* esm: mark import attributes and JSON module as stable
* deps:
+ upgrade npm to 10.8.2
+ update simdutf to 5.6.0
+ update brotli to 1.1.0
+ update ada to 2.8.0
+ update acorn to 8.13.0
+ update acorn-walk to 8.3.4
+ update c-ares to 1.29.0
- CVE-2024-21538.patch: fixes regular expression denial of service
(bsc#1233856, CVE-2024-21538)
- fix_ci_tests.patch, versioned.patch: refreshed
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=83
* This release fixes a regression introduced in Node.js 18.19.0 where
http.server.close() was incorrectly closing idle connections.
* deps:
+ acorn updated to 8.11.3.
+ acorn-walk updated to 8.3.2.
+ ada updated to 2.7.8.
+ c-ares updated to 1.28.1.
+ corepack updated to 0.28.0.
+ nghttp2 updated to 1.61.0.
+ ngtcp2 updated to 1.3.0.
+ npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.
+ simdutf updated to 5.2.4.
- Changes in 18.20.2:
* fixes bsc#1222665, CVE-2024-27980 - windows only bug
- versioned.patch, npm_search_paths.patch: refreshed
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=79
* (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High)
* (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
* (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
* (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
* undici version 5.28.3 (CVE-2024-24758, bsc#1220017)
* libuv version 1.48.0 (CVE-2024-24806, bsc#1219724)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=73
were fixed:
* (CVE-2023-32002, bsc#1214150): Policies can be bypassed
via Module._load (High)
* (CVE-2023-32006, bsc#1214156): Policies can be bypassed by
module.constructor.createRequire (Medium)
* (CVE-2023-32559, bsc#1214154): Policies can be bypassed via
process.binding (Medium)
- Changes included in LTS version 18.17.0:
* dns: expose getDefaultResultOrder
* events: add getMaxListeners method
* fs:
+ add support for mode flag to specify the copy behavior
+ add recursive option to readdir and opendir
+ add support for mode flag to specify the copy behavior
+ implement byob mode for readableWebStream()
* http:
+ prevent writing to the body when not allowed by HTTP spec
+ remove internal error in assignSocket
+ add highWaterMark opt in http.createServer
* lib:
+ add webstreams to Duplex.from()
+ implement AbortSignal.any()
* module:
+ change default resolver to not throw on unknown scheme
* node-api:
+ define version 9
+ deprecate napi_module_register
* stream:
+ preserve object mode in compose
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=64
CVEs are fixed in this release:
* (CVE-2023-30581, bsc#1212574): mainModule.__proto__ Bypass
Experimental Policy Mechanism (High)
* (CVE-2023-30585, bsc#1212579): Privilege escalation via
Malicious Registry Key manipulation during Node.js
installer repair process (Medium)
* (CVE-2023-30588, bsc#1212581): Process interuption due to invalid
Public Key information in x509 certificates (Medium)
* (CVE-2023-30589, bsc#1212582): HTTP Request Smuggling via
Empty headers separated by CR (Medium)
* (CVE-2023-30590, bsc#1212583): DiffieHellman does not
generate keys after setting a private key (Medium)
* c-ares security issues:
+ CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
(bsc#1211604)
+ CVE-2023-31147 Moderate. Insufficient randomness in generation
of DNS query IDs (bsc#1211605)
+ CVE-2023-31130. Moderate. Buffer Underwrite in
ares_inet_net_pton() (bsc#1211606)
+ CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE
during cross compilation (bsc#1211607)
- fix_ci_tests.patch: increase default timeout on unit tests
to 20min from 2min. This seems to have lead to build failures
on some platforms, like s390x in Factory. (bsc#1211407)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=61
* deps: upgrade npm to 9.5.0
* deps: update undici to 5.20.0
- Changes in version 18.14.1:
* fixes permissions policies can be bypassed via process.mainModule
(bsc#1208481, CVE-2023-23918)
* fixes insecure loading of ICU data through ICU_DATA environment
variable (bsc#1208487, CVE-2023-23920)
* fixes OpenSSL error handling issues in nodejs crypto library
(bsc#1208483, CVE-2023-23919)
* updates undici to v5.19.1
+ Fetch API in Node.js did not protect against CRLF injection in host headers
+ Regular Expression Denial of Service in Headers in Node.js fetch API
(bsc#1208413, bsc#1208485, CVE-2023-24807, CVE-2023-23936)
- Update to NodeJS 18.14.0 LTS:
* deps:
+ update npm to 9.2.0
* http:
+ join authorization headers
+ improved timeout defaults handling
* stream:
+ implement finished() for ReadableStream and WritableStream
- refreshed patches: linker_lto_jobs.patch, npm_search_paths.patch,
versioned.patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=47
* Running in 'watch' mode using node --watch restarts the process
when an imported file is changed.
* fs: add FileHandle.prototype.readLines
* http: add writeEarlyHints function to ServerResponse
* http2: make early hints generic
* util: add default value option to parsearg
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=26
* added experimental watch mode -- running in 'watch' mode using
node --watch restarts the process when an imported file is changed
* fs: add FileHandle.prototype.readLines
* http: add writeEarlyHints function to ServerResponse
* http2: make early hints generic
* lib: refactor transferable AbortSignal
* src: add detailed embedder process initialization API
* util: add default value option to parsearg
- legacy_python.patch, versioned.patch: updated
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=24
* lib - add diagnostics channel for process and worker
* os - add machine method
* report - expose report public native apis
* src - expose environment RequestInterrupt api
* vm - include vm context in the embedded snapshot
- Changes in 18.8.0:
* bootstrap: implement run-time user-land snapshots via
--build-snapshot and --snapshot-blob. See
* crypto:
+ allow zero-length IKM in HKDF and in webcrypto PBKDF2
+ allow zero-length secret KeyObject
* deps: upgrade npm to 8.18.0
* http: make idle http parser count configurable
* net: add local family
* src: print source map error source on demand
* tls: pass a valid socket on tlsClientError
- dns.patch: upstreamed, removed
- nodejs-libpath.patch, versioned.patch: refreshed
- fix_ci_tests.patch: partially upstreamed
- openssl3_fixups.patch: fix unit tests with openssl 1.1.1
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs18?expand=0&rev=7
