node-aix-ppc64 21.7.1 → 21.7.3

package/CHANGELOG.md

@@ -8,6 +8,8 @@
 </tr>
 <tr>
 <td>
+<a href="#21.7.3">21.7.3</a><br/>
+<a href="#21.7.2">21.7.2</a><br/>
 <a href="#21.7.1">21.7.1</a><br/>
 <a href="#21.7.0">21.7.0</a><br/>
 <a href="#21.6.2">21.6.2</a><br/>
@@ -46,6 +48,41 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="21.7.3"></a>
+
+## 2024-04-10, Version 21.7.3 (Current), @RafaelGSS
+
+This is a security release.
+
+### Notable Changes
+
+* CVE-2024-27980 - Command injection via args parameter of `child_process.spawn` without shell option enabled on Windows
+
+### Commits
+
+* \[[`9095c914ed`](https://github.com/nodejs/node/commit/9095c914ed)] - **src**: disallow direct .bat and .cmd file spawning (Ben Noordhuis) [nodejs-private/node-private#562](https://github.com/nodejs-private/node-private/pull/562)
+
+<a id="21.7.2"></a>
+
+## 2024-04-03, Version 21.7.2 (Current), @RafaelGSS prepared by @marco-ippolito
+
+This is a security release.
+
+### Notable changes
+
+* CVE-2024-27983 - Assertion failed in node::http2::Http2Session::\~Http2Session() leads to HTTP/2 server crash- (High)
+* CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium)
+* llhttp version 9.2.1
+* undici version 6.11.1
+
+### Commits
+
+* \[[`3dfc10c851`](https://github.com/nodejs/node/commit/3dfc10c851)] - **deps**: update undici to 6.11.1 (Node.js GitHub Bot) [#52328](https://github.com/nodejs/node/pull/52328)
+* \[[`aceea1c5e7`](https://github.com/nodejs/node/commit/aceea1c5e7)] - **deps**: update undici to 6.10.2 (Node.js GitHub Bot) [#52227](https://github.com/nodejs/node/pull/52227)
+* \[[`5f0f96b275`](https://github.com/nodejs/node/commit/5f0f96b275)] - **deps**: update llhttp to 9.2.0 (Node.js GitHub Bot) [#51719](https://github.com/nodejs/node/pull/51719)
+* \[[`1a65e98e22`](https://github.com/nodejs/node/commit/1a65e98e22)] - **http**: do not allow OBS fold in headers by default (Paolo Insogna) [nodejs-private/node-private#556](https://github.com/nodejs-private/node-private/pull/556)
+* \[[`3bd39fb474`](https://github.com/nodejs/node/commit/3bd39fb474)] - **src**: ensure to close stream when destroying session (RafaelGSS) [nodejs-private/node-private#561](https://github.com/nodejs-private/node-private/pull/561)
+
 <a id="21.7.1"></a>
 
 ## 2024-03-08, Version 21.7.1 (Current), @targos
@@ -515,7 +552,7 @@ Node.js 21.6.0 comes with several fixes for the experimental permission model an
 We're adding a new flag `--allow-addons` to enable addon usage when using the Permission Model.
 
 ```console
-$ node --experimental-permission --allow-addons
+node --experimental-permission --allow-addons
 ```
 
 Contributed by Rafael Gonzaga in [#51183](https://github.com/nodejs/node/pull/51183)
@@ -524,7 +561,7 @@ And relative paths are now supported through the `--allow-fs-*` flags.
 Therefore, with this release one can use:
 
 ```console
-$ node --experimental-permission --allow-fs-read=./index.js
+node --experimental-permission --allow-fs-read=./index.js
 ```
 
 To give only read access to the entrypoint of the application.
@@ -536,7 +573,7 @@ Contributed by Rafael Gonzaga and Carlos Espa in [#50758](https://github.com/nod
 We are adding a new flag `--build-snapshot-config` to configure snapshots through a custom JSON configuration file.
 
 ```console
-$ node --build-snapshot-config=/path/to/myconfig.json
+node --build-snapshot-config=/path/to/myconfig.json
 ```
 
 When using this flag, additional script files provided on the command line will

package/include/node/node.exp

@@ -5980,15 +5980,15 @@ _GLOBAL__F__ZN2v88internal6torque5Block13SetInputTypesERKNS1_5StackIPKNS1_4TypeE
 _GLOBAL__F__ZN2v88internal6torque9KytheData21AddConstantDefinitionEPKNS1_5ValueE
 _GLOBAL__F__ZNK2v88internal6torque3cpp8Function22PrintDeclarationHeaderERSoi
 _GLOBAL__F__ZNK2v88internal6torque4Rule9RunActionEPKNS1_4ItemERKNS1_11LexerResultE
-_GLOBAL__I_65535_0_.._deps_v8_src_common_ptr_compr.cc_87E8306D_0x336befb04d4166be
+_GLOBAL__I_65535_0_.._deps_v8_src_common_ptr_compr.cc_87E8306D_0x7ad2cb38b5bbc8b2
 _GLOBAL__I_65535_0_.._deps_v8_src_compiler_int64_lowering.cc_E21CEA7D_0x1ac90f5e4394c074
-_GLOBAL__I_65535_0_.._deps_v8_src_compiler_turboshaft_utils.cc_DFF67DD7_0x2db78c2d750af15c
+_GLOBAL__I_65535_0_.._deps_v8_src_compiler_turboshaft_utils.cc_DFF67DD7_0x83b97329f83d321
 _GLOBAL__I_65535_0_.._deps_v8_src_diagnostics_gdb_jit.cc_DFF67DD7_0xd5582dde01019a40
 _GLOBAL__I_65535_0_.._deps_v8_src_diagnostics_objects_debug.cc_DFF67DD7_0xfc307f2e5da7a714
 _GLOBAL__I_65535_0_.._deps_v8_src_execution_arguments.cc_DFF67DD7_0xca19078f607b442e
 _GLOBAL__I_65535_0_.._deps_v8_src_execution_simulator_base.cc_7874F2D3_0x19fe1aa8a1fbc856
-_GLOBAL__I_65535_0_.._deps_v8_src_heap_evacuation_verifier.cc_FE345EE0_0x758ef5ebc5e8f817
-_GLOBAL__I_65535_0_.._deps_v8_src_heap_factory_base.cc_7874F2D3_0x789d0ef05d4f3c23
+_GLOBAL__I_65535_0_.._deps_v8_src_heap_evacuation_verifier.cc_FE345EE0_0x191434e6c1d5c8e3
+_GLOBAL__I_65535_0_.._deps_v8_src_heap_factory_base.cc_7874F2D3_0x12712529d4ebff30
 _GLOBAL__I_65535_0_.._deps_v8_src_heap_heap_verifier.cc_7874F2D3_0x98e85742896c204e
 _GLOBAL__I_65535_0_.._deps_v8_src_heap_objects_visiting.cc_DFF67DD7_0x4c0f84d7016fc70d
 _GLOBAL__I_65535_0_.._deps_v8_src_objects_tagged_impl.cc_87E8306D_0xa1e14aa90c304163
@@ -5997,7 +5997,7 @@ _GLOBAL__I_65535_0_.._deps_v8_src_sandbox_code_pointer_table.cc_87E8306D_0x18b1e
 _GLOBAL__I_65535_0_.._deps_v8_src_sandbox_external_pointer_table.cc_87E8306D_0xe024b3244e0d65d2
 _GLOBAL__I_65535_0_.._deps_v8_src_sandbox_sandbox.cc_87E8306D_0xd1d01372b263d45d
 _GLOBAL__I_65535_0_.._deps_v8_src_sandbox_testing.cc_7874F2D3_0x752cde940e7dfac2
-_GLOBAL__I_65535_0_.._src_connection_wrap.cc_E21CEA7D_0x39639a69027d399
+_GLOBAL__I_65535_0_.._src_connection_wrap.cc_E21CEA7D_0x4d37d11a258a2aed
 _GLOBAL__I_65535_0_OPENSSL_ppccap_P
 _GLOBAL__I_65535_0__Z16_register_configv
 _GLOBAL__I_65535_0__Z17_register_symbolsv
@@ -88942,10 +88942,10 @@ llhttp__internal__c_test_flags_3
 llhttp__internal__c_test_flags_4
 llhttp__internal__c_test_lenient_flags
 llhttp__internal__c_test_lenient_flags_1
-llhttp__internal__c_test_lenient_flags_19
 llhttp__internal__c_test_lenient_flags_2
-llhttp__internal__c_test_lenient_flags_21
-llhttp__internal__c_test_lenient_flags_23
+llhttp__internal__c_test_lenient_flags_20
+llhttp__internal__c_test_lenient_flags_22
+llhttp__internal__c_test_lenient_flags_24
 llhttp__internal__c_test_lenient_flags_3
 llhttp__internal__c_test_lenient_flags_4
 llhttp__internal__c_test_lenient_flags_7

package/include/node/node_version.h

@@ -24,7 +24,7 @@
 
 #define NODE_MAJOR_VERSION 21
 #define NODE_MINOR_VERSION 7
-#define NODE_PATCH_VERSION 1
+#define NODE_PATCH_VERSION 3
 
 #define NODE_VERSION_IS_LTS 0
 #define NODE_VERSION_LTS_CODENAME ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-aix-ppc64",
-  "version": "v21.7.1",
+  "version": "v21.7.3",
   "description": "node",
   "bin": {
     "node": "bin/node"