node-linux-arm64 14.18.0 → 14.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +166 -0
- package/LICENSE +26 -17
- package/bin/node +0 -0
- package/include/node/common.gypi +1 -1
- package/include/node/config.gypi +4 -2
- package/include/node/node.h +7 -1
- package/include/node/node_version.h +1 -1
- package/include/node/openssl/archs/BSD-x86/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/BSD-x86/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/BSD-x86/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/BSD-x86_64/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/BSD-x86_64/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN32/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN32/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN32/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN64A/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/VC-WIN64A/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/aix-gcc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/aix-gcc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/aix-gcc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/aix64-gcc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/aix64-gcc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/aix64-gcc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin-i386-cc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin-i386-cc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin64-arm64-cc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-aarch64/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-aarch64/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-aarch64/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-armv4/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-armv4/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-armv4/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-elf/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-elf/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-elf/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc64/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc64/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc64/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc64le/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-ppc64le/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-x32/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-x32/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-x32/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-x86_64/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-x86_64/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux-x86_64/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux32-s390x/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux32-s390x/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux32-s390x/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux64-mips64/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux64-mips64/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux64-mips64/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux64-s390x/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux64-s390x/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/linux64-s390x/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/solaris-x86-gcc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h +1 -1
- package/include/node/openssl/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h +1 -1
- package/include/node/openssl/ec.h +10 -7
- package/include/node/openssl/opensslv.h +2 -2
- package/package.json +1 -1
- package/share/man/man1/node.1 +5 -0
package/CHANGELOG.md
CHANGED
|
@@ -11,6 +11,10 @@
|
|
|
11
11
|
</tr>
|
|
12
12
|
<tr>
|
|
13
13
|
<td valign="top">
|
|
14
|
+
<a href="#14.19.0">14.19.0</a><br/>
|
|
15
|
+
<a href="#14.18.3">14.18.3</a><br/>
|
|
16
|
+
<a href="#14.18.2">14.18.2</a><br/>
|
|
17
|
+
<a href="#14.18.1">14.18.1</a><br/>
|
|
14
18
|
<a href="#14.18.0">14.18.0</a><br/>
|
|
15
19
|
<a href="#14.17.6">14.17.6</a><br/>
|
|
16
20
|
<a href="#14.17.5">14.17.5</a><br/>
|
|
@@ -66,6 +70,168 @@
|
|
|
66
70
|
* [io.js](CHANGELOG_IOJS.md)
|
|
67
71
|
* [Archive](CHANGELOG_ARCHIVE.md)
|
|
68
72
|
|
|
73
|
+
<a id="14.19.0"></a>
|
|
74
|
+
|
|
75
|
+
## 2022-02-01, Version 14.19.0 'Fermium' (LTS), @richardlau
|
|
76
|
+
|
|
77
|
+
### Notable Changes
|
|
78
|
+
|
|
79
|
+
#### Corepack
|
|
80
|
+
|
|
81
|
+
Node.js now includes Corepack, a script that acts as a bridge between Node.js projects and the package managers they are intended to be used with during development.
|
|
82
|
+
In practical terms, **Corepack will let you use Yarn and pnpm without having to install them** - just like what currently happens with npm, which is shipped in Node.js by default.
|
|
83
|
+
Please head over to the [Corepack documentation page](https://nodejs.org/dist/latest-v14.x/docs/api/corepack.html) for more information on how to use it.
|
|
84
|
+
|
|
85
|
+
Contributed by Maël Nison - [#39608](https://github.com/nodejs/node/pull/39608)
|
|
86
|
+
|
|
87
|
+
#### ICU updated
|
|
88
|
+
|
|
89
|
+
ICU has been updated to 70.1. This updates timezone database to 2021a3, including bringing forward the start for DST for Jordan from March to February.
|
|
90
|
+
|
|
91
|
+
Contributed by Michaël Zasso - [#40658](https://github.com/nodejs/node/pull/40658)
|
|
92
|
+
|
|
93
|
+
#### New option to disable loading of native addons
|
|
94
|
+
|
|
95
|
+
A new command line option `--no-addons` has been added to disallow loading of native addons.
|
|
96
|
+
|
|
97
|
+
Contributed by Dominic Elm - [#39977](https://github.com/nodejs/node/pull/39977)
|
|
98
|
+
|
|
99
|
+
#### Updated Root Certificates
|
|
100
|
+
|
|
101
|
+
Root certificates have been updated to those from Mozilla's Network Security Services 3.71.
|
|
102
|
+
|
|
103
|
+
Contributed by Richard Lau - [#40280](https://github.com/nodejs/node/pull/40280)
|
|
104
|
+
|
|
105
|
+
#### Other Notable Changes
|
|
106
|
+
|
|
107
|
+
* \[[`0d448eaab5`](https://github.com/nodejs/node/commit/0d448eaab5)] - **(SEMVER-MINOR)** **crypto**: make FIPS related options always available (Vít Ondruch) [#36341](https://github.com/nodejs/node/pull/36341)
|
|
108
|
+
* \[[`004eafbebf`](https://github.com/nodejs/node/commit/004eafbebf)] - **(SEMVER-MINOR)** **lib**: add unsubscribe method to non-active DC channels (simon-id) [#40433](https://github.com/nodejs/node/pull/40433)
|
|
109
|
+
* \[[`625be7585d`](https://github.com/nodejs/node/commit/625be7585d)] - **(SEMVER-MINOR)** **lib**: add return value for DC channel.unsubscribe (simon-id) [#40433](https://github.com/nodejs/node/pull/40433)
|
|
110
|
+
* \[[`607bc74eae`](https://github.com/nodejs/node/commit/607bc74eae)] - **(SEMVER-MINOR)** **module**: support pattern trailers (Guy Bedford) [#39635](https://github.com/nodejs/node/pull/39635)
|
|
111
|
+
* \[[`f74fe2a59c`](https://github.com/nodejs/node/commit/f74fe2a59c)] - **(SEMVER-MINOR)** **src**: make napi\_create\_reference accept symbol (JckXia) [#39926](https://github.com/nodejs/node/pull/39926)
|
|
112
|
+
|
|
113
|
+
### Commits
|
|
114
|
+
|
|
115
|
+
* \[[`0231ffa501`](https://github.com/nodejs/node/commit/0231ffa501)] - **build**: add `--without-corepack` (Jonah Snider) [#41060](https://github.com/nodejs/node/pull/41060)
|
|
116
|
+
* \[[`5389b8ab05`](https://github.com/nodejs/node/commit/5389b8ab05)] - **crypto**: update root certificates (Richard Lau) [#40280](https://github.com/nodejs/node/pull/40280)
|
|
117
|
+
* \[[`0d448eaab5`](https://github.com/nodejs/node/commit/0d448eaab5)] - **(SEMVER-MINOR)** **crypto**: make FIPS related options always available (Vít Ondruch) [#36341](https://github.com/nodejs/node/pull/36341)
|
|
118
|
+
* \[[`cd20ecc7cb`](https://github.com/nodejs/node/commit/cd20ecc7cb)] - **deps**: upgrade Corepack to 0.10 (Maël Nison) [#40374](https://github.com/nodejs/node/pull/40374)
|
|
119
|
+
* \[[`737df75e17`](https://github.com/nodejs/node/commit/737df75e17)] - **(SEMVER-MINOR)** **deps**: add corepack (Maël Nison) [#39608](https://github.com/nodejs/node/pull/39608)
|
|
120
|
+
* \[[`b85aa5a143`](https://github.com/nodejs/node/commit/b85aa5a143)] - **deps**: upgrade npm to 6.14.16 (Ruy Adorno) [#41603](https://github.com/nodejs/node/pull/41603)
|
|
121
|
+
* \[[`2755d391a5`](https://github.com/nodejs/node/commit/2755d391a5)] - **deps**: update ICU to 70.1 (Michaël Zasso) [#40658](https://github.com/nodejs/node/pull/40658)
|
|
122
|
+
* \[[`3089326d89`](https://github.com/nodejs/node/commit/3089326d89)] - **deps**: update archs files for OpenSSL-1.1.1m (Richard Lau) [#41173](https://github.com/nodejs/node/pull/41173)
|
|
123
|
+
* \[[`59da7c12aa`](https://github.com/nodejs/node/commit/59da7c12aa)] - **deps**: upgrade openssl sources to 1.1.1m (Richard Lau) [#41173](https://github.com/nodejs/node/pull/41173)
|
|
124
|
+
* \[[`cede1f26f6`](https://github.com/nodejs/node/commit/cede1f26f6)] - **deps**: add -fno-strict-aliasing flag to libuv (Daniel Bevenius) [#40631](https://github.com/nodejs/node/pull/40631)
|
|
125
|
+
* \[[`4477da858f`](https://github.com/nodejs/node/commit/4477da858f)] - **doc**: fix corepack grammar for `--force` flag (Steven) [#40762](https://github.com/nodejs/node/pull/40762)
|
|
126
|
+
* \[[`5971d58600`](https://github.com/nodejs/node/commit/5971d58600)] - **doc**: add missing YAML tag in `esm.md` (Antoine du Hamel) [#41516](https://github.com/nodejs/node/pull/41516)
|
|
127
|
+
* \[[`e903798ae1`](https://github.com/nodejs/node/commit/e903798ae1)] - **doc**: add note regarding unfinished TLA (Antoine du Hamel) [#41434](https://github.com/nodejs/node/pull/41434)
|
|
128
|
+
* \[[`a90defebcf`](https://github.com/nodejs/node/commit/a90defebcf)] - **esm**: make `process.exit()` default to exit code 0 (Gang Chen) [#41388](https://github.com/nodejs/node/pull/41388)
|
|
129
|
+
* \[[`fc328f1ab0`](https://github.com/nodejs/node/commit/fc328f1ab0)] - **fs**: nullish coalescing to respect zero positional reads (Omar El-Mihilmy) [#40716](https://github.com/nodejs/node/pull/40716)
|
|
130
|
+
* \[[`004eafbebf`](https://github.com/nodejs/node/commit/004eafbebf)] - **(SEMVER-MINOR)** **lib**: add unsubscribe method to non-active DC channels (simon-id) [#40433](https://github.com/nodejs/node/pull/40433)
|
|
131
|
+
* \[[`625be7585d`](https://github.com/nodejs/node/commit/625be7585d)] - **(SEMVER-MINOR)** **lib**: add return value for DC channel.unsubscribe (simon-id) [#40433](https://github.com/nodejs/node/pull/40433)
|
|
132
|
+
* \[[`2c365961d0`](https://github.com/nodejs/node/commit/2c365961d0)] - **module**: support pattern trailers for imports field (Guy Bedford) [#40041](https://github.com/nodejs/node/pull/40041)
|
|
133
|
+
* \[[`607bc74eae`](https://github.com/nodejs/node/commit/607bc74eae)] - **(SEMVER-MINOR)** **module**: support pattern trailers (Guy Bedford) [#39635](https://github.com/nodejs/node/pull/39635)
|
|
134
|
+
* \[[`f74fe2a59c`](https://github.com/nodejs/node/commit/f74fe2a59c)] - **(SEMVER-MINOR)** **src**: make napi\_create\_reference accept symbol (JckXia) [#39926](https://github.com/nodejs/node/pull/39926)
|
|
135
|
+
* \[[`b050c65885`](https://github.com/nodejs/node/commit/b050c65885)] - **src**: add option to disable loading native addons (Dominic Elm) [#39977](https://github.com/nodejs/node/pull/39977)
|
|
136
|
+
* \[[`c1695ac68a`](https://github.com/nodejs/node/commit/c1695ac68a)] - **tools**: update certdata.txt (Richard Lau) [#40280](https://github.com/nodejs/node/pull/40280)
|
|
137
|
+
|
|
138
|
+
<a id="14.18.3"></a>
|
|
139
|
+
## 2022-01-10, Version 14.18.3 'Fermium' (LTS), @richardlau
|
|
140
|
+
|
|
141
|
+
This is a security release.
|
|
142
|
+
|
|
143
|
+
### Notable changes
|
|
144
|
+
|
|
145
|
+
#### Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
|
|
146
|
+
|
|
147
|
+
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
|
|
148
|
+
|
|
149
|
+
Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the `--security-revert` command-line option.
|
|
150
|
+
|
|
151
|
+
More details will be available at [CVE-2021-44531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531) after publication.
|
|
152
|
+
|
|
153
|
+
#### Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
|
|
154
|
+
|
|
155
|
+
Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
|
|
156
|
+
|
|
157
|
+
Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the `--security-revert` command-line option.
|
|
158
|
+
|
|
159
|
+
More details will be available at [CVE-2021-44532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532) after publication.
|
|
160
|
+
|
|
161
|
+
#### Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
|
|
162
|
+
|
|
163
|
+
Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
|
|
164
|
+
|
|
165
|
+
Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
|
|
166
|
+
|
|
167
|
+
More details will be available at [CVE-2021-44533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533) after publication.
|
|
168
|
+
|
|
169
|
+
#### Prototype pollution via `console.table` properties (Low)(CVE-2022-21824)
|
|
170
|
+
|
|
171
|
+
Due to the formatting logic of the `console.table()` function it was not safe to allow user controlled input to be passed to the `properties` parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be `__proto__`. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype.
|
|
172
|
+
|
|
173
|
+
Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.
|
|
174
|
+
|
|
175
|
+
More details will be available at [CVE-2022-21824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824) after publication.
|
|
176
|
+
|
|
177
|
+
Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability.
|
|
178
|
+
|
|
179
|
+
### Commits
|
|
180
|
+
|
|
181
|
+
* \[[`e2a74f3c99`](https://github.com/nodejs/node/commit/e2a74f3c99)] - **console**: fix prototype pollution via console.table (Tobias Nießen) [nodejs-private/node-private#307](https://github.com/nodejs-private/node-private/pull/307)
|
|
182
|
+
* \[[`df1b2c33f6`](https://github.com/nodejs/node/commit/df1b2c33f6)] - **crypto,tls**: implement safe x509 GeneralName format (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
|
|
183
|
+
* \[[`9f2c52617f`](https://github.com/nodejs/node/commit/9f2c52617f)] - **src**: add cve reverts and associated tests (Michael Dawson and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
|
|
184
|
+
* \[[`b14be42518`](https://github.com/nodejs/node/commit/b14be42518)] - **src**: remove unused x509 functions (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
|
|
185
|
+
* \[[`83d8f880bb`](https://github.com/nodejs/node/commit/83d8f880bb)] - **tls**: fix handling of x509 subject and issuer (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
|
|
186
|
+
* \[[`461a0c674b`](https://github.com/nodejs/node/commit/461a0c674b)] - **tls**: drop support for URI alternative names (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
|
|
187
|
+
|
|
188
|
+
<a id="14.18.2"></a>
|
|
189
|
+
## 2021-11-30, Version 14.18.2 'Fermium' (LTS), @richardlau
|
|
190
|
+
|
|
191
|
+
### Notable changes
|
|
192
|
+
|
|
193
|
+
This release contains a c-ares update to fix a regression introduced in
|
|
194
|
+
Node.js 14.17.5 resolving CNAME records containing underscores
|
|
195
|
+
[#39780](https://github.com/nodejs/node/issues/39780).
|
|
196
|
+
|
|
197
|
+
Also included are commits to allow Node.js 14 to continue to build and
|
|
198
|
+
pass tests on our Jenkins CI, including adding Python 3.10 to the list
|
|
199
|
+
of allowable Python versions for building.
|
|
200
|
+
|
|
201
|
+
### Commits
|
|
202
|
+
|
|
203
|
+
* \[[`7923c61a62`](https://github.com/nodejs/node/commit/7923c61a62)] - **build**: pin build-docs workflow to Node.js 14 (Richard Lau) [#40939](https://github.com/nodejs/node/pull/40939)
|
|
204
|
+
* \[[`da356128fb`](https://github.com/nodejs/node/commit/da356128fb)] - **build**: support Python 3.10.0 (FrankQiu) [#40296](https://github.com/nodejs/node/pull/40296)
|
|
205
|
+
* \[[`9c3a85d279`](https://github.com/nodejs/node/commit/9c3a85d279)] - **deps**: update c-ares to 1.18.1 (Richard Lau) [#40660](https://github.com/nodejs/node/pull/40660)
|
|
206
|
+
* \[[`cd7c340545`](https://github.com/nodejs/node/commit/cd7c340545)] - **deps**: V8: patch jinja2 for Python 3.10 compat (Michaël Zasso) [#40296](https://github.com/nodejs/node/pull/40296)
|
|
207
|
+
* \[[`6330d435f5`](https://github.com/nodejs/node/commit/6330d435f5)] - **doc**: mark Node.js 10 as End-of-Life (Richard Lau) [#38482](https://github.com/nodejs/node/pull/38482)
|
|
208
|
+
* \[[`8ca082ec71`](https://github.com/nodejs/node/commit/8ca082ec71)] - **doc**: fix CJS-ESM selector in Safari (Bradley Farias) [#40135](https://github.com/nodejs/node/pull/40135)
|
|
209
|
+
* \[[`92490d1c89`](https://github.com/nodejs/node/commit/92490d1c89)] - **doc**: add macOS arm64 experimental status (Michael Rienstra) [#40127](https://github.com/nodejs/node/pull/40127)
|
|
210
|
+
* \[[`8894bdd4d8`](https://github.com/nodejs/node/commit/8894bdd4d8)] - **lib**: fix regular expression to detect \`/\` and \`\\\` (Francesco Trotta) [#40325](https://github.com/nodejs/node/pull/40325)
|
|
211
|
+
* \[[`704989b698`](https://github.com/nodejs/node/commit/704989b698)] - **test**: deflake child-process-pipe-dataflow (Luigi Pinca) [#40838](https://github.com/nodejs/node/pull/40838)
|
|
212
|
+
* \[[`df401cd346`](https://github.com/nodejs/node/commit/df401cd346)] - **test**: update upload.zip to be uncorrupted (Greg Ziskind) [#37294](https://github.com/nodejs/node/pull/37294)
|
|
213
|
+
* \[[`aa947f7dbf`](https://github.com/nodejs/node/commit/aa947f7dbf)] - **tools**: add script to update c-ares (Richard Lau) [#40660](https://github.com/nodejs/node/pull/40660)
|
|
214
|
+
* \[[`6b7b2bba41`](https://github.com/nodejs/node/commit/6b7b2bba41)] - **tools**: patch jinja2 for Python 3.10 compat (Michaël Zasso) [#40296](https://github.com/nodejs/node/pull/40296)
|
|
215
|
+
* \[[`39583f77d8`](https://github.com/nodejs/node/commit/39583f77d8)] - **worker**: avoid potential deadlock on NearHeapLimit (Santiago Gimeno) [#38403](https://github.com/nodejs/node/pull/38403)
|
|
216
|
+
|
|
217
|
+
<a id="14.18.1"></a>
|
|
218
|
+
## 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams
|
|
219
|
+
|
|
220
|
+
This is a security release.
|
|
221
|
+
|
|
222
|
+
### Notable changes
|
|
223
|
+
|
|
224
|
+
* **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium)
|
|
225
|
+
* The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication.
|
|
226
|
+
* **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium)
|
|
227
|
+
* The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication.
|
|
228
|
+
|
|
229
|
+
### Commits
|
|
230
|
+
|
|
231
|
+
* [[`8c254ca7e4`](https://github.com/nodejs/node/commit/8c254ca7e4)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285)
|
|
232
|
+
* [[`9b92ae2499`](https://github.com/nodejs/node/commit/9b92ae2499)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285)
|
|
233
|
+
* [[`f467539719`](https://github.com/nodejs/node/commit/f467539719)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285)
|
|
234
|
+
|
|
69
235
|
<a id="14.18.0"></a>
|
|
70
236
|
## 2021-09-28, Version 14.18.0 'Fermium' (LTS), @targos
|
|
71
237
|
|
package/LICENSE
CHANGED
|
@@ -392,31 +392,29 @@ The externally maintained libraries used by Node.js are:
|
|
|
392
392
|
|
|
393
393
|
3. Lao Word Break Dictionary Data (laodict.txt)
|
|
394
394
|
|
|
395
|
-
#
|
|
396
|
-
#
|
|
395
|
+
# Copyright (C) 2016 and later: Unicode, Inc. and others.
|
|
396
|
+
# License & terms of use: http://www.unicode.org/copyright.html
|
|
397
|
+
# Copyright (c) 2015 International Business Machines Corporation
|
|
398
|
+
# and others. All Rights Reserved.
|
|
397
399
|
#
|
|
398
|
-
# Project: https://github.com/
|
|
399
|
-
# Dictionary: https://github.com/
|
|
400
|
-
# License: https://github.com/
|
|
401
|
-
#
|
|
400
|
+
# Project: https://github.com/rober42539/lao-dictionary
|
|
401
|
+
# Dictionary: https://github.com/rober42539/lao-dictionary/laodict.txt
|
|
402
|
+
# License: https://github.com/rober42539/lao-dictionary/LICENSE.txt
|
|
403
|
+
# (copied below)
|
|
402
404
|
#
|
|
403
|
-
#
|
|
404
|
-
# modifications.
|
|
405
|
+
# This file is derived from the above dictionary version of Nov 22, 2020
|
|
405
406
|
# ----------------------------------------------------------------------
|
|
406
407
|
# Copyright (C) 2013 Brian Eugene Wilson, Robert Martin Campbell.
|
|
407
408
|
# All rights reserved.
|
|
408
409
|
#
|
|
409
410
|
# Redistribution and use in source and binary forms, with or without
|
|
410
|
-
# modification,
|
|
411
|
-
# are permitted provided that the following conditions are met:
|
|
412
|
-
#
|
|
413
|
-
#
|
|
414
|
-
# Redistributions of source code must retain the above copyright notice, this
|
|
415
|
-
# list of conditions and the following disclaimer. Redistributions in
|
|
416
|
-
# binary form must reproduce the above copyright notice, this list of
|
|
417
|
-
# conditions and the following disclaimer in the documentation and/or
|
|
418
|
-
# other materials provided with the distribution.
|
|
411
|
+
# modification, are permitted provided that the following conditions are met:
|
|
419
412
|
#
|
|
413
|
+
# Redistributions of source code must retain the above copyright notice, this
|
|
414
|
+
# list of conditions and the following disclaimer. Redistributions in binary
|
|
415
|
+
# form must reproduce the above copyright notice, this list of conditions and
|
|
416
|
+
# the following disclaimer in the documentation and/or other materials
|
|
417
|
+
# provided with the distribution.
|
|
420
418
|
#
|
|
421
419
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
422
420
|
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
@@ -625,6 +623,17 @@ The externally maintained libraries used by Node.js are:
|
|
|
625
623
|
USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
626
624
|
"""
|
|
627
625
|
|
|
626
|
+
- corepack, located at deps/corepack, is licensed as follows:
|
|
627
|
+
"""
|
|
628
|
+
**Copyright © Corepack contributors**
|
|
629
|
+
|
|
630
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
631
|
+
|
|
632
|
+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
633
|
+
|
|
634
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
635
|
+
"""
|
|
636
|
+
|
|
628
637
|
- OpenSSL, located at deps/openssl, is licensed as follows:
|
|
629
638
|
"""
|
|
630
639
|
Copyright (c) 1998-2019 The OpenSSL Project. All rights reserved.
|
package/bin/node
CHANGED
|
Binary file
|
package/include/node/common.gypi
CHANGED
package/include/node/config.gypi
CHANGED
|
@@ -17,18 +17,19 @@
|
|
|
17
17
|
'force_dynamic_crt': 0,
|
|
18
18
|
'gas_version': '2.30',
|
|
19
19
|
'host_arch': 'arm64',
|
|
20
|
-
'icu_data_in': '../../deps/icu-tmp/
|
|
20
|
+
'icu_data_in': '../../deps/icu-tmp/icudt70l.dat',
|
|
21
21
|
'icu_endianness': 'l',
|
|
22
22
|
'icu_gyp_path': 'tools/icu/icu-generic.gyp',
|
|
23
23
|
'icu_path': 'deps/icu-small',
|
|
24
24
|
'icu_small': 'false',
|
|
25
|
-
'icu_ver_major': '
|
|
25
|
+
'icu_ver_major': '70',
|
|
26
26
|
'is_debug': 0,
|
|
27
27
|
'llvm_version': '0.0',
|
|
28
28
|
'napi_build_version': '8',
|
|
29
29
|
'node_byteorder': 'little',
|
|
30
30
|
'node_debug_lib': 'false',
|
|
31
31
|
'node_enable_d8': 'false',
|
|
32
|
+
'node_install_corepack': 'true',
|
|
32
33
|
'node_install_npm': 'true',
|
|
33
34
|
'node_library_files': [ 'lib/_http_client.js',
|
|
34
35
|
'lib/diagnostics_channel.js',
|
|
@@ -202,6 +203,7 @@
|
|
|
202
203
|
'lib/internal/modules/esm/loader.js',
|
|
203
204
|
'lib/internal/modules/esm/resolve.js',
|
|
204
205
|
'lib/internal/modules/esm/create_dynamic_module.js',
|
|
206
|
+
'lib/internal/modules/esm/handle_process_exit.js',
|
|
205
207
|
'lib/internal/modules/esm/translators.js',
|
|
206
208
|
'lib/internal/modules/esm/get_format.js',
|
|
207
209
|
'lib/internal/modules/esm/get_source.js',
|
package/include/node/node.h
CHANGED
|
@@ -428,7 +428,13 @@ enum Flags : uint64_t {
|
|
|
428
428
|
// Set this flag to force hiding console windows when spawning child
|
|
429
429
|
// processes. This is usually used when embedding Node.js in GUI programs on
|
|
430
430
|
// Windows.
|
|
431
|
-
kHideConsoleWindows = 1 << 5
|
|
431
|
+
kHideConsoleWindows = 1 << 5,
|
|
432
|
+
// Set this flag to disable loading native addons via `process.dlopen`.
|
|
433
|
+
// This environment flag is especially important for worker threads
|
|
434
|
+
// so that a worker thread can't load a native addon even if `execArgv`
|
|
435
|
+
// is overwritten and `--no-addons` is not specified but was specified
|
|
436
|
+
// for this Environment instance.
|
|
437
|
+
kNoNativeAddons = 1 << 6
|
|
432
438
|
};
|
|
433
439
|
} // namespace EnvironmentFlags
|
|
434
440
|
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
*/
|
|
12
12
|
|
|
13
13
|
#define PLATFORM "platform: solaris64-x86_64-gcc"
|
|
14
|
-
#define DATE "built on: Tue
|
|
14
|
+
#define DATE "built on: Tue Dec 14 17:36:48 2021 UTC"
|
|
15
15
|
|
|
16
16
|
/*
|
|
17
17
|
* Generate compiler_flags as an array of individual characters. This is a
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
*/
|
|
12
12
|
|
|
13
13
|
#define PLATFORM "platform: solaris64-x86_64-gcc"
|
|
14
|
-
#define DATE "built on: Tue
|
|
14
|
+
#define DATE "built on: Tue Dec 14 17:36:59 2021 UTC"
|
|
15
15
|
|
|
16
16
|
/*
|
|
17
17
|
* Generate compiler_flags as an array of individual characters. This is a
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
*/
|
|
12
12
|
|
|
13
13
|
#define PLATFORM "platform: solaris64-x86_64-gcc"
|
|
14
|
-
#define DATE "built on: Tue
|
|
14
|
+
#define DATE "built on: Tue Dec 14 17:37:10 2021 UTC"
|
|
15
15
|
|
|
16
16
|
/*
|
|
17
17
|
* Generate compiler_flags as an array of individual characters. This is a
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright 2002-
|
|
2
|
+
* Copyright 2002-2021 The OpenSSL Project Authors. All Rights Reserved.
|
|
3
3
|
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
|
|
4
4
|
*
|
|
5
5
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
@@ -793,12 +793,15 @@ int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1,
|
|
|
793
793
|
EC_GROUP *d2i_ECPKParameters(EC_GROUP **, const unsigned char **in, long len);
|
|
794
794
|
int i2d_ECPKParameters(const EC_GROUP *, unsigned char **out);
|
|
795
795
|
|
|
796
|
-
# define d2i_ECPKParameters_bio(bp,x)
|
|
797
|
-
|
|
798
|
-
# define
|
|
799
|
-
|
|
800
|
-
# define
|
|
801
|
-
|
|
796
|
+
# define d2i_ECPKParameters_bio(bp,x) \
|
|
797
|
+
ASN1_d2i_bio_of(EC_GROUP, NULL, d2i_ECPKParameters, bp, x)
|
|
798
|
+
# define i2d_ECPKParameters_bio(bp,x) \
|
|
799
|
+
ASN1_i2d_bio_of_const(EC_GROUP, i2d_ECPKParameters, bp, x)
|
|
800
|
+
# define d2i_ECPKParameters_fp(fp,x) \
|
|
801
|
+
(EC_GROUP *)ASN1_d2i_fp(NULL, (d2i_of_void *)d2i_ECPKParameters, (fp), \
|
|
802
|
+
(void **)(x))
|
|
803
|
+
# define i2d_ECPKParameters_fp(fp,x) \
|
|
804
|
+
ASN1_i2d_fp((i2d_of_void *)i2d_ECPKParameters, (fp), (void *)(x))
|
|
802
805
|
|
|
803
806
|
int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off);
|
|
804
807
|
# ifndef OPENSSL_NO_STDIO
|
|
@@ -39,8 +39,8 @@ extern "C" {
|
|
|
39
39
|
* (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
|
|
40
40
|
* major minor fix final patch/beta)
|
|
41
41
|
*/
|
|
42
|
-
# define OPENSSL_VERSION_NUMBER
|
|
43
|
-
# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.
|
|
42
|
+
# define OPENSSL_VERSION_NUMBER 0x101010dfL
|
|
43
|
+
# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1m 14 Dec 2021"
|
|
44
44
|
|
|
45
45
|
/*-
|
|
46
46
|
* The macros below are to be used for shared library (.so, .dll, ...)
|
package/package.json
CHANGED
package/share/man/man1/node.1
CHANGED
|
@@ -282,6 +282,11 @@ Silence deprecation warnings.
|
|
|
282
282
|
Disable runtime checks for `async_hooks`.
|
|
283
283
|
These will still be enabled dynamically when `async_hooks` is enabled.
|
|
284
284
|
.
|
|
285
|
+
.It Fl -no-addons
|
|
286
|
+
Disable the `node-addons` exports condition as well as disable loading native
|
|
287
|
+
addons. When `--no-addons` is specified, calling `process.dlopen` or requiring
|
|
288
|
+
a native C++ addon will fail and throw an exception.
|
|
289
|
+
.
|
|
285
290
|
.It Fl -no-warnings
|
|
286
291
|
Silence all process warnings (including deprecations).
|
|
287
292
|
.
|