search

ecomplus / app-tiny-erp

E-Com Plus app to integrate Tiny ERP
GNU General Public License v3.0
0 stars 4 forks source link

chore(deps): update all non-major dependencies #148

Open renovate[bot] opened 1 year ago

renovate[bot] commented 1 year ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
@commitlint/cli (source) ^17.7.1 -> ^17.8.1 age adoption passing confidence devDependencies patch
@commitlint/config-conventional (source) ^17.7.0 -> ^17.8.1 age adoption passing confidence devDependencies patch
@google-cloud/firestore ^6.7.0 -> ^6.8.0 age adoption passing confidence dependencies minor
@google-cloud/pubsub ^4.0.6 -> ^4.8.0 age adoption passing confidence dependencies minor
eslint (source) ^8.57.0 -> ^8.57.1 age adoption passing confidence devDependencies patch
firebase-functions ^4.4.1 -> ^4.9.0 age adoption passing confidence dependencies minor
form-data ^3.0.1 -> ^3.0.2 age adoption passing confidence dependencies patch
node (source) 16 -> 16.20.2 age adoption passing confidence minor
node (source) 16 -> 16.20.2 age adoption passing confidence engines minor
standard (source) ^17.1.0 -> ^17.1.2 age adoption passing confidence devDependencies patch
uglify-js ^3.17.4 -> ^3.19.3 age adoption passing confidence dependencies patch

Release Notes

googleapis/nodejs-firestore (@​google-cloud/firestore) ### [`v6.8.0`](https://redirect.github.com/googleapis/nodejs-firestore/blob/HEAD/CHANGELOG.md#680-2023-09-26) [Compare Source](https://redirect.github.com/googleapis/nodejs-firestore/compare/v6.7.0...v6.8.0) ##### Features - Publish proto definitions for SUM/AVG in Firestore ([#​1856](https://redirect.github.com/googleapis/nodejs-firestore/issues/1856)) ([ac35b37](https://redirect.github.com/googleapis/nodejs-firestore/commit/ac35b372faf32f093d83af18d487f1b3f23ee673)) ##### Bug Fixes - **deps:** Use protobufjs v7.2.5 ([#​1889](https://redirect.github.com/googleapis/nodejs-firestore/pull/1889)) - Add tests for multiple inequality support ([#​1878](https://redirect.github.com/googleapis/nodejs-firestore/issues/1878)) ([8e621d5](https://redirect.github.com/googleapis/nodejs-firestore/commit/8e621d580396b7e3bc7e42dad0c63f91e999411f))
googleapis/nodejs-pubsub (@​google-cloud/pubsub) ### [`v4.8.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#480-2024-10-15) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.7.2...v4.8.0) ##### Features - Add ingestion Cloud Storage fields and Platform Logging fields to Topic ([#​1974](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1974)) ([afec9a1](https://redirect.github.com/googleapis/nodejs-pubsub/commit/afec9a1ad3f665a71f08e748623f0fdaa332d17b)) - Return listing information for subscriptions created via Analytics Hub ([afec9a1](https://redirect.github.com/googleapis/nodejs-pubsub/commit/afec9a1ad3f665a71f08e748623f0fdaa332d17b)) ### [`v4.7.2`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#472-2024-09-13) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.7.1...v4.7.2) ##### Bug Fixes - Set MaxBytes for AckQueue ([#​1963](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1963)) ([5945563](https://redirect.github.com/googleapis/nodejs-pubsub/commit/594556315f159f4197ffc0e7249ce1b0339c12ec)) ### [`v4.7.1`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#471-2024-08-26) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.7.0...v4.7.1) ##### Bug Fixes - **deps:** Update dependency [@​opentelemetry/semantic-conventions](https://redirect.github.com/opentelemetry/semantic-conventions) to ~1.26.0 ([#​1945](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1945)) ([f082869](https://redirect.github.com/googleapis/nodejs-pubsub/commit/f082869a185c059463654c76c744e44e7b28415e)) - **deps:** Update dependency protobufjs to ~7.4.0 ([#​1959](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1959)) ([25946e0](https://redirect.github.com/googleapis/nodejs-pubsub/commit/25946e0d4fe794202984cdad6cf48121f72063cf)) - Propagate set options to LeaseManager (from [https://github.com/googleapis/nodejs-pubsub/pull/1880](https://redirect.github.com/googleapis/nodejs-pubsub/pull/1880)) ([#​1954](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1954)) ([cdb0916](https://redirect.github.com/googleapis/nodejs-pubsub/commit/cdb0916bd30da67f5153c9aead09e7f505954253)) ### [`v4.7.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#470-2024-08-24) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.6.0...v4.7.0) ##### Features - Add support for OTel context propagation and harmonized spans ([#​1833](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1833)) ([4b5c90d](https://redirect.github.com/googleapis/nodejs-pubsub/commit/4b5c90dc334e90cefb4da3c6fe9ce027b50aacb8)) ### [`v4.6.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#460-2024-07-12) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.5.0...v4.6.0) ##### Features - Add max messages batching for Cloud Storage subscriptions ([#​1956](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1956)) ([90546f6](https://redirect.github.com/googleapis/nodejs-pubsub/commit/90546f634cc4e510185e20a4d1ba1c74ebc59b85)) - Add use_topic_schema for Cloud Storage Subscriptions ([#​1948](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1948)) ([120fa1b](https://redirect.github.com/googleapis/nodejs-pubsub/commit/120fa1bca0516185e109260c69ea91eb7ddeecd0)) ##### Bug Fixes - **docs samples:** Update missing argv in sample metadata for push subscription ([#​1946](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1946)) ([34b8c03](https://redirect.github.com/googleapis/nodejs-pubsub/commit/34b8c03f90618ba6ae506764b9d97d9db84dcada)) ### [`v4.5.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#450-2024-06-11) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.4.1...v4.5.0) ##### Features - Add service_account_email for export subscriptions ([#​1927](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1927)) ([c532854](https://redirect.github.com/googleapis/nodejs-pubsub/commit/c53285473c2c0973baf5932e52d2d135958c6948)) ### [`v4.4.1`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#441-2024-05-30) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.4.0...v4.4.1) ##### Bug Fixes - An existing message `UpdateVehicleLocationRequest` is removed ([5451d15](https://redirect.github.com/googleapis/nodejs-pubsub/commit/5451d150e77d46a475e7a8e150a7f6b5d04d6448)) - An existing method `SearchFuzzedVehicles` is removed from service `VehicleService` ([5451d15](https://redirect.github.com/googleapis/nodejs-pubsub/commit/5451d150e77d46a475e7a8e150a7f6b5d04d6448)) - An existing method `UpdateVehicleLocation` is removed from service `VehicleService` ([5451d15](https://redirect.github.com/googleapis/nodejs-pubsub/commit/5451d150e77d46a475e7a8e150a7f6b5d04d6448)) - **deps:** Update dependency protobufjs to ~7.3.0 ([#​1921](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1921)) ([c5afd34](https://redirect.github.com/googleapis/nodejs-pubsub/commit/c5afd3400cc8ff9f920b4b232c4e4a5fb41eb07b)) - Pull in new gax for protobufjs vuln fix ([#​1925](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1925)) ([8024c6d](https://redirect.github.com/googleapis/nodejs-pubsub/commit/8024c6d2e4ce69f97fd8b64bb9f076e33d47c662)) ### [`v4.4.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#440-2024-05-03) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.3.3...v4.4.0) ##### Features - Add several fields to manage state of database encryption update ([#​1904](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1904)) ([aba9aee](https://redirect.github.com/googleapis/nodejs-pubsub/commit/aba9aee0c8ecc840c150aa077892b7bb88f18eca)) ##### Bug Fixes - **deps:** Update dependency [@​types/long](https://redirect.github.com/types/long) to v5 ([#​1901](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1901)) ([d13d395](https://redirect.github.com/googleapis/nodejs-pubsub/commit/d13d395341efacf926a126bf756873922f6bbab7)) ### [`v4.3.3`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#433-2024-03-03) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.3.2...v4.3.3) ##### Bug Fixes - Add client library version to headers ([#​1891](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1891)) ([6b59195](https://redirect.github.com/googleapis/nodejs-pubsub/commit/6b59195aed8b6c6576e50512aeca9123ad0cc016)) ### [`v4.3.2`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#432-2024-02-13) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.3.1...v4.3.2) ##### Bug Fixes - Update minimum google-gax versions for auth fixes ([#​1888](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1888)) ([08acade](https://redirect.github.com/googleapis/nodejs-pubsub/commit/08acadee042c6a3b85344575d5d0be09ae6e4202)) ### [`v4.3.1`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#431-2024-02-08) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.3.0...v4.3.1) ##### Bug Fixes - Add option to manually control emulator auth handling, and fix heuristics for TPC ([#​1861](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1861)) ([761cdc8](https://redirect.github.com/googleapis/nodejs-pubsub/commit/761cdc898c69715e6775d2f5913ead1fca2def02)) ### [`v4.3.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#430-2024-02-05) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.2.0...v4.3.0) ##### Features - Trusted Private Cloud support, use the universeDomain parameter ([#​1878](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1878)) ([d89fd1d](https://redirect.github.com/googleapis/nodejs-pubsub/commit/d89fd1d90b352f0cc7a50a72c5fec4aab6660f8f)) ##### Bug Fixes - Updated google-gax required for TPC ([#​1882](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1882)) ([1445856](https://redirect.github.com/googleapis/nodejs-pubsub/commit/144585699595b97f1a4cc28551e45fe23305f480)) ### [`v4.2.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#420-2024-02-01) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.1.1...v4.2.0) ##### Features - Add enforce_in_transit fields and optional annotations ([#​1873](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1873)) ([09fc424](https://redirect.github.com/googleapis/nodejs-pubsub/commit/09fc4241c8782d2f60c1a78dda316628eca5f751)) - Add schema revision samples ([#​1870](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1870)) ([044e149](https://redirect.github.com/googleapis/nodejs-pubsub/commit/044e1494d82fd64010f7c6f872982d659e753499)) ##### Bug Fixes - **deps:** Update dependency [@​opentelemetry/semantic-conventions](https://redirect.github.com/opentelemetry/semantic-conventions) to ~1.20.0 ([#​1871](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1871)) ([2ee0dba](https://redirect.github.com/googleapis/nodejs-pubsub/commit/2ee0dba67e6d66d9a678796de6172bcafd28796b)) - **deps:** Update dependency [@​opentelemetry/semantic-conventions](https://redirect.github.com/opentelemetry/semantic-conventions) to ~1.21.0 ([#​1876](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1876)) ([0fe61a9](https://redirect.github.com/googleapis/nodejs-pubsub/commit/0fe61a95b3bfc21bd1a5176c7fbd7f822ece5a5c)) ### [`v4.1.1`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#411-2024-01-05) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.1.0...v4.1.1) ##### Bug Fixes - Correct long audio synthesis HTTP binding ([#​1867](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1867)) ([65940a4](https://redirect.github.com/googleapis/nodejs-pubsub/commit/65940a40fe8f2301690d26f769571a198f747dd3)) - **deps:** Update dependency [@​opentelemetry/semantic-conventions](https://redirect.github.com/opentelemetry/semantic-conventions) to ~1.19.0 ([#​1862](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1862)) ([92259f5](https://redirect.github.com/googleapis/nodejs-pubsub/commit/92259f5bffee05036f1746990b021299ea3ea4e7)) ### [`v4.1.0`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#410-2023-12-04) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.0.7...v4.1.0) ##### Features - Add `use_table_schema` field to BigQueryConfig ([#​1858](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1858)) ([2875d83](https://redirect.github.com/googleapis/nodejs-pubsub/commit/2875d8383831563e5b748e96094faa94bf25fc15)) ### [`v4.0.7`](https://redirect.github.com/googleapis/nodejs-pubsub/blob/HEAD/CHANGELOG.md#407-2023-11-09) [Compare Source](https://redirect.github.com/googleapis/nodejs-pubsub/compare/v4.0.6...v4.0.7) ##### Bug Fixes - **deps:** Update dependency [@​opentelemetry/semantic-conventions](https://redirect.github.com/opentelemetry/semantic-conventions) to ~1.18.0 ([#​1852](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1852)) ([d9a0432](https://redirect.github.com/googleapis/nodejs-pubsub/commit/d9a0432a37c6d741c9694a5bcff047f4c85b2feb)) - Set x-goog-request-params for streaming pull request ([#​1849](https://redirect.github.com/googleapis/nodejs-pubsub/issues/1849)) ([7b82ff0](https://redirect.github.com/googleapis/nodejs-pubsub/commit/7b82ff01e5c654b3e339dfdec5b3da8bf45da049))
eslint/eslint (eslint) ### [`v8.57.1`](https://redirect.github.com/eslint/eslint/compare/v8.57.0...5b9414c501c58bfa85f41f96f821973c41e8ae74) [Compare Source](https://redirect.github.com/eslint/eslint/compare/v8.57.0...v8.57.1)
firebase/firebase-functions (firebase-functions) ### [`v4.9.0`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.9.0) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.8.2...v4.9.0) - Add new 2nd gen Firestore auth context triggers. ([#​1519](https://redirect.github.com/firebase/firebase-functions/issues/1519)) ### [`v4.8.2`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.8.2) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.8.1...v4.8.2) Fix bug with CORS options for an array of one string ([#​1544](https://redirect.github.com/firebase/firebase-functions/issues/1544)) ### [`v4.8.1`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.8.1) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.8.0...v4.8.1) Fix bug where 1st gen functions eventually fail with stack too deep ([#​1540](https://redirect.github.com/firebase/firebase-functions/issues/1540)) Make simple CORS options static for improved debugability ([#​1536](https://redirect.github.com/firebase/firebase-functions/issues/1536)) ### [`v4.8.0`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.8.0) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.7.0...v4.8.0) Add onInit callback function for global variable initialization ([#​1531](https://redirect.github.com/firebase/firebase-functions/issues/1531)) ### [`v4.7.0`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.7.0) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.6.0...v4.7.0) - Fixes access on deeply nested, nonexistent property. ([#​1432](https://redirect.github.com/firebase/firebase-functions/issues/1432)) - Add IteratedDataSnapshot interface to match with firebase admin v12 ([#​1517](https://redirect.github.com/firebase/firebase-functions/issues/1517)). - Make bucket parameterizeable in storage functions ([#​1518](https://redirect.github.com/firebase/firebase-functions/issues/1518)) - Introduce helper library for select and multi-select input ([#​1518](https://redirect.github.com/firebase/firebase-functions/issues/1518)) ### [`v4.6.0`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.6.0) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.5.0...v4.6.0) - Wrap 2nd gen onCall functions with trace context. ([#​1491](https://redirect.github.com/firebase/firebase-functions/issues/1491)) - Bump peer depdencies for firebase-admin to support 12.0.0. ([#​1509](https://redirect.github.com/firebase/firebase-functions/issues/1509)) ### [`v4.5.0`](https://redirect.github.com/firebase/firebase-functions/releases/tag/v4.5.0) [Compare Source](https://redirect.github.com/firebase/firebase-functions/compare/v4.4.1...v4.5.0) - Remove HTTP server shutdown message. ([#​1457](https://redirect.github.com/firebase/firebase-functions/issues/1457)) - Add features to task queue functions. ([#​1423](https://redirect.github.com/firebase/firebase-functions/issues/1423)) - Add traces to V2 Firestore trigger logs. ([#​1440](https://redirect.github.com/firebase/firebase-functions/issues/1440)) - Fix incorrectly parsed timestamps in auth blocking functions. ([#​1472](https://redirect.github.com/firebase/firebase-functions/issues/1472)) - Add recaptcha verdict support for auth blocking functions ([#​1458](https://redirect.github.com/firebase/firebase-functions/issues/1458))
form-data/form-data (form-data) ### [`v3.0.2`](https://redirect.github.com/form-data/form-data/releases/tag/v3.0.2) [Compare Source](https://redirect.github.com/form-data/form-data/compare/v3.0.1...v3.0.2) ##### Fixes - npmignore temporary build files ([#​532](https://redirect.github.com/form-data/form-data/issues/532)) - move util.isArray to Array.isArray ([#​564](https://redirect.github.com/form-data/form-data/issues/564)) ##### Tests - migrate from travis to GHA
nodejs/node (node) ### [`v16.20.2`](https://redirect.github.com/nodejs/node/releases/tag/v16.20.2): 2023-08-09, Version 16.20.2 'Gallium' (LTS), @​RafaelGSS [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.20.1...v16.20.2) This is a security release. ##### Notable Changes The following CVEs are fixed in this release: - [CVE-2023-32002](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32002): Policies can be bypassed via Module.\_load (High) - [CVE-2023-32006](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32006): Policies can be bypassed by module.constructor.createRequire (Medium) - [CVE-2023-32559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32559): Policies can be bypassed via process.binding (Medium) - OpenSSL Security Releases - [OpenSSL security advisory 14th July](https://mta.openssl.org/pipermail/openssl-announce/2023-July/000264.html). - [OpenSSL security advisory 19th July](https://mta.openssl.org/pipermail/openssl-announce/2023-July/000265.html). - [OpenSSL security advisory 31st July](https://mta.openssl.org/pipermail/openssl-announce/2023-July/000267.html) More detailed information on each of the vulnerabilities can be found in [August 2023 Security Releases](https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/) blog post. ##### Commits - \[[`40c3958a5a`](https://redirect.github.com/nodejs/node/commit/40c3958a5a)] - **deps**: update archs files for OpenSSL-1.1.1v (RafaelGSS) [#​49043](https://redirect.github.com/nodejs/node/pull/49043) - \[[`a9ac9da89a`](https://redirect.github.com/nodejs/node/commit/a9ac9da89a)] - **deps**: fix openssl crypto clean (RafaelGSS) [#​49043](https://redirect.github.com/nodejs/node/pull/49043) - \[[`362d4c7494`](https://redirect.github.com/nodejs/node/commit/362d4c7494)] - **deps**: upgrade openssl sources to OpenSSL\_1\_1\_1v (RafaelGSS) [#​49043](https://redirect.github.com/nodejs/node/pull/49043) - \[[`d8ccfe9ad4`](https://redirect.github.com/nodejs/node/commit/d8ccfe9ad4)] - **policy**: handle Module.constructor and main.extensions bypass (RafaelGSS) [nodejs-private/node-private#445](https://redirect.github.com/nodejs-private/node-private/pull/445) - \[[`242aaa0caa`](https://redirect.github.com/nodejs/node/commit/242aaa0caa)] - **policy**: disable process.binding() when enabled (Tobias Nießen) [nodejs-private/node-private#459](https://redirect.github.com/nodejs-private/node-private/pull/459) ### [`v16.20.1`](https://redirect.github.com/nodejs/node/releases/tag/v16.20.1): 2023-06-20, Version 16.20.1 'Gallium' (LTS), @​RafaelGSS [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.20.0...v16.20.1) This is a security release. ##### Notable Changes The following CVEs are fixed in this release: - [CVE-2023-30581](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30581): `mainModule.__proto__` Bypass Experimental Policy Mechanism (High) - [CVE-2023-30585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30585): Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) - [CVE-2023-30588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30588): Process interuption due to invalid Public Key information in x509 certificates (Medium) - [CVE-2023-30589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30589): HTTP Request Smuggling via Empty headers separated by CR (Medium) - [CVE-2023-30590](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30590): DiffieHellman does not generate keys after setting a private key (Medium) - OpenSSL Security Releases - [OpenSSL security advisory 28th March](https://www.openssl.org/news/secadv/20230328.txt). - [OpenSSL security advisory 20th April](https://www.openssl.org/news/secadv/20230420.txt). - [OpenSSL security advisory 30th May](https://www.openssl.org/news/secadv/20230530.txt) - c-ares vulnerabilities: - [GHSA-9g78-jv2r-p7vc](https://redirect.github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc) - [GHSA-8r8p-23f3-64c2](https://redirect.github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2) - [GHSA-54xr-f67r-4pc4](https://redirect.github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4) - [GHSA-x6mf-cxr9-8q6v](https://redirect.github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v) More detailed information on each of the vulnerabilities can be found in [June 2023 Security Releases](https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/) blog post. ##### Commits - \[[`5a92ea7a3b`](https://redirect.github.com/nodejs/node/commit/5a92ea7a3b)] - **crypto**: handle cert with invalid SPKI gracefully (Tobias Nießen) - \[[`5df04e893a`](https://redirect.github.com/nodejs/node/commit/5df04e893a)] - **deps**: set `CARES_RANDOM_FILE` for c-ares (Richard Lau) [#​48156](https://redirect.github.com/nodejs/node/pull/48156) - \[[`c171cbd124`](https://redirect.github.com/nodejs/node/commit/c171cbd124)] - **deps**: update c-ares to 1.19.1 (RafaelGSS) [#​48115](https://redirect.github.com/nodejs/node/pull/48115) - \[[`155d3aac02`](https://redirect.github.com/nodejs/node/commit/155d3aac02)] - **deps**: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) [#​48369](https://redirect.github.com/nodejs/node/pull/48369) - \[[`8d4c8f8ebe`](https://redirect.github.com/nodejs/node/commit/8d4c8f8ebe)] - **deps**: upgrade openssl sources to OpenSSL\_1\_1\_1u (RafaelGSS) [#​48369](https://redirect.github.com/nodejs/node/pull/48369) - \[[`1a5c9284eb`](https://redirect.github.com/nodejs/node/commit/1a5c9284eb)] - **doc,test**: clarify behavior of DH generateKeys (Tobias Nießen) [nodejs-private/node-private#426](https://redirect.github.com/nodejs-private/node-private/pull/426) - \[[`e42ff4b018`](https://redirect.github.com/nodejs/node/commit/e42ff4b018)] - **http**: disable request smuggling via empty headers (Paolo Insogna) [nodejs-private/node-private#429](https://redirect.github.com/nodejs-private/node-private/pull/429) - \[[`10042683c8`](https://redirect.github.com/nodejs/node/commit/10042683c8)] - **msi**: do not create AppData\Roaming\npm (Tobias Nießen) [nodejs-private/node-private#408](https://redirect.github.com/nodejs-private/node-private/pull/408) - \[[`a6f4e87bc9`](https://redirect.github.com/nodejs/node/commit/a6f4e87bc9)] - **policy**: handle mainModule.\__proto\_\_ bypass (RafaelGSS) [nodejs-private/node-private#416](https://redirect.github.com/nodejs-private/node-private/pull/416) - \[[`b77000f4d7`](https://redirect.github.com/nodejs/node/commit/b77000f4d7)] - **test**: allow SIGBUS in signal-handler abort test (Michaël Zasso) [#​47851](https://redirect.github.com/nodejs/node/pull/47851) ### [`v16.20.0`](https://redirect.github.com/nodejs/node/releases/tag/v16.20.0): 2023-03-29, Version 16.20.0 'Gallium' (LTS), @​BethGriggs [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.19.1...v16.20.0) ##### Notable Changes - **deps:** - update undici to 5.20.0 (Node.js GitHub Bot) [#​46711](https://redirect.github.com/nodejs/node/pull/46711) - update c-ares to 1.19.0 (Michaël Zasso) [#​46415](https://redirect.github.com/nodejs/node/pull/46415) - upgrade npm to 8.19.4 (npm team) [#​46677](https://redirect.github.com/nodejs/node/pull/46677) - update corepack to 0.17.0 (Node.js GitHub Bot) [#​46842](https://redirect.github.com/nodejs/node/pull/46842) - **(SEMVER-MINOR)** **src**: add support for externally shared js builtins (Michael Dawson) [#​44376](https://redirect.github.com/nodejs/node/pull/44376) ##### Commits - \[[`de6dd67790`](https://redirect.github.com/nodejs/node/commit/de6dd67790)] - **crypto**: avoid hang when no algorithm available (Richard Lau) [#​46237](https://redirect.github.com/nodejs/node/pull/46237) - \[[`4617512788`](https://redirect.github.com/nodejs/node/commit/4617512788)] - **crypto**: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) [#​46185](https://redirect.github.com/nodejs/node/pull/46185) - \[[`24972164fc`](https://redirect.github.com/nodejs/node/commit/24972164fc)] - **deps**: update undici to 5.20.0 (Node.js GitHub Bot) [#​46711](https://redirect.github.com/nodejs/node/pull/46711) - \[[`85f88c6a8d`](https://redirect.github.com/nodejs/node/commit/85f88c6a8d)] - **deps**: V8: cherry-pick [`90be99f`](https://redirect.github.com/nodejs/node/commit/90be99fab31c) (Michaël Zasso) [#​46646](https://redirect.github.com/nodejs/node/pull/46646) - \[[`b4ebe6d47b`](https://redirect.github.com/nodejs/node/commit/b4ebe6d47b)] - **deps**: update c-ares to 1.19.0 (Michaël Zasso) [#​46415](https://redirect.github.com/nodejs/node/pull/46415) - \[[`56cbc7fdda`](https://redirect.github.com/nodejs/node/commit/56cbc7fdda)] - **deps**: V8: cherry-pick [`c2792e5`](https://redirect.github.com/nodejs/node/commit/c2792e58035f) (Jiawen Geng) [#​44961](https://redirect.github.com/nodejs/node/pull/44961) - \[[`7af9bdb31e`](https://redirect.github.com/nodejs/node/commit/7af9bdb31e)] - **deps**: upgrade npm to 8.19.4 (npm team) [#​46677](https://redirect.github.com/nodejs/node/pull/46677) - \[[`962a7471b5`](https://redirect.github.com/nodejs/node/commit/962a7471b5)] - **deps**: update corepack to 0.17.0 (Node.js GitHub Bot) [#​46842](https://redirect.github.com/nodejs/node/pull/46842) - \[[`748bc96e35`](https://redirect.github.com/nodejs/node/commit/748bc96e35)] - **deps**: update corepack to 0.16.0 (Node.js GitHub Bot) [#​46710](https://redirect.github.com/nodejs/node/pull/46710) - \[[`a467782499`](https://redirect.github.com/nodejs/node/commit/a467782499)] - **deps**: update corepack to 0.15.3 (Node.js GitHub Bot) [#​46037](https://redirect.github.com/nodejs/node/pull/46037) - \[[`1913b6763d`](https://redirect.github.com/nodejs/node/commit/1913b6763d)] - **deps**: update corepack to 0.15.2 (Node.js GitHub Bot) [#​45635](https://redirect.github.com/nodejs/node/pull/45635) - \[[`809371a15f`](https://redirect.github.com/nodejs/node/commit/809371a15f)] - **module**: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) [#​45147](https://redirect.github.com/nodejs/node/pull/45147) - \[[`086bb2f8d4`](https://redirect.github.com/nodejs/node/commit/086bb2f8d4)] - ***Revert*** "**src**: let http2 streams end after session close" (Rich Trott) [#​46721](https://redirect.github.com/nodejs/node/pull/46721) - \[[`6a01d39120`](https://redirect.github.com/nodejs/node/commit/6a01d39120)] - **(SEMVER-MINOR)** **src**: add support for externally shared js builtins (Michael Dawson) [#​44376](https://redirect.github.com/nodejs/node/pull/44376) - \[[`d081032a60`](https://redirect.github.com/nodejs/node/commit/d081032a60)] - **test**: fix test-net-connect-reset-until-connected (Vita Batrla) [#​46781](https://redirect.github.com/nodejs/node/pull/46781) - \[[`efe1be47ec`](https://redirect.github.com/nodejs/node/commit/efe1be47ec)] - **test**: skip test depending on `overlapped-checker` when not available (Antoine du Hamel) [#​45015](https://redirect.github.com/nodejs/node/pull/45015) - \[[`fc47d58abe`](https://redirect.github.com/nodejs/node/commit/fc47d58abe)] - **test**: remove cjs loader from stack traces (Geoffrey Booth) [#​44197](https://redirect.github.com/nodejs/node/pull/44197) - \[[`cf76d0790d`](https://redirect.github.com/nodejs/node/commit/cf76d0790d)] - **test**: fix WPT title when no META title is present (Filip Skokan) [#​46804](https://redirect.github.com/nodejs/node/pull/46804) - \[[`0d1485b924`](https://redirect.github.com/nodejs/node/commit/0d1485b924)] - **test**: fix default WPT titles (Filip Skokan) [#​46778](https://redirect.github.com/nodejs/node/pull/46778) - \[[`088e9cde3d`](https://redirect.github.com/nodejs/node/commit/088e9cde3d)] - **test**: add WPTRunner support for variants and generating WPT reports (Filip Skokan) [#​46498](https://redirect.github.com/nodejs/node/pull/46498) - \[[`908c4dff44`](https://redirect.github.com/nodejs/node/commit/908c4dff44)] - **test**: mark test-crypto-key-objects flaky on Linux (Richard Lau) [#​46684](https://redirect.github.com/nodejs/node/pull/46684) - \[[`768e56227e`](https://redirect.github.com/nodejs/node/commit/768e56227e)] - **tools**: make `utils.SearchFiles` deterministic (Bruno Pitrus) [#​44496](https://redirect.github.com/nodejs/node/pull/44496) ### [`v16.19.1`](https://redirect.github.com/nodejs/node/releases/tag/v16.19.1): 2023-02-16, Version 16.19.1 'Gallium' (LTS), @​richardlau [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.19.0...v16.19.1) This is a security release. ##### Notable Changes The following CVEs are fixed in this release: - **[CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918)**: Node.js Permissions policies can be bypassed via process.mainModule (High) - **[CVE-2023-23919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23919)**: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) - **[CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920)**: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) Fixed by an update to undici: - **[CVE-2023-23936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936)**: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) - See for more information. - **[CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)**: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) - See for more information. More detailed information on each of the vulnerabilities can be found in [February 2023 Security Releases](https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/) blog post. This security release includes OpenSSL security updates as outlined in the recent [OpenSSL security advisory](https://www.openssl.org/news/secadv/20230207.txt). ##### Commits - \[[`7fef050447`](https://redirect.github.com/nodejs/node/commit/7fef050447)] - **build**: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) [nodejs-private/node-private#374](https://redirect.github.com/nodejs-private/node-private/pull/374) - \[[`b558e9f476`](https://redirect.github.com/nodejs/node/commit/b558e9f476)] - **crypto**: clear OpenSSL error on invalid ca cert (RafaelGSS) [nodejs-private/node-private#375](https://redirect.github.com/nodejs-private/node-private/pull/375) - \[[`160adb7ffc`](https://redirect.github.com/nodejs/node/commit/160adb7ffc)] - **crypto**: clear OpenSSL error queue after calling X509\_check_private_key() (Filip Skokan) [#​45495](https://redirect.github.com/nodejs/node/pull/45495) - \[[`d0ece30948`](https://redirect.github.com/nodejs/node/commit/d0ece30948)] - **crypto**: clear OpenSSL error queue after calling X509\_verify() (Takuro Sato) [#​45377](https://redirect.github.com/nodejs/node/pull/45377) - \[[`2d9ae4f184`](https://redirect.github.com/nodejs/node/commit/2d9ae4f184)] - **deps**: update undici to v5.19.1 (Matteo Collina) [nodejs-private/node-private#388](https://redirect.github.com/nodejs-private/node-private/pull/388) - \[[`d80e8312fd`](https://redirect.github.com/nodejs/node/commit/d80e8312fd)] - **deps**: cherry-pick Windows ARM64 fix for openssl (Richard Lau) [#​46568](https://redirect.github.com/nodejs/node/pull/46568) - \[[`de5c8d2c2f`](https://redirect.github.com/nodejs/node/commit/de5c8d2c2f)] - **deps**: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) [#​46568](https://redirect.github.com/nodejs/node/pull/46568) - \[[`1a8ccfe908`](https://redirect.github.com/nodejs/node/commit/1a8ccfe908)] - **deps**: upgrade openssl sources to OpenSSL\_1\_1\_1t+quic (RafaelGSS) [#​46568](https://redirect.github.com/nodejs/node/pull/46568) - \[[`693789780b`](https://redirect.github.com/nodejs/node/commit/693789780b)] - **doc**: clarify release notes for Node.js 16.19.0 (Richard Lau) [#​45846](https://redirect.github.com/nodejs/node/pull/45846) - \[[`f95ef064f4`](https://redirect.github.com/nodejs/node/commit/f95ef064f4)] - **lib**: makeRequireFunction patch when experimental policy (RafaelGSS) [nodejs-private/node-private#358](https://redirect.github.com/nodejs-private/node-private/pull/358) - \[[`b02d895137`](https://redirect.github.com/nodejs/node/commit/b02d895137)] - **policy**: makeRequireFunction on mainModule.require (RafaelGSS) [nodejs-private/node-private#358](https://redirect.github.com/nodejs-private/node-private/pull/358) - \[[`d7f83c420c`](https://redirect.github.com/nodejs/node/commit/d7f83c420c)] - **test**: avoid left behind child processes (Richard Lau) [#​46276](https://redirect.github.com/nodejs/node/pull/46276) ### [`v16.19.0`](https://redirect.github.com/nodejs/node/releases/tag/v16.19.0): 2022-12-13, Version 16.19.0 'Gallium' (LTS), @​richardlau [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.18.1...v16.19.0) ##### Notable Changes ##### OpenSSL 1.1.1s This update is a bugfix release and does not address any security vulnerabilities. ##### Root certificates updated to NSS 3.85 Certificates added: - Autoridad de Certificacion Firmaprofesional CIF [`A626340`](https://redirect.github.com/nodejs/node/commit/A62634068) - Certainly Root E1 - Certainly Root R1 - D-TRUST BR Root CA 1 2020 - D-TRUST EV Root CA 1 2020 - DigiCert TLS ECC P384 Root G5 - DigiCert TLS RSA4096 Root G5 - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 - HiPKI Root CA - G1 - ISRG Root X2 - Security Communication ECC RootCA1 - Security Communication RootCA3 - Telia Root CA v2 - vTrus ECC Root CA - vTrus Root CA Certificates removed: - Cybertrust Global Root - DST Root CA X3 - GlobalSign Root CA - R2 - Hellenic Academic and Research Institutions RootCA 2011 ##### Time zone update to 2022f Time zone data has been updated to 2022f. This includes changes to Daylight Savings Time (DST) for Fiji and Mexico. For more information, see . ##### Other Notable Changes - \[[`33707dcd03`](https://redirect.github.com/nodejs/node/commit/33707dcd03)] - **dgram**: add dgram send queue info (theanarkh) [#​44149](https://redirect.github.com/nodejs/node/pull/44149) Dependency updates: - \[[`3b2b70d792`](https://redirect.github.com/nodejs/node/commit/3b2b70d792)] - **deps**: upgrade npm to 8.19.3 (npm team) [#​45322](https://redirect.github.com/nodejs/node/pull/45322) Experimental features: - \[[`1e0dcd1ee0`](https://redirect.github.com/nodejs/node/commit/1e0dcd1ee0)] - **cli**: add `--watch` (Moshe Atlow) [#​44366](https://redirect.github.com/nodejs/node/pull/44366) - \[[`8c73279ebb`](https://redirect.github.com/nodejs/node/commit/8c73279ebb)] - **util**: add default value option to parsearg (Manuel Spigolon) [#​44631](https://redirect.github.com/nodejs/node/pull/44631) ##### Commits - \[[`bbef3c42f6`](https://redirect.github.com/nodejs/node/commit/bbef3c42f6)] - **build**: add version info to timezone update PR (Darshan Sen) [#​45021](https://redirect.github.com/nodejs/node/pull/45021) - \[[`cc2c7648e0`](https://redirect.github.com/nodejs/node/commit/cc2c7648e0)] - **build**: support Python 3.11 (Luigi Pinca) [#​45191](https://redirect.github.com/nodejs/node/pull/45191) - \[[`ac24c80663`](https://redirect.github.com/nodejs/node/commit/ac24c80663)] - **build**: remove redundant condition from common.gypi (Richard Lau) [#​45076](https://redirect.github.com/nodejs/node/pull/45076) - \[[`03dcbe3030`](https://redirect.github.com/nodejs/node/commit/03dcbe3030)] - **build**: fix bad upstream merge (Stephen Gallagher) [#​44642](https://redirect.github.com/nodejs/node/pull/44642) - \[[`1e0dcd1ee0`](https://redirect.github.com/nodejs/node/commit/1e0dcd1ee0)] - **cli**: add `--watch` (Moshe Atlow) [#​44366](https://redirect.github.com/nodejs/node/pull/44366) - \[[`96d131665e`](https://redirect.github.com/nodejs/node/commit/96d131665e)] - **cluster**: use inspector utils (Moshe Atlow) [#​44592](https://redirect.github.com/nodejs/node/pull/44592) - \[[`704836033a`](https://redirect.github.com/nodejs/node/commit/704836033a)] - **crypto**: update root certificates (Luigi Pinca) [#​45490](https://redirect.github.com/nodejs/node/pull/45490) - \[[`5a776d4a69`](https://redirect.github.com/nodejs/node/commit/5a776d4a69)] - **deps**: update timezone to 2022f (Richard Lau) [#​45613](https://redirect.github.com/nodejs/node/pull/45613) - \[[`3b2b70d792`](https://redirect.github.com/nodejs/node/commit/3b2b70d792)] - **deps**: upgrade npm to 8.19.3 (npm team) [#​45322](https://redirect.github.com/nodejs/node/pull/45322) - \[[`9fbc8b21db`](https://redirect.github.com/nodejs/node/commit/9fbc8b21db)] - **deps**: update corepack to 0.15.1 (Node.js GitHub Bot) [#​45331](https://redirect.github.com/nodejs/node/pull/45331) - \[[`87e3d002ca`](https://redirect.github.com/nodejs/node/commit/87e3d002ca)] - **deps**: update corepack to 0.15.0 (Node.js GitHub Bot) [#​45235](https://redirect.github.com/nodejs/node/pull/45235) - \[[`e972ff7b13`](https://redirect.github.com/nodejs/node/commit/e972ff7b13)] - **deps**: V8: backport [`bbd800c`](https://redirect.github.com/nodejs/node/commit/bbd800c6e359) (Chengzhong Wu) [#​44947](https://redirect.github.com/nodejs/node/pull/44947) - \[[`af9d8217c0`](https://redirect.github.com/nodejs/node/commit/af9d8217c0)] - **deps**: V8: cherry-pick [`b953542`](https://redirect.github.com/nodejs/node/commit/b95354290941) (Chengzhong Wu) [#​44947](https://redirect.github.com/nodejs/node/pull/44947) - \[[`38202d321b`](https://redirect.github.com/nodejs/node/commit/38202d321b)] - **deps**: update undici to 5.12.0 (Node.js GitHub Bot) [#​45236](https://redirect.github.com/nodejs/node/pull/45236) - \[[`7c0da6adf9`](https://redirect.github.com/nodejs/node/commit/7c0da6adf9)] - **deps**: update archs files for OpenSSL-1.1.1s (RafaelGSS) [#​45274](https://redirect.github.com/nodejs/node/pull/45274) - \[[`1149ead6f7`](https://redirect.github.com/nodejs/node/commit/1149ead6f7)] - **deps**: upgrade openssl sources to OpenSSL\_1\_1\_1s (RafaelGSS) [#​45274](https://redirect.github.com/nodejs/node/pull/45274) - \[[`cd54bce4f5`](https://redirect.github.com/nodejs/node/commit/cd54bce4f5)] - **deps**: update timezone (Node.js GitHub Bot) [#​44950](https://redirect.github.com/nodejs/node/pull/44950) - \[[`2901abe4f0`](https://redirect.github.com/nodejs/node/commit/2901abe4f0)] - **deps**: update undici to 5.11.0 (Node.js GitHub Bot) [#​44929](https://redirect.github.com/nodejs/node/pull/44929) - \[[`c80cf97033`](https://redirect.github.com/nodejs/node/commit/c80cf97033)] - **deps**: update corepack to 0.14.2 (Node.js GitHub Bot) [#​44775](https://redirect.github.com/nodejs/node/pull/44775) - \[[`33707dcd03`](https://redirect.github.com/nodejs/node/commit/33707dcd03)] - **dgram**: add dgram send queue info (theanarkh) [#​44149](https://redirect.github.com/nodejs/node/pull/44149) - \[[`c708d9bb94`](https://redirect.github.com/nodejs/node/commit/c708d9bb94)] - **doc**: fix typo in parseArgs default value (Tobias Nießen) [#​45083](https://redirect.github.com/nodejs/node/pull/45083) - \[[`5a0efa05d2`](https://redirect.github.com/nodejs/node/commit/5a0efa05d2)] - **node-api**: handle no support for external buffers (Michael Dawson) [#​45181](https://redirect.github.com/nodejs/node/pull/45181) - \[[`db31de634e`](https://redirect.github.com/nodejs/node/commit/db31de634e)] - **readline**: refactor to avoid unsafe regex primordials (Antoine du Hamel) [#​43475](https://redirect.github.com/nodejs/node/pull/43475) - \[[`fbc52e5729`](https://redirect.github.com/nodejs/node/commit/fbc52e5729)] - **src**: disambiguate terms used to refer to builtins and addons (Joyee Cheung) [#​44135](https://redirect.github.com/nodejs/node/pull/44135) - \[[`953072d3db`](https://redirect.github.com/nodejs/node/commit/953072d3db)] - **src**: let http2 streams end after session close (Santiago Gimeno) [#​45153](https://redirect.github.com/nodejs/node/pull/45153) - \[[`54608d8dc3`](https://redirect.github.com/nodejs/node/commit/54608d8dc3)] - **src**: split property helpers from node::Environment (Chengzhong Wu) [#​44056](https://redirect.github.com/nodejs/node/pull/44056) - \[[`6733556783`](https://redirect.github.com/nodejs/node/commit/6733556783)] - **test**: add test to validate changelogs for releases (Richard Lau) [#​45325](https://redirect.github.com/nodejs/node/pull/45325) - \[[`821d832cef`](https://redirect.github.com/nodejs/node/commit/821d832cef)] - **test**: mark test-watch-mode\* as flaky on all platforms (Pierrick Bouvier) [#​45049](https://redirect.github.com/nodejs/node/pull/45049) - \[[`02a18eac69`](https://redirect.github.com/nodejs/node/commit/02a18eac69)] - **test**: fix test-runner-inspect (Moshe Atlow) [#​44620](https://redirect.github.com/nodejs/node/pull/44620) - \[[`197df63f74`](https://redirect.github.com/nodejs/node/commit/197df63f74)] - **test**: add a test to ensure the correctness of timezone upgrades (Darshan Sen) [#​45299](https://redirect.github.com/nodejs/node/pull/45299) - \[[`42e9d8016a`](https://redirect.github.com/nodejs/node/commit/42e9d8016a)] - **test**: fix textdecoder test for small-icu builds (Richard Lau) [#​45225](https://redirect.github.com/nodejs/node/pull/45225) - \[[`6d736a56d8`](https://redirect.github.com/nodejs/node/commit/6d736a56d8)] - **test**: fix watch mode test flake (Moshe Atlow) [#​44739](https://redirect.github.com/nodejs/node/pull/44739) - \[[`543d3d2bf3`](https://redirect.github.com/nodejs/node/commit/543d3d2bf3)] - **test**: deflake watch mode tests (Moshe Atlow) [#​44621](https://redirect.github.com/nodejs/node/pull/44621) - \[[`97f6caf4eb`](https://redirect.github.com/nodejs/node/commit/97f6caf4eb)] - **test**: split watch mode inspector tests to sequential (Moshe Atlow) [#​44551](https://redirect.github.com/nodejs/node/pull/44551) - \[[`499750ff7a`](https://redirect.github.com/nodejs/node/commit/499750ff7a)] - **test**: update list of known globals (Antoine du Hamel) [#​45255](https://redirect.github.com/nodejs/node/pull/45255) - \[[`64d343af74`](https://redirect.github.com/nodejs/node/commit/64d343af74)] - **test_runner**: support using `--inspect` with `--test` (Moshe Atlow) [#​44520](https://redirect.github.com/nodejs/node/pull/44520) - \[[`99ee5e484d`](https://redirect.github.com/nodejs/node/commit/99ee5e484d)] - **test_runner**: fix `duration_ms` to be milliseconds (Moshe Atlow) [#​44450](https://redirect.github.com/nodejs/node/pull/44450) - \[[`37e909251c`](https://redirect.github.com/nodejs/node/commit/37e909251c)] - **test_runner**: support programmatically running `--test` (Moshe Atlow) [#​44241](https://redirect.github.com/nodejs/node/pull/44241) - \[[`0ae5694f88`](https://redirect.github.com/nodejs/node/commit/0ae5694f88)] - **tools**: update certdata.txt (Luigi Pinca) [#​45490](https://redirect.github.com/nodejs/node/pull/45490) - \[[`891368cefd`](https://redirect.github.com/nodejs/node/commit/891368cefd)] - **tools**: remove faulty early termination logic from update-timezone.mjs (Darshan Sen) [#​44870](https://redirect.github.com/nodejs/node/pull/44870) - \[[`543493c242`](https://redirect.github.com/nodejs/node/commit/543493c242)] - **tools**: fix timezone update tool (Darshan Sen) [#​44870](https://redirect.github.com/nodejs/node/pull/44870) - \[[`c77f660b75`](https://redirect.github.com/nodejs/node/commit/c77f660b75)] - **tools**: fix `create-or-update-pull-request-action` hash on GHA (Antoine du Hamel) [#​45166](https://redirect.github.com/nodejs/node/pull/45166) - \[[`58c30dd049`](https://redirect.github.com/nodejs/node/commit/58c30dd049)] - **tools**: update gr2m/create-or-update-pull-request-action (Luigi Pinca) [#​45022](https://redirect.github.com/nodejs/node/pull/45022) - \[[`749a4b3e5e`](https://redirect.github.com/nodejs/node/commit/749a4b3e5e)] - **tools**: use Python 3.11 in GitHub Actions workflows (Luigi Pinca) [#​45191](https://redirect.github.com/nodejs/node/pull/45191) - \[[`6f541d99a5`](https://redirect.github.com/nodejs/node/commit/6f541d99a5)] - **tools**: have test-asan use ubuntu-20.04 (Filip Skokan) [#​45581](https://redirect.github.com/nodejs/node/pull/45581) - \[[`e7ed56f501`](https://redirect.github.com/nodejs/node/commit/e7ed56f501)] - **tools**: make license-builder.sh comply with shellcheck 0.8.0 (Rich Trott) [#​41258](https://redirect.github.com/nodejs/node/pull/41258) - \[[`cc819b4bf8`](https://redirect.github.com/nodejs/node/commit/cc819b4bf8)] - **tools**: fix typo in `avoid-prototype-pollution` lint rule (Antoine du Hamel) [#​44446](https://redirect.github.com/nodejs/node/pull/44446) - \[[`254358c81e`](https://redirect.github.com/nodejs/node/commit/254358c81e)] - **tools**: refactor `avoid-prototype-pollution` lint rule (Antoine du Hamel) [#​43476](https://redirect.github.com/nodejs/node/pull/43476) - \[[`8c73279ebb`](https://redirect.github.com/nodejs/node/commit/8c73279ebb)] - **util**: add default value option to parsearg (Manuel Spigolon) [#​44631](https://redirect.github.com/nodejs/node/pull/44631) ### [`v16.18.1`](https://redirect.github.com/nodejs/node/releases/tag/v16.18.1): 2022-11-04, Version 16.18.1 'Gallium' (LTS), @​BethGriggs [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.18.0...v16.18.1) This is a security release. ##### Notable changes The following CVEs are fixed in this release: - **[CVE-2022-43548](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43548)**: DNS rebinding in --inspect via invalid octal IP address (Medium) More detailed information on each of the vulnerabilities can be found in [November 2022 Security Releases](https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/) blog post. ##### Commits - \[[`9ffddd7098`](https://redirect.github.com/nodejs/node/commit/9ffddd7098)] - **inspector**: harden IP address validation again (Tobias Nießen) [nodejs-private/node-private#354](https://redirect.github.com/nodejs-private/node-private/pull/354) ### [`v16.18.0`](https://redirect.github.com/nodejs/node/releases/tag/v16.18.0): 2022-10-12, Version 16.18.0 'Gallium' (LTS), @​juanarbol [Compare Source](https://redirect.github.com/nodejs/node/compare/v16.17.1...v16.18.0) ##### Notable changes - \[[`1cc050eaa8`](https://redirect.github.com/nodejs/node/commit/1cc050eaa8)] - **(SEMVER-MINOR)** **assert**: add `getCalls` and `reset` to callTracker (Moshe Atlow) [#​44191](https://redirect.github.com/nodejs/node/pull/44191) - \[[`e5c9975f11`](https://redirect.github.com/nodejs/node/commit/e5c9975f11)] - **(SEMVER-MINOR)** **crypto**: allow zero-length secret KeyObject (Filip Skokan) [#​44201](https://redirect.github.com/nodejs/node/pull/44201) - \[[`317cd051ce`](https://redirect.github.com/nodejs/node/commit/317cd051ce)] - **(SEMVER-MINOR)** **crypto**: allow zero-length IKM in HKDF and in webcrypto PBKDF2 (Filip Skokan) [#​44201](https://redirect.github.com/nodejs/node/pull/44201) - \[[`f80bdc5ef3`](https://redirect.github.com/nodejs/node/commit/f80bdc5ef3)] - **(SE

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

This PR was generated by Mend Renovate. View the repository job log.