This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| node | engines | major | >=16.0.0
-> >=v18.12.1
|
Release Notes
nodejs/node
v18.12.1
: 2022-11-04, Version 18.12.1 'Hydrogen' (LTS), @juanarbol
Compare Source
This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
- CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
- CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)
More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.
Commits
v18.12.0
: 2022-10-25, Version 18.12.0 'Hydrogen' (LTS), @ruyadorno and @RafaelGSS
Compare Source
Notable Changes
This release marks the transition of Node.js 18.x into Long Term Support (LTS)
with the codename 'Hydrogen'. The 18.x release line now moves into "Active LTS"
and will remain so until October 2023. After that time, it will move into
"Maintenance" until end of life in April 2025.
v18.11.0
: 2022-10-13, Version 18.11.0 (Current), @danielleadams
Compare Source
Notable changes
watch mode (experimental)
Running in 'watch' mode using node --watch
restarts the process when an imported file is changed.
Contributed by Moshe Atlow in #44366
Other notable changes
- fs:
- (SEMVER-MINOR) add
FileHandle.prototype.readLines
(Antoine du Hamel) #42590
- http:
- (SEMVER-MINOR) add writeEarlyHints function to ServerResponse (Wing) #44180
- http2:
- (SEMVER-MINOR) make early hints generic (Yagiz Nizipli) #44820
- lib:
- (SEMVER-MINOR) refactor transferable AbortSignal (flakey5) #44048
- src:
- (SEMVER-MINOR) add detailed embedder process initialization API (Anna Henningsen) #44121
- util:
- (SEMVER-MINOR) add default value option to parsearg (Manuel Spigolon) #44631
Commits
v18.10.0
: 2022-09-28, Version 18.10.0 (Current), @RafaelGSS
Compare Source
Notable changes
- doc:
- (SEMVER-MINOR) deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #44588
- add legendecas to TSC list (Michael Dawson) #44662
- move
policy
docs to the permissions
scope (Rafael Gonzaga) #44222
- gyp:
- libnode for ios app embedding (chexiongsheng) #44210
- http:
- (SEMVER-MINOR) throw error on content-length mismatch (sidwebworks) #44588
- stream:
- (SEMVER-MINOR) add
ReadableByteStream.tee()
(Daeyeon Jeong) #44505
Commits
v18.9.1
: 2022-09-23, Version 18.9.1 (Current), @RafaelGSS
Compare Source
This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- Insufficient fix for macOS devices on v18.5.0
- CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
- CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
- CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
- CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
- CVE-2022-35255: Weak randomness in WebCrypto keygen
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
llhttp updated to 6.0.10
llhttp
is updated to 6.0.10 which includes fixes for the following vulnerabilities.
- HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The
llhttp
parser in the http
module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
- HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The
llhttp
parser in the http
module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
- HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the
http
does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
Commits
v18.9.0
: 2022-09-08, Version 18.9.0 (Current), @RafaelGSS
Compare Source
Notable changes
- doc
- add daeyeon to collaborators (Daeyeon Jeong) #44355
- lib
- (SEMVER-MINOR) add diagnostics channel for process and worker (theanarkh) #44045
- os
- (SEMVER-MINOR) add machine method (theanarkh) #44416
- report
- (SEMVER-MINOR) expose report public native apis (Chengzhong Wu) #44255
- src
- (SEMVER-MINOR) expose environment RequestInterrupt api (Chengzhong Wu) #44362
- vm
- include vm context in the embedded snapshot (Joyee Cheung) #44252
Commits
Configuration
📅 Schedule: Branch creation - "before 6am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
dependencies