217bff4fd8- Update to 20.19.2: * fix error handling on async crypto operation (bsc#1243218, CVE-2025-23166) * add missing call to uv_fs_req_cleanup (bsc#1243217, CVE-2025-23165) * update llhttp to 9.2.0 (bsc#1243220, CVE-2025-23167) - Changes in 20.19.1: * deps: update undici to 6.21.2 * dns: restore dns query cache ttlAdam Majer2025-06-12 14:43:19 +00:00
9f8fcfaa8c- Update to 20.19.0: * esm: mark import attributes and JSON module as stable * module: + require(esm) is now enabled by default + Module syntax detection is now enabled by default * worker: add postMessageToThread - Build with PIE (bsc#1239949) - nodejs-libpath.patch: refreshedAdam Majer2025-04-08 13:23:37 +00:00
157584cc23- Update to 20.18.2: * src,loader,permission: throw on InternalWorker use when permission model is enabled (bsc#1236251, CVE-2025-23083) * src: fix HTTP2 mem leak on premature close and ERR_PROTO (bsc#1236250, CVE-2025-23085) * deps: Use of Insufficiently Random Values in undici fetch() (bsc#1236258, CVE-2025-22150)Adam Majer2025-01-22 11:28:47 +00:00
b692d3ae42- nodejs.keyring: sync keys with upstreamAdam Majer2024-12-05 10:29:50 +00:00
401ab9a1e5- linker_lto_jobs.patch: refreshed - fix_ci_tests.patch: fix dns test vs. older c-aresAdam Majer2024-12-04 17:51:51 +00:00
6eba4bd4ca- Update to 20.18.1 * Experimental Network Inspection Support in Node.js * Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext * New option for vm.createContext() to create a context with a freezable globalThis * buffer: optimize createFromString - Changes in 20.17.0: * module: support require()ing synchronous ESM graphs * path: add matchesGlob method * stream: expose DuplexPair API - Changes in 20.16.0: * process: add process.getBuiltinModule(id) * inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth * buffer: add .bytes() method to Blob - CVE-2024-21538.patch: fixes regular expression denial of service (bsc#1233856, CVE-2024-21538) - linker_lto_jobs.patch, fix_ci_tests.patch: refreshedAdam Majer2024-12-04 16:58:37 +00:00
5a0045e3ae- Update to 20.12.0: * crypto: implement crypto.hash() * util: add loading and parsing environment variables * new connection attempt events: connectionAttempt, connectionAttemptFailed, connectionAttemptTimeout * sea: support embedding assets * support configurable snapshot through --build-snapshot-config flag * util.styleText(format, text): This function returns a formatted text considering the format passed. * vm: support using the default loader to handle dynamic import() - c-ares-fixes.patch: removed, upstreamed - nodejs-libpath.patch, versioned.patch: refreshed * libuv version 1.48.0 (CVE-2024-24806, bsc#1220053)Adam Majer2024-04-02 14:59:13 +00:00
e02b7ed54f- Update to 20.11.1: (security updates) * (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High) * (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) * (CVE-2024-21896, bsc#1219994) - Path traversal by monkey-patching Buffer internals- (High) * (CVE-2024-22017, bsc#1219995) - setuid() does not drop all privileges due to io_uring - (High) * (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) * (CVE-2024-21891, bsc#1219998) - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) * (CVE-2024-21890, bsc#1219999) - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) * (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) * undici version 5.28.3 (CVE-2024-24758, bsc#1220017) * libuv version 1.48.0 (CVE-2024-24806, bsc#1219724)Adam Majer2024-02-16 16:24:14 +00:00
4f15b0343b- update to 20.11.0: * esm: add import.meta.dirname and import.meta.filename * fs: add c++ fast path for writeFileSync utf8 * module: remove useCustomLoadersIfPresent flag * module: bootstrap module loaders in shadow realm * src: add --disable-warning option * src: create per isolate proxy env template * src: make process binding data weak * stream: use Array for Readable buffer * stream: optimize creation * test_runner: adds built in lcov reporter * test_runner: add Date to the supported mock APIs * test_runner, cli: add --test-timeout flag - c-ares-fixes.patch: refreshedAdam Majer2024-02-12 14:47:36 +00:00
45439a6199- Update to 20.10.0: * --experimental-default-type flag to flip module defaults * The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected. * Added flush option in file system functions for fs.writeFile functions * Added experimental WebSocket client * vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script For details, see https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0 - nodejs20-zlib-1.3.patch: upstreamed, removed - fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshedAdam Majer2023-11-23 10:43:36 +00:00
abe59659fe- fix_ci_tests.patch: adapt for openssl 3.1.4Adam Majer2023-10-27 09:19:38 +00:00
e0faf6dcc7-------------------------------------------------------------------- - Add nodejs20-zlib-1.3.patch: Support zlib version with only major.minor versions, like zlib 1.3. ------------------------------------------------------------------Adam Majer2023-10-24 14:18:15 +00:00
d419ccb18e- Update to 20.8.0: * Stream performance improvements * Rework of memory management in vm APIs with the importModuleDynamically option * test_runner: + accept testOnly in run + add junit reporter - fix_ci_tests.patch: refreshedAdam Majer2023-10-05 14:56:50 +00:00
5be1703cd5- f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: fixes issues with Angular and other software that tries to load ECM modules in somewhat circular fashion ending up with multiple executions.Adam Majer2023-09-08 10:48:07 +00:00
2a9178dd9f- nodejs.keyring: updated to include current upstream releasersAdam Majer2023-09-05 11:21:21 +00:00
f7fd71549c- Update to 20.6.0: * add support for .env files to configure envrionment variables * import.meta.resolve unflagged * deps: npm updated to 9.8.1Adam Majer2023-09-05 09:57:08 +00:00
7182d7ee39- Update to version 20.5.1: * (CVE-2023-32002, bsc#1214150): Policies can be bypassed via Module._load (High) * (CVE-2023-32558, bsc#1214155): process.binding() can bypass the permission model through path traversal (High) * (CVE-2023-32004, bsc#1214152): Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High) * (CVE-2023-32006, bsc#1214156): Policies can be bypassed by module.constructor.createRequire (Medium) * (CVE-2023-32559, bsc#1214154): Policies can be bypassed via process.binding (Medium) * (CVE-2023-32005, bsc#1214153): fs.statfs can bypass the permission model (Low) * (CVE-2023-32003, bsc#1214151): fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low) - Changes in 20.5.0: * events: allow safely adding listener to abortSignal * fs: add a fast-path for readFileSync utf-8 * test_runner: add shards support - Changes in 20.4.0: * tls: add ALPNCallback server option for dynamic ALPN negotiation * adds support for ECMAScript Explicit Resource Management * adds Mock Timer support to test module For details see, https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.5.1Adam Majer2023-08-10 14:02:38 +00:00
1cdf9b4679- Update to version 20.3.1 (security fixes only). The following CVEs are fixed in this release: * (CVE-2023-30581, bsc#1212574): mainModule.__proto__ Bypass Experimental Policy Mechanism (High) * (CVE-2023-30584, bsc#1212575): Path Traversal Bypass in Experimental Permission Model (High) * (CVE-2023-30587, bsc#1212576): Bypass of Experimental Permission Model via Node.js Inspector (High) * (CVE-2023-30582, bsc#1212577): Inadequate Permission Model Allows Unauthorized File Watching (Medium) * (CVE-2023-30583, bsc#1212578): Bypass of Experimental Permission Model via fs.openAsBlob() (Medium) * (CVE-2023-30585, bsc#1212579): Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) * (CVE-2023-30586, bsc#1212580): Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium) * (CVE-2023-30588, bsc#1212581): Process interuption due to invalid Public Key information in x509 certificates (Medium) * (CVE-2023-30589, bsc#1212582): HTTP Request Smuggling via Empty headers separated by CR (Medium) * (CVE-2023-30590, bsc#1212583): DiffieHellman does not generate keys after setting a private key (Medium)Adam Majer2023-06-21 12:07:38 +00:00
5b2b61f845- Update to version 20.3.0: * deps: upgrade to libuv 1.45.0, including significant performance improvements to file system operations on Linux * module: change default resolver to not throw on unknown scheme * stream: deprecate asIndexedPairs - versioned.patch, fix_ci_tests.patch: refreshed - openssl3_1-adapt_tests.patch: upstreamed and removed For details see, https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.3.0Adam Majer2023-06-15 11:44:48 +00:00
b7b4ea6812- Update to version 20.2.0: * http: prevent writing to the body when not allowed by HTTP spec * sea: add option to disable the experimental SEA warning * test_runner: add skip, todo, and only shorthands to test * url: add value argument to URLSearchParams has and delete methods For details see, https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.2.0Adam Majer2023-05-19 13:53:28 +00:00
02d0db4631on some platforms, like s390x in Factory. (bsc#1211407)Adam Majer2023-05-15 14:34:43 +00:00
12a0128514- fix_ci_tests.patch: increase default timeout on unit tests to 20min from 2min. This seems to have lead to build failures on some platforms, like s390x in Factory.Adam Majer2023-05-15 14:06:14 +00:00
efc950d556- z13.patch: fixes illegal instruction error on z13 and older s390Adam Majer2023-05-12 07:59:13 +00:00
6978a0940b- Update to version 20.1.0 assert: deprecate CallTracker dns: expose getDefaultResultOrder doc: add KhafraDev to collaborators fs: add recursive option to readdir and opendir fs: add support for mode flag to specify the copy behavior of the cp methods http: add highWaterMark option http.createServer stream: preserve object mode in compose test_runner: add testNamePatterns to run API test_runner: execute before hook on test test_runner: support combining coverage reports wasi: make returnOnExit true by defaultAdam Majer2023-05-04 13:34:39 +00:00
Adam Majer