Update Node.js#1
Open
renovate-tests wants to merge 1 commit into
Open
Conversation
renovate-tests
force-pushed
the
renovate/node-8.x
branch
from
February 13, 2019 17:37
92b5215 to
4d01df5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.13-browsers->8.15-browsersv8.13.0->8.15.08.13.0->8.15.0Release Notes
nodejs/node
v8.15.0Compare Source
The 8.14.0 security release introduced some unexpected breakages on the 8.x release line.
This is a special release to fix a regression in the HTTP binary upgrade response body and add
a missing CLI flag to adjust the max header size of the http parser.
Notable Changes
Commits
693e362175] - (SEMVER-MINOR) cli: add --max-http-header-size flag (cjihrig) #248114fb5a1be2f] - (SEMVER-MINOR) deps: cherry-pick http_parser_set_max_header_size (cjihrig) #24811446f8b54e5] - (SEMVER-MINOR) http: add maxHeaderSize property (cjihrig) #24860215ecfe4de] - http: fix regression of binary upgrade response body (Matteo Collina) #25037e1fbc26c6a] - test: move test-benchmark-path to sequential (Rich Trott) #21393aef71c05a2] - test: mark test-http2-settings-flood as flaky on Windows (Rich Trott) #25048v8.14.1Compare Source
Notable changes
Commits
62fb5dbec5] - assert: revert breaking change (Ruben Bridgewater) #24786a8402fe1c8] - build: only check REPLACEME & DEP...X for releases (Rod Vagg) #2457526743369d3] - build: improve Travis CI settings (Timothy Gu) #214591da04c208d] - build: install markdown linter for travis (Richard Lau) #212157612024939] - build: initial .travis.yml implementation (Anna Henningsen) #21059f70e79a7b2] - build: allow for overwriting of use_openssl_def (Shelley Vohr) #2376315d1f67c60] - build,doc: remove outdatedlint-md-build(Michaël Zasso) #2299185a6daeaef] - build,meta: switch to gcc-4.9 on travis (Refael Ackermann) #23778313ef6fa73] - build,tools: tweak the travis config (Refael Ackermann) #2241722b41495ea] - child_process: handle undefined/null for fork() args (Shobhit Chittora) #22416499605618b] - crypto: add SET_INTEGER_CONSANT macro (Daniel Bevenius) #2368734d91296df] - deps: icu: apply workaround patch (Steven R. Loomis) #2376450347297a1] - deps: cherry-pickd2e0166from V8 upstream (Vasili Skurydzin) #239589bedae5266] - deps: cherry-pick6bc4bfefrom V8 upstream (Vasili Skurydzin) #239584f3c9e6aab] - deps,v8: fix gyp build on Aix platform (Vasili Skurydzin) #2395874c1074d53] - doc: add description for inspector-only console methods. (Benjamin Zaslavsky) #17004692223182c] - doc: fix api documentation of http.createServer (Ari Autio) #248696d8c65e574] - doc: update to adding listens on SIGUSR1 (willhayslett) #1970933b7c50036] - doc: remove "if provided" for optional arguments (Rich Trott) #19690216e7da8c5] - doc: do not identify string as "JavaScript string" (Rich Trott) #1968917e84217c7] - doc: fix grammar error in process.md (Kenji Okamoto) #1964106daf5276f] - doc: remove use of "random port" re dgram send (Thomas Hunter II) #19620bf95392e86] - doc: improve assert legacy text (Rich Trott) #19622e48cc3c403] - doc: remove confusing note about child process stdio (Anna Henningsen) #195529d249bf6d5] - doc: add BethGriggs to collaborators (Beth Griggs) #19610c3ecf05b01] - doc: documentmake docopen(Ayush Gupta) #193218338700d05] - doc: add directory structure in writing-tests.md (juggernaut451) #1880263d8632611] - doc: add types for someprocessproperties (Vse Mozhet Byt) #19571b2fc3b556c] - doc: fix n-api example string (Steven R. Loomis) #19205d79e7d6e89] - doc: minor improvements to buffer.md (Rich Trott) #1954706491482f8] - doc: update child_process.md (Ari Leo Frankel) #190754db289ca17] - doc: move StackOverflow to unofficial section (josephleon) #19416f5683a9a6d] - doc: correct async_hooks resource names (Gerhard Stoebich) #24684ffe1f8033c] - doc: sort bottom-of-file markdown links (Sam Roberts) #2468278d9a5e6e4] - doc: address bits of proof reading work (Jagannath Bhat) #23978d1eebb2e43] - doc: revise COLLABORATOR_GUIDE.md (Rich Trott) #23990003eb0c8e1] - doc: simplify CODE_OF_CONDUCT.md (Rich Trott) #23989c1723c8bca] - doc: add branding to style guide (Rich Trott) #239678bb67a1fb9] - doc: use Node.js instead of Node (Rich Trott) #2396773e0bb1f52] - doc: fix typographical issues (Denis McDonald) #239706d76f852a9] - doc: add documentation for http.IncomingMessage$complete (James M Snell) #239143025f351db] - doc: remove mailing list (Rich Trott) #239322459e150bb] - doc: add note about ABI compatibility (Myles Borins) #2223727b35833bd] - doc: make example more clarified in cluster.md (ZYSzys) #239310d4de59967] - doc: simplify valid security issue descriptions (Rich Trott) #238819afdc09f98] - doc: simplify path.basename() on POSIX and Windows (ZYSzys) #238643f2a01688d] - doc: add review suggestions to require() (erickwendel) #23605f037942fe7] - doc: move @phillipj to emeriti (Phillip Johnsen) #23790e5f75cf82e] - doc: add note about removeListener order (James M Snell) #237620ff88a3510] - doc: document ACL limitation for fs.access on Windows (James M Snell) #2377232ae851710] - doc: document that addMembership must be called once in a cluster (James M Snell) #23746e2d2ce6706] - doc: remove reference to sslv3 in tls.md (James M Snell) #237454c24a82a65] - http2: fix sequence of error/close events (Gerhard Stoebich) #247898afbd5ce41] - lib: fix a typo in lib/timers "read through" (wangzengdi) #19666fa12532000] - lib: remove useless cwd in posix.resolve (ZYSzys) #23902e8dbd09414] - src: use "constants" string instead of creating new one (Ouyang Yadong) #23894394cb42962] - test: verify order of error in h2 server stream (Myles Borins) #246855e09a3d4ed] - test: test process.setuid for bad argument types (Divyanshu Singh) #19703970164f3a8] - test: improve assert message (fatahn) #19629086570e4e1] - test: remove third argument from call to assert.strictEqual() (Forrest Wolf) #19659a7b3274af4] - test: fix flaky test-cluster-send-handle-twice (Rich Trott) #197001bda58289a] - test: rename regression tests more expressively (Ujjwal Sharma) #19668bd9cc92e8d] - test: remove 3rd argument from assert.strictEqual (Arian Santrach) #197073ca10faf00] - test: use createReadStream instead of ReadStream (Daniel Bevenius) #196368a546e822d] - test: removed default message from assert.strictEqual (jaspal-yupana) #19660a62df1b379] - test: refactor test-net-dns-error (Luigi Pinca) #196408a0ecf4360] - test: refactor test-http-expect-continue (Rich Trott) #196250cbe813e90] - test: update link according to NIST bibliography (Tobias Nießen) #19593ea1fda6228] - test: remove third param from assert.strictEqual (davis.okoth@kemsa.co.ke) #1953618c4e5e886] - test: remove message from assert.strictEqual() (willhayslett) #19525146c488bf5] - test: refactor parallel/test-tls-ca-concat.js (juggernaut451) #190928fa5bd3761] - test: rename regression tests file names (Ujjwal Sharma) #19332d34ade8755] - test: fix strictEqual arguments order (Esteban Sotillo) #239566ae07a9248] - test: add property for RangeError in test-buffer-copy (mritunjaygoutam12) #23968b1e6de80c1] - test: fix regression when compiled with FIPS (Adam Majer) #23871d0368b8245] - test: fix strictEqual() argument order (Loic) #238293a864d716e] - test: fix strictEqual() arguments order (Nolan Rigo) #23800e7a573a9e2] - test: fix test-require-symlink on Windows (Bartosz Sosnowski) #23691ac91346776] - test: fix strictEqual() argument order (Romain Lanz) #237680f98c4926a] - test: fix strictEqual() arguments order (Thomas GENTILHOMME) #2377173d19b1516] - test: ensure openssl version prints correctly (Sam Roberts) #23678544e64d68d] - test: fix assertion arguments order (Elian Gutierrez) #23787e84c01d1f3] - tools: update alternative docs versions (Richard Lau) #2398002209c5fa7] - tools: clarify commit message linting (Rich Trott) #2374222043ccb84] - tools: do not lint commit message if var undefined (Rich Trott) #237252a8a28c436] - tools: make Travis commit linting more robust (Rich Trott) #23397c15d236545] - tools: apply linting to first commit in PRs (Rich Trott) #22452v8.14.0Compare Source
This is a security release. All Node.js users should consult the security release summary at:
https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
for details on patched vulnerabilities.
Fixes for the following CVEs are included in this release:
Notable Changes
server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction withserver.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)pathoption in HTTP client requests. Paths containing characters outside of the range\u0021-\u00ffwill now be rejected with aTypeError. This behavior can be reverted if necessary by supplying the--security-revert=CVE-2018-12116command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (Lob), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina)url.parse()with the'javascript:'protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)Commits
add20f373c] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) nodejs/node#1836c4e382cce3] - deps: fix asm build error of openssl in x86_win32 (Shigeki Ohtsu) nodejs/node#1389f1d1f12519] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) nodejs/node#138969037ad5c4] - deps: copy all openssl header files to include dir (Sam Roberts) #24530f5b34336bb] - deps: upgrade openssl sources to 1.0.2q (Sam Roberts) #2453093dba83fb0] - deps,http: http_parser set max header size to 8KB (Matteo Collina) nodejs-private/node-private#143576038fb61] - (SEMVER-MINOR) http: add --security-revert for CVE-2018-12116 (Matteo Collina) nodejs-private/node-private#146513e9747a2] - (SEMVER-MINOR) http: disallow two-byte characters in URL path (Benno Fünfstück) nodejs-private/node-private#146696f063c5e] - (SEMVER-MINOR) http,https: protect against slow headers attack (Matteo Collina) nodejs-private/node-private#1517f362a11ee] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) nodejs/node#138953a6e4eb20] - url: avoid hostname spoofing w/ javascript protocol (Matteo Collina) nodejs-private/node-private#145Renovate configuration
📅 Schedule: At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "
rebase!".👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.