- Update to 20.10.0:
* --experimental-default-type flag to flip module defaults
* The new flag --experimental-detect-module can be used to
automatically run ES modules when their syntax can be detected.
* Added flush option in file system functions for fs.writeFile functions
* Added experimental WebSocket client
* vm: fix V8 compilation cache support for vm.Script. This fixes
performance regression since v16.x when support for
importModuleDynamically was added to vm.Script
For details, see
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed
- Update to 20.9.0:
* No changes, just LTS transition
OBS-URL: https://build.opensuse.org/request/show/1133875
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nodejs20?expand=0&rev=17
* --experimental-default-type flag to flip module defaults
* The new flag --experimental-detect-module can be used to
automatically run ES modules when their syntax can be detected.
* Added flush option in file system functions for fs.writeFile functions
* Added experimental WebSocket client
* vm: fix V8 compilation cache support for vm.Script. This fixes
performance regression since v16.x when support for
importModuleDynamically was added to vm.Script
For details, see
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed
- Update to 20.9.0:
* No changes, just LTS transition
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs20?expand=0&rev=50
- Update to version 20.5.1:
* (CVE-2023-32002, bsc#1214150): Policies can be bypassed
via Module._load (High)
* (CVE-2023-32558, bsc#1214155): process.binding() can bypass
the permission model through path traversal (High)
* (CVE-2023-32004, bsc#1214152): Permission model can be bypassed
by specifying a path traversal sequence in a Buffer (High)
* (CVE-2023-32006, bsc#1214156): Policies can be bypassed
by module.constructor.createRequire (Medium)
* (CVE-2023-32559, bsc#1214154): Policies can be bypassed
via process.binding (Medium)
* (CVE-2023-32005, bsc#1214153): fs.statfs can bypass
the permission model (Low)
* (CVE-2023-32003, bsc#1214151): fs.mkdtemp() and fs.mkdtempSync()
can bypass the permission model (Low)
- Changes in 20.5.0:
* events: allow safely adding listener to abortSignal
* fs: add a fast-path for readFileSync utf-8
* test_runner: add shards support
- Changes in 20.4.0:
* tls: add ALPNCallback server option for dynamic ALPN negotiation
* adds support for ECMAScript Explicit Resource Management
* adds Mock Timer support to test module
For details see,
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.5.1
versioned.patch: refreshed
OBS-URL: https://build.opensuse.org/request/show/1103349
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nodejs20?expand=0&rev=8
* (CVE-2023-32002, bsc#1214150): Policies can be bypassed
via Module._load (High)
* (CVE-2023-32558, bsc#1214155): process.binding() can bypass
the permission model through path traversal (High)
* (CVE-2023-32004, bsc#1214152): Permission model can be bypassed
by specifying a path traversal sequence in a Buffer (High)
* (CVE-2023-32006, bsc#1214156): Policies can be bypassed
by module.constructor.createRequire (Medium)
* (CVE-2023-32559, bsc#1214154): Policies can be bypassed
via process.binding (Medium)
* (CVE-2023-32005, bsc#1214153): fs.statfs can bypass
the permission model (Low)
* (CVE-2023-32003, bsc#1214151): fs.mkdtemp() and fs.mkdtempSync()
can bypass the permission model (Low)
- Changes in 20.5.0:
* events: allow safely adding listener to abortSignal
* fs: add a fast-path for readFileSync utf-8
* test_runner: add shards support
- Changes in 20.4.0:
* tls: add ALPNCallback server option for dynamic ALPN negotiation
* adds support for ECMAScript Explicit Resource Management
* adds Mock Timer support to test module
For details see,
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.5.1
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs20?expand=0&rev=24
- Update to version 20.3.1 (security fixes only). The following
CVEs are fixed in this release:
* (CVE-2023-30581, bsc#1212574): mainModule.__proto__ Bypass
Experimental Policy Mechanism (High)
* (CVE-2023-30584, bsc#1212575): Path Traversal Bypass in
Experimental Permission Model (High)
* (CVE-2023-30587, bsc#1212576): Bypass of Experimental
Permission Model via Node.js Inspector (High)
* (CVE-2023-30582, bsc#1212577): Inadequate Permission Model
Allows Unauthorized File Watching (Medium)
* (CVE-2023-30583, bsc#1212578): Bypass of Experimental
Permission Model via fs.openAsBlob() (Medium)
* (CVE-2023-30585, bsc#1212579): Privilege escalation via
Malicious Registry Key manipulation during Node.js
installer repair process (Medium)
* (CVE-2023-30586, bsc#1212580): Bypass of Experimental
Permission Model via Arbitrary OpenSSL Engines (Medium)
* (CVE-2023-30588, bsc#1212581): Process interuption due to invalid
Public Key information in x509 certificates (Medium)
* (CVE-2023-30589, bsc#1212582): HTTP Request Smuggling via
Empty headers separated by CR (Medium)
* (CVE-2023-30590, bsc#1212583): DiffieHellman does not
generate keys after setting a private key (Medium)
OBS-URL: https://build.opensuse.org/request/show/1094364
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nodejs20?expand=0&rev=7
CVEs are fixed in this release:
* (CVE-2023-30581, bsc#1212574): mainModule.__proto__ Bypass
Experimental Policy Mechanism (High)
* (CVE-2023-30584, bsc#1212575): Path Traversal Bypass in
Experimental Permission Model (High)
* (CVE-2023-30587, bsc#1212576): Bypass of Experimental
Permission Model via Node.js Inspector (High)
* (CVE-2023-30582, bsc#1212577): Inadequate Permission Model
Allows Unauthorized File Watching (Medium)
* (CVE-2023-30583, bsc#1212578): Bypass of Experimental
Permission Model via fs.openAsBlob() (Medium)
* (CVE-2023-30585, bsc#1212579): Privilege escalation via
Malicious Registry Key manipulation during Node.js
installer repair process (Medium)
* (CVE-2023-30586, bsc#1212580): Bypass of Experimental
Permission Model via Arbitrary OpenSSL Engines (Medium)
* (CVE-2023-30588, bsc#1212581): Process interuption due to invalid
Public Key information in x509 certificates (Medium)
* (CVE-2023-30589, bsc#1212582): HTTP Request Smuggling via
Empty headers separated by CR (Medium)
* (CVE-2023-30590, bsc#1212583): DiffieHellman does not
generate keys after setting a private key (Medium)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs20?expand=0&rev=22
