Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update node.js to >=v10.21.0 #248

Merged
merged 1 commit into from
Jul 14, 2020
Merged

chore(deps): update node.js to >=v10.21.0 #248

merged 1 commit into from
Jul 14, 2020

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 14, 2020 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
node engines minor >=10.0.0 -> >=v10.21.0

Release Notes

nodejs/node

v10.21.0

Compare Source

Notable changes

This is a security release.

Vulnerabilities fixed:

  • CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
  • CVE-2020-10531: ICU-20958 Prevent SEGV_MAPERR in append (High).
  • CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
Commits

v10.20.1

Compare Source

Notable changes

Due to release process failures, Node.js v10.20.0 shipped with source
and header tarballs that did not properly match the final release
commit that was used to build the binaries. We recommend that Node.js
v10.20.0 not be used, particularly in any applications using native
add-ons or where compiling Node.js from source is involved.

Node.js v10.20.1 is a clean release with the correct sources and is
strongly recommended in place of v10.20.0.

v10.20.0

Compare Source

macOS package notarization and a change in builder configuration

The macOS binaries for this release, and future 10.x releases, are now
being compiled on macOS 10.15 (Catalina) with Xcode 11 to support
package notarization, a requirement for installing .pkg files on macOS
10.15 and later. Previous builds of Node.js 10.x were compiled on macOS
10.10 (Yosemite) with a minimum deployment target of macOS 10.7 (Lion).
As binaries are still being compiled to support a minimum of macOS 10.7
(Lion) we do not anticipate this having a negative impact on Node.js
10.x users with older versions of macOS.

Notable changes
  • buffer: add {read|write}Big[U]Int64{BE|LE} methods (garygsc) #​19691
  • build: macOS package notarization (Rod Vagg) #​31459
  • deps:
    • update npm to 6.14.3 (Myles Borins) #​32368
    • upgrade openssl sources to 1.1.1e (Hassaan Pasha) #​32328
    • upgrade to libuv 1.34.2 (cjihrig) #​31477
  • n-api:
    • add napi_get_all_property_names (himself65) #​30006
    • add APIs for per-instance state management (Gabriel Schulhof) #​28682
    • define release 6 #​32058
    • turn NAPI_CALL_INTO_MODULE into a function (Anna Henningsen) #​26128
  • tls:
    • expose keylog event on TLSSocket (Alba Mendez) #​27654
    • support TLS min/max protocol defaults in CLI (Sam Roberts) #​27946
  • url: handle quasi-WHATWG URLs in urlToOptions() (cjihrig) #​26226
Commits

v10.19.0

Compare Source

Notable changes

This is a security release.

Vulnerabilities fixed:

  • CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
  • CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
  • CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

Also, HTTP parsing is more strict to be more secure. Since this may
cause problems in interoperability with some non-conformant HTTP
implementations, it is possible to disable the strict checks with the
--insecure-http-parser command line flag, or the insecureHTTPParser
http option. Using the insecure HTTP parser should be avoided.

Commits

v10.18.1

Compare Source

Notable changes
  • http2: fix session memory accounting after pausing (Michael Lehenbauer) #​30684
  • n-api: correct bug in napi_get_last_error (Octavian Soldea) #​28702
  • tools: update tzdata to 2019c (Myles Borins) #​30479
Commits

v10.18.0

Compare Source

This is a security release.

For more details about the vulnerability please consult the npm blog:

https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

Notable changes
Commits

v10.17.0

Compare Source

Notable changes
  • crypto:
    • add support for chacha20-poly1305 for AEAD (chux0519) #​24081
    • increase maxmem range from 32 to 53 bits (Tobias Nießen) #​28799
  • deps:
    • update npm to 6.11.3 (claudiahdz) #​29430
    • upgrade openssl sources to 1.1.1d (Sam Roberts) #​29921
  • dns: remove dns.promises experimental warning (cjihrig) #​26592
  • fs: remove experimental warning for fs.promises (Anna Henningsen) #​26581
  • http: makes response.writeHead return the response (Mark S. Everitt) #​25974
  • http2: makes response.writeHead return the response (Mark S. Everitt) #​25974
  • n-api:
    • make func argument of napi_create_threadsafe_function optional (legendecas) #​27791
    • mark version 5 N-APIs as stable (Gabriel Schulhof) #​29401
    • implement date object (Jarrod Connolly) #​25917
  • process: add --unhandled-rejections flag (Ruben Bridgewater) #​26599
  • stream:
    • implement Readable.from async iterator utility (Guy Bedford) #​27660
    • make Symbol.asyncIterator support stable (Matteo Collina) #​26989
Commits

v10.16.3

Compare Source

Notable changes

This is a security release.

Node.js, as well as many other implementations of HTTP/2, have been found
vulnerable to Denial of Service attacks.
See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
for more information.

Vulnerabilities fixed:

  • CVE-2019-9511 “Data Dribble”: The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
  • CVE-2019-9512 “Ping Flood”: The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
  • CVE-2019-9513 “Resource Loop”: The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service.
  • CVE-2019-9514 “Reset Flood”: The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
  • CVE-2019-9515 “Settings Flood”: The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
  • CVE-2019-9516 “0-Length Headers Leak”: The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service.
  • CVE-2019-9517 “Internal Data Buffering”: The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service.
  • CVE-2019-9518 “Empty Frames Flood”: The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google)
Commits

v10.16.2

Compare Source

Notable changes

This release patches a regression in the OpenSSL upgrade to 1.1.1c that causes intermittent hangs in machines that have low entropy.

Commits

v10.16.1

Compare Source

Notable changes
  • deps: upgrade openssl sources to 1.1.1c (Sam Roberts) #​28212
  • stream: do not unconditionally call \_read() on resume() (Anna Henningsen) #​26965
  • worker: fix nullptr deref after MessagePort deser failure (Anna Henningsen) #​25076
Commits

v10.16.0

Compare Source

Notable Changes
  • deps:
    • update ICU to 64.2 (Ujjwal Sharma) #​27361
    • upgrade npm to 6.9.0 (Kat Marchán) #​26244
    • upgrade openssl sources to 1.1.1b (Sam Roberts) #​26327
    • upgrade to libuv 1.28.0 (cjihrig) #​27241
  • events: add once method to use promises with EventEmitter (Matteo Collina) #​26078
  • n-api: mark thread-safe function as stable (Gabriel Schulhof) #​25556
  • repl: support top-level for-await-of (Shelley Vohr) #​23841
  • zlib: add brotli support (Anna Henningsen) #​24938
Commits

Renovate configuration

📅 Schedule: "before 3am on Monday" (UTC).

🚦 Automerge: Disabled due to failing status checks.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by WhiteSource Renovate. View repository job log here.

@erezrokah erezrokah added the type: chore work needed to keep the product and development running smoothly label Jul 14, 2020
@erezrokah erezrokah merged commit eeac62e into master Jul 14, 2020
@erezrokah erezrokah deleted the renovate/node-10.x branch July 14, 2020 09:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
type: chore work needed to keep the product and development running smoothly
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@erezrokah @renovate-bot