomWrapper-importable.modern.********************.js	463 B
dotcom-rendering/dist/AustralianTerritorySwitcher-importable.modern.********************.js	1.14 kB
dotcom-rendering/dist/Branding-importable.modern.********************.js	2.18 kB
dotcom-rendering/dist/braze-web-sdk-core.modern.********************.js	36.9 kB
dotcom-rendering/dist/BrazeMessaging-importable.modern.********************.js	5.24 kB
dotcom-rendering/dist/CalloutBlockComponent-importable.modern.********************.js	6.46 kB
dotcom-rendering/dist/CalloutEmbedBlockComponent-importable.modern.********************.js	6.59 kB
dotcom-rendering/dist/Carousel-importable.modern.********************.js	5.28 kB
dotcom-rendering/dist/ChartAtomWrapper-importable.modern.********************.js	474 B
dotcom-rendering/dist/CommentCount-importable.modern.********************.js	2.77 kB
dotcom-rendering/dist/discussion.modern.********************.js	393 B
dotcom-rendering/dist/DiscussionContainer-importable.modern.********************.js	4.29 kB
dotcom-rendering/dist/DiscussionMeta-importable.modern.********************.js	3.35 kB
dotcom-rendering/dist/DocumentBlockComponent-importable.modern.********************.js	2.72 kB
dotcom-rendering/dist/EmbedBlockComponent-importable.modern.********************.js	3.25 kB
dotcom-rendering/dist/embedIframe.modern.********************.js	520 B
dotcom-rendering/dist/EnhancePinnedPost-importable.modern.********************.js	1.93 kB
dotcom-rendering/dist/FetchCommentCounts-importable.modern.********************.js	2.97 kB
dotcom-rendering/dist/FetchOnwardsData-importable.modern.********************.js	2.01 kB
dotcom-rendering/dist/FilterKeyEventsToggle-importable.modern.********************.js	3.41 kB
dotcom-rendering/dist/FocusStyles-importable.modern.********************.js	511 B
dotcom-rendering/dist/frameworks.modern.********************.js	20.5 kB
dotcom-rendering/dist/GetCricketScoreboard-importable.modern.********************.js	3.36 kB
dotcom-rendering/dist/GetMatchNav-importable.modern.********************.js	11.4 kB
dotcom-rendering/dist/GetMatchStats-importable.modern.********************.js	6.32 kB
dotcom-rendering/dist/GetMatchTabs-importable.modern.********************.js	2.42 kB
dotcom-rendering/dist/guardian-braze-components-banner.modern.********************.js	13.3 kB
dotcom-rendering/dist/guardian-braze-components-end-of-article.modern.********************.js	10.3 kB
dotcom-rendering/dist/GuideAtomWrapper-importable.modern.********************.js	476 B
dotcom-rendering/dist/HeaderTopBar-importable.modern.********************.js	10.5 kB
dotcom-rendering/dist/index.modern.********************.js	33.3 kB
dotcom-rendering/dist/InstagramBlockComponent-importable.modern.********************.js	2.79 kB
dotcom-rendering/dist/InteractiveBlockComponent-importable.modern.********************.js	5.8 kB
dotcom-rendering/dist/InteractiveContentsBlockComponent-importable.modern.********************.js	4.09 kB
dotcom-rendering/dist/InteractiveSupportButton-importable.modern.********************.js	3.82 kB
dotcom-rendering/dist/KeyEventsCarousel-importable.modern.********************.js	2.21 kB
dotcom-rendering/dist/KnowledgeQuizAtomWrapper-importable.modern.********************.js	481 B
dotcom-rendering/dist/LatestLinks-importable.modern.********************.js	1.85 kB
dotcom-rendering/dist/LiveBlogEpic-importable.modern.********************.js	5.08 kB
dotcom-rendering/dist/Liveness-importable.modern.********************.js	5.52 kB
dotcom-rendering/dist/ManyNewsletterSignUp-importable.modern.********************.js	5.62 kB
dotcom-rendering/dist/MapEmbedBlockComponent-importable.modern.********************.js	5.32 kB
dotcom-rendering/dist/Metrics-importable.modern.********************.js	2.46 kB
dotcom-rendering/dist/MostViewedFooter-importable.modern.********************.js	5.36 kB
dotcom-rendering/dist/MostViewedFooterData-importable.modern.********************.js	7.55 kB
dotcom-rendering/dist/MostViewedRightWrapper-importable.modern.********************.js	3.78 kB
dotcom-rendering/dist/newsletterEmbedIframe.modern.********************.js	621 B
dotcom-rendering/dist/OnwardsUpper-importable.modern.********************.js	3.9 kB
dotcom-rendering/dist/PersonalityQuizAtomWrapper-importable.modern.********************.js	483 B
dotcom-rendering/dist/ProfileAtomWrapper-importable.modern.********************.js	478 B
dotcom-rendering/dist/QandaAtomWrapper-importable.modern.********************.js	475 B
dotcom-rendering/dist/ReaderRevenueDev-importable.modern.********************.js	461 B
dotcom-rendering/dist/readerRevenueDevUtils.modern.********************.js	2.71 kB
dotcom-rendering/dist/ReaderRevenueLinks-importable.modern.********************.js	5.57 kB
dotcom-rendering/dist/RecipeMultiplier-importable.modern.********************.js	3.23 kB
dotcom-rendering/dist/relativeTime.modern.********************.js	976 B
dotcom-rendering/dist/RichLinkComponent-importable.modern.********************.js	5.05 kB
dotcom-rendering/dist/SecureSignupIframe-importable.modern.********************.js	2.54 kB
dotcom-rendering/dist/SendAMessage-importable.modern.********************.js	4.37 kB
dotcom-rendering/dist/sentry.modern.********************.js	766 B
dotcom-rendering/dist/SetABTests-importable.modern.********************.js	3.88 kB
dotcom-rendering/dist/ShareCount-importable.modern.********************.js	2.91 kB
dotcom-rendering/dist/shimport.modern.********************.js	2.78 kB
dotcom-rendering/dist/ShowHideContainers-importable.modern.********************.js	719 B
dotcom-rendering/dist/ShowMore-importable.modern.********************.js	5.05 kB
dotcom-rendering/dist/SignInGateMain.modern.********************.js	2.93 kB
dotcom-rendering/dist/SignInGateMainCheckoutComplete.modern.********************.js	3.84 kB
dotcom-rendering/dist/SignInGateSelector-importable.modern.********************.js	3.68 kB
dotcom-rendering/dist/SlotBodyEnd-importable.modern.********************.js	2.86 kB
dotcom-rendering/dist/Snow-importable.modern.********************.js	4.26 kB
dotcom-rendering/dist/SpotifyBlockComponent-importable.modern.********************.js	5.17 kB
dotcom-rendering/dist/StickyBottomBanner-importable.modern.********************.js	3.95 kB
dotcom-rendering/dist/SubNav-importable.modern.********************.js	2.34 kB
dotcom-rendering/dist/SupportTheG-importable.modern.********************.js	5.68 kB
dotcom-rendering/dist/TableOfContents-importable.modern.********************.js	3.08 kB
dotcom-rendering/dist/TimelineAtomWrapper-importable.modern.********************.js	476 B
dotcom-rendering/dist/TopRightAdSlot-importable.modern.********************.js	631 B
dotcom-rendering/dist/TweetBlockComponent-importable.modern.********************.js	1 kB
dotcom-rendering/dist/UnsafeEmbedBlockComponent-importable.modern.********************.js	2.8 kB
dotcom-rendering/dist/VideoFacebookBlockComponent-importable.modern.********************.js	5.33 kB
dotcom-rendering/dist/VineBlockComponent-importable.modern.********************.js	2.64 kB
dotcom-rendering/dist/YoutubeBlockComponent-importable.modern.********************.js	4.05 kB

_{compressed-size-action}

[mxdvl]

Have you considered #7998?

Also, the Changelog would not load formatted for me so pasting here:

2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
• CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
• CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
• CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
• CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 28th March.
  • OpenSSL security advisory 20th April.
  • OpenSSL security advisory 30th May
• c-ares vulnerabilities:
  • GHSA-9g78-jv2r-p7vc
  • GHSA-8r8p-23f3-64c2
  • GHSA-54xr-f67r-4pc4
  • GHSA-x6mf-cxr9-8q6v

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

• [bf3e2c8928] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
• [70f9449072] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
• [35d4efb57b] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
• [392dfedc77] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
• [46cd5fe38b] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
• [7e3d2d85c2] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
• [4ff6ba050a] - http: disable request smuggling via rempty headers (Paolo Insogna) nodejs-private/node-private#428
• [ab269129a6] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
• [925e8f5619] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
• [d6fae8e47e] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

[JamieB-gu]

Have you considered #7998?

👍 will take a look.