Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(major deps): update major dependencies (major) #28

Merged
merged 1 commit into from
Mar 3, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 17, 2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
node (source) 20.11.1 -> 21.6.2 age adoption passing confidence
postcss-cli 10.1.0 -> 11.0.0 age adoption passing confidence

Release Notes

nodejs/node (node)

v21.6.2: 2024-02-14, Version 21.6.2 (Current), @​RafaelGSS

Compare Source

Notable changes

This is a security release.

Notable changes
  • CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  • CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  • CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
  • CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
  • CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  • CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  • CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  • CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  • undici version 5.28.3
  • libuv version 1.48.0
  • OpenSSL version 3.0.13+quic1
Commits

v21.6.1: 2024-01-22, Version 21.6.1 (Current), @​RafaelGSS

Compare Source

Notable Changes

This release fixes a bug in undici using WebStreams

Commits

v21.6.0: 2024-01-15, Version 21.6.0 (Current), @​RafaelGSS

Compare Source

New connection attempt events

Three new events were added in the net.createConnection flow:

  • connectionAttempt: Emitted when a new connection attempt is established. In case of Happy Eyeballs, this might emitted multiple times.
  • connectionAttemptFailed: Emitted when a connection attempt failed. In case of Happy Eyeballs, this might emitted multiple times.
  • connectionAttemptTimeout: Emitted when a connection attempt timed out. In case of Happy Eyeballs, this will not be emitted for the last attempt. This is not emitted at all if Happy Eyeballs is not used.

Additionally, a previous bug has been fixed where a new connection attempt could have been started after a previous one failed and after the connection was destroyed by the user.
This led to a failed assertion.

Contributed by Paolo Insogna in #​51045.

Changes to the Permission Model

Node.js 21.6.0 comes with several fixes for the experimental permission model and two new semver-minor commits.
We're adding a new flag --allow-addons to enable addon usage when using the Permission Model.

$ node --experimental-permission --allow-addons

Contributed by Rafael Gonzaga in #​51183

And relative paths are now supported through the --allow-fs-* flags.
Therefore, with this release one can use:

$ node --experimental-permission --allow-fs-read=./index.js

To give only read access to the entrypoint of the application.

Contributed by Rafael Gonzaga and Carlos Espa in #​50758

Support configurable snapshot through --build-snapshot-config flag

We are adding a new flag --build-snapshot-config to configure snapshots through a custom JSON configuration file.

$ node --build-snapshot-config=/path/to/myconfig.json

When using this flag, additional script files provided on the command line will
not be executed and instead be interpreted as regular command line arguments.

These changes were contributed by Joyee Cheung and Anna Henningsen in #​50453

Other Notable Changes
Commits

v21.5.0: 2023-12-19, Version 21.5.0 (Current), @​RafaelGSS

Compare Source

Notable Changes
Deprecations
Commits

v21.4.0: 2023-12-05, Version 21.4.0 (Current), @​targos

Compare Source

Notable Changes

This release fixes a regression introduced in v21.3.0 that caused the fs.writeFileSync
method to throw when called with 'utf8' encoding, no flag option, and if the target file didn't exist yet.

  • [32acafeeb6] - (SEMVER-MINOR) fs: introduce dirent.parentPath (Antoine du Hamel) #​50976
  • [724548674d] - fs: use default w flag for writeFileSync with utf8 encoding (Murilo Kakazu) #​50990
Commits

v21.3.0: 2023-11-30, Version 21.3.0 (Current), @​RafaelGSS

Compare Source

Notable Changes
New --disable-warning flag

This version adds a new --disable-warning option that allows users to disable specific warnings either by code
(i.e. DEP0025) or type (i.e. DeprecationWarning, ExperimentalWarning).

This option works alongside existing --warnings and --no-warnings.

For example, the following script will not emit DEP0025 require('node:sys') when executed with
node --disable-warning=DEP0025:

import sys from 'node:sys';

Contributed by Ethan-Arrowood in #​50661

Update Root Certificates to NSS 3.95

This is the certdata.txt from NSS 3.95, released on 2023-11-16.

This is the version of NSS that will ship in Firefox 121 on
2023-12-19.

Certificates added:

  • TrustAsia Global Root CA G3
  • TrustAsia Global Root CA G4
  • CommScope Public Trust ECC Root-01
  • CommScope Public Trust ECC Root-02
  • CommScope Public Trust RSA Root-01
  • CommScope Public Trust RSA Root-02

Certificates removed:

  • Autoridad de Certificacion Firmaprofesional CIF A626340
Fast fs.writeFileSync with UTF-8 Strings

Enhanced writeFileSync functionality by implementing a highly efficient fast path primarily in C++ for UTF8-encoded string data.
Additionally, optimized the appendFileSync method by leveraging the improved writeFileSync functionality.
For simplicity and performance considerations, the current implementation supports only string data,
as benchmark results raise concerns about the efficacy of using Buffer for this purpose.
Future optimizations and expansions may be explored, but for now, the focus is on maximizing efficiency for string data operations.

Contributed by CanadaHonk in #​49884.

Other Notable Changes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Oct 17, 2023
@renovate renovate bot force-pushed the renovate/major-major-deps branch 2 times, most recently from 22b79cf to 7190394 Compare October 19, 2023 20:29
@renovate renovate bot force-pushed the renovate/major-major-deps branch 2 times, most recently from c75f8f8 to 20d8aa5 Compare October 25, 2023 21:15
@renovate renovate bot force-pushed the renovate/major-major-deps branch from 20d8aa5 to 7c76507 Compare November 8, 2023 03:14
@renovate renovate bot force-pushed the renovate/major-major-deps branch 2 times, most recently from fe40e94 to c9860ff Compare November 23, 2023 11:08
@renovate renovate bot changed the title fix(major deps): update node.js to v21 fix(major deps): update major dependencies (major) Dec 5, 2023
@renovate renovate bot force-pushed the renovate/major-major-deps branch 2 times, most recently from 6af2779 to 8a18703 Compare December 6, 2023 00:37
@renovate renovate bot force-pushed the renovate/major-major-deps branch from 8a18703 to 7db176c Compare January 10, 2024 04:54
@renovate renovate bot force-pushed the renovate/major-major-deps branch 3 times, most recently from 29741f4 to 6476d40 Compare January 23, 2024 05:48
@renovate renovate bot force-pushed the renovate/major-major-deps branch from 6476d40 to 469c758 Compare January 25, 2024 16:38
@renovate renovate bot force-pushed the renovate/major-major-deps branch 2 times, most recently from f8071e1 to a890392 Compare February 7, 2024 07:03
@renovate renovate bot force-pushed the renovate/major-major-deps branch 2 times, most recently from a229874 to 94fd3b1 Compare February 15, 2024 22:10
@renovate renovate bot force-pushed the renovate/major-major-deps branch from 94fd3b1 to 6d1046c Compare March 1, 2024 19:18
@renovate renovate bot force-pushed the renovate/major-major-deps branch from 6d1046c to 6a16e07 Compare March 2, 2024 13:42
@zdenko-kovac zdenko-kovac merged commit ee36185 into main Mar 3, 2024
7 checks passed
@zdenko-kovac zdenko-kovac deleted the renovate/major-major-deps branch March 3, 2024 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant