search

freeCodeCamp / chapter

A self-hosted event management tool for nonprofits
BSD 3-Clause "New" or "Revised" License
1.92k stars 360 forks source link

chore(deps): update node.js to v18.14.1 #2388

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Type Update Change
node patch 18.14.0 -> 18.14.1
node engines patch 18.14.0 -> 18.14.1

Release Notes

nodejs/node ### [`v18.14.1`](https://togithub.com/nodejs/node/releases/tag/v18.14.1): 2023-02-16, Version 18.14.1 'Hydrogen' (LTS), @​RafaelGSS prepared by @​juanarbol [Compare Source](https://togithub.com/nodejs/node/compare/v18.14.0...v18.14.1) This is a security release. ##### Notable Changes The following CVEs are fixed in this release: - **[CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918)**: Node.js Permissions policies can be bypassed via process.mainModule (High) - **[CVE-2023-23919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23919)**: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) - **[CVE-2023-23936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936)**: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) - **[CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)**: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) - **[CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920)**: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) More detailed information on each of the vulnerabilities can be found in [February 2023 Security Releases](https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/) blog post. This security release includes OpenSSL security updates as outlined in the recent [OpenSSL security advisory](https://www.openssl.org/news/secadv/20230207.txt). ##### Commits - \[[`8393ebc72d`](https://togithub.com/nodejs/node/commit/8393ebc72d)] - **build**: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) [nodejs-private/node-private#​379](https://togithub.com/nodejs-private/node-private/pull/379) - \[[`004e34d046`](https://togithub.com/nodejs/node/commit/004e34d046)] - **crypto**: clear OpenSSL error on invalid ca cert (RafaelGSS) [#​46572](https://togithub.com/nodejs/node/pull/46572) - \[[`5e0142a852`](https://togithub.com/nodejs/node/commit/5e0142a852)] - **deps**: cherry-pick Windows ARM64 fix for openssl (Richard Lau) [#​46572](https://togithub.com/nodejs/node/pull/46572) - \[[`f71fe278a6`](https://togithub.com/nodejs/node/commit/f71fe278a6)] - **deps**: update archs files for quictls/openssl-3.0.8+quic (RafaelGSS) [#​46572](https://togithub.com/nodejs/node/pull/46572) - \[[`2c6817e42b`](https://togithub.com/nodejs/node/commit/2c6817e42b)] - **deps**: upgrade openssl sources to quictls/openssl-3.0.8+quic (RafaelGSS) [#​46572](https://togithub.com/nodejs/node/pull/46572) - \[[`f0afa0bfe5`](https://togithub.com/nodejs/node/commit/f0afa0bfe5)] - **deps**: update undici to 5.19.1 (Node.js GitHub Bot) [#​46634](https://togithub.com/nodejs/node/pull/46634) - \[[`c26a34c13e`](https://togithub.com/nodejs/node/commit/c26a34c13e)] - **deps**: update undici to 5.18.0 (Node.js GitHub Bot) [#​46634](https://togithub.com/nodejs/node/pull/46634) - \[[`db93ee4a15`](https://togithub.com/nodejs/node/commit/db93ee4a15)] - **deps**: update undici to 5.17.1 (Node.js GitHub Bot) [#​46634](https://togithub.com/nodejs/node/pull/46634) - \[[`b4e49fb02c`](https://togithub.com/nodejs/node/commit/b4e49fb02c)] - **deps**: update undici to 5.16.0 (Node.js GitHub Bot) [#​46634](https://togithub.com/nodejs/node/pull/46634) - \[[`90994e6a2c`](https://togithub.com/nodejs/node/commit/90994e6a2c)] - **deps**: update undici to 5.15.1 (Node.js GitHub Bot) [#​46634](https://togithub.com/nodejs/node/pull/46634) - \[[`00302fc7ac`](https://togithub.com/nodejs/node/commit/00302fc7ac)] - **deps**: update undici to 5.15.0 (Node.js GitHub Bot) [#​46634](https://togithub.com/nodejs/node/pull/46634) - \[[`0e3b796cc5`](https://togithub.com/nodejs/node/commit/0e3b796cc5)] - **lib**: makeRequireFunction patch when experimental policy (RafaelGSS) [nodejs-private/node-private#​371](https://togithub.com/nodejs-private/node-private/pull/371) - \[[`7cccd5565f`](https://togithub.com/nodejs/node/commit/7cccd5565f)] - **policy**: makeRequireFunction on mainModule.require (RafaelGSS) [nodejs-private/node-private#​371](https://togithub.com/nodejs-private/node-private/pull/371)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

This PR has been generated by Mend Renovate. View repository job log here.

ghost commented 1 year ago
👇 Click on the image for a new way to code review #### [![Review these changes using an interactive CodeSee Map](https://s3.us-east-2.amazonaws.com/maps.codesee.io/images/github/freeCodeCamp/chapter/2388/5ec130e0/11644f472938608dce90d620be6553ae14fcd935.svg)](https://app.codesee.io/r/reviews?pr=2388&src=https%3A%2F%2Fgithub.com%2FfreeCodeCamp%2Fchapter) #### Legend ![CodeSee Map Legend](https://app.codesee.io/Legend_v2.png)