Skip to content
This repository has been archived by the owner on Feb 20, 2023. It is now read-only.

chore(deps): update node.js to v18.14.1 #147

Open
wants to merge 1 commit into
base: staging
Choose a base branch
from
Open

chore(deps): update node.js to v18.14.1 #147

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 24, 2022 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Update Change
node minor v18.3.0 -> 18.14.1

Release Notes

nodejs/node

v18.14.1: 2023-02-16, Version 18.14.1 'Hydrogen' (LTS), @​RafaelGSS prepared by @​juanarbol

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

  • CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
  • CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
  • CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
  • CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
  • CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.

Commits

v18.14.0: 2023-02-02, Version 18.14.0 'Hydrogen' (LTS), @​BethGriggs prepared by @​juanarbol

Compare Source

Notable changes
Updated npm to 9.3.1

Based on the list of guidelines we've established on integrating npm and node,
here is a grouped list of the breaking changes with the reasoning as to why they
fit within the guidelines linked above. Note that all the breaking changes were
made in 9.0.0.
All subsequent minor and patch releases after [email protected] do not contain any
breaking changes.

Engines

Explanation: the node engines supported by npm@9 make it safe to allow npm@9 as the default in any LTS version of 14 or 16, as well as anything later than or including 18.0.0

  • npm is now compatible with the following semver range for node: ^14.17.0 || ^16.13.0 || >=18.0.0
Filesystem

Explanation: when run as root previous versions of npm attempted to manage file ownership automatically on the user's behalf. this behavior was problematic in many cases and has been removed in favor of allowing users to manage their own filesystem permissions

  • npm will no longer attempt to modify ownership of files it creates.
Auth

Explanation: any errors thrown from users having unsupported auth configurations will show npm config fix in the remediation instructions, which will allow the user to automatically have their auth config fixed.

  • The presence of auth related settings that are not scoped to a specific
    registry found in a config file is no longer supported and will throw errors.
Login

Explanation: the default auth-type has changed and users can opt back into the old behavior with npm config set auth-type=legacy. login and adduser have also been seperated making each command more closely match it's name instead of being aliases for each other.

  • Legacy auth types sso, saml & legacy have been consolidated into "legacy".
  • auth-type defaults to "web"
  • login and adduser are now separate commands that send different data to the registry.
  • auth-type config values web and legacy only try their respective methods,
    npm no longer tries them all and waits to see which one doesn't fail.
Tarball Packing

Explanation: previously using multiple ignore/allow lists when packing was an undefined behavior, and now the order of operations is strictly defined when packing a tarball making it easier to follow and should only affect users relying on the previously undefined behavior.

  • npm pack now follows a strict order of operations when applying ignore rules.
    If a files array is present in the package.json, then rules in .gitignore
    and .npmignore files from the root will be ignored.
Display/Debug/Timing Info

Explanation: these changes center around the display of information to the terminal including timing and debug log info. We do not anticipate these changes breaking any existing workflows.

  • Links generated from git urls will now use HEAD instead of master as the default ref.
  • timing has been removed as a value for --loglevel.
  • --timing will show timing information regardless of --loglevel, except when --silent.
  • When run with the --timing flag, npm now writes timing data to a file
    alongside the debug log data, respecting the logs-dir option and falling
    back to <CACHE>/_logs/ dir, instead of directly inside the cache directory.
  • The timing file data is no longer newline delimited JSON, and instead each run
    will create a uniquely named <ID>-timing.json file, with the <ID> portion
    being the same as the debug log.
  • npm now outputs some json errors on stdout. Previously npm would output
    all json formatted errors on stderr, making it difficult to parse as the
    stderr stream usually has logs already written to it.
Config/Command Deprecations or Removals

Explanation: install-links is the only config or command in the list that has an effect on package installs. We fixed a number of issues that came up during prereleases with this change. It will also only be applied to new package trees created without a package-lock.json file. Any install with an existing lock file will not be changed.

  • Deprecate boolean install flags in favor of --install-strategy.
  • npm config set will no longer accept deprecated or invalid config options.
  • install-links config defaults to "true".
  • node-version config has been removed.
  • npm-version config has been removed.
  • npm access subcommands have been renamed.
  • npm birthday has been removed.
  • npm set-script has been removed.
  • npm bin has been removed (use npx or npm exec to execute binaries).
Other notable changes
  • doc:
    • add parallelism note to os.cpus() (Colin Ihrig) #​45895
  • http:
    • join authorization headers (Marco Ippolito) #​45982
    • improved timeout defaults handling (Paolo Insogna) #​45778
  • stream:
    • implement finished() for ReadableStream and WritableStream (Debadree Chatterjee) #​46205
Commits

v18.13.0: 2023-01-05, Version 18.13.0 'Hydrogen' (LTS), @​danielleadams

Compare Source

Notable changes
Add support for externally shared js builtins

By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed.

Contributed by Michael Dawson in #​44376

Introduce File

The File class is part of the FileAPI. It can be used anywhere a Blob can, for example in URL.createObjectURL and FormData. It contains two properties that Blobs do not have: lastModified, the last time the file was modified in ms, and name, the name of the file.

Contributed by Khafra in #​45139

Support function mocking on Node.js test runner

The node:test module supports mocking during testing via a top-level mock
object.

test('spies on an object method', (t) => {
  const number = {
    value: 5,
    add(a) {
      return this.value + a;
    },
  };
  t.mock.method(number, 'add');

  assert.strictEqual(number.add(3), 8);
  assert.strictEqual(number.add.mock.calls.length, 1);
});

Contributed by Colin Ihrig in #​45326

Other notable changes
  • build:
    • disable v8 snapshot compression by default (Joyee Cheung) #​45716
  • crypto:
    • update root certificates (Luigi Pinca) #​45490
  • deps:
    • update ICU to 72.1 (Michaël Zasso) #​45068
  • doc:
    • add doc-only deprecation for headers/trailers setters (Rich Trott) #​45697
    • add Rafael to the tsc (Michael Dawson) #​45691
    • deprecate use of invalid ports in url.parse (Antoine du Hamel) #​45576
    • add lukekarrys to collaborators (Luke Karrys) #​45180
    • add anonrig to collaborators (Yagiz Nizipli) #​45002
    • deprecate url.parse() (Rich Trott) #​44919
  • lib:
    • drop fetch experimental warning (Matteo Collina) #​45287
  • net:
    • (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #​44731
  • src:
    • (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #​45639
    • (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #​42869
  • test_runner:
    • (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #​45792
    • (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #​45792
  • tls:
    • (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #​44935
    • remove trustcor root ca certificates (Ben Noordhuis) #​45776
  • tools:
    • update certdata.txt (Luigi Pinca) #​45490
  • util:
    • add fast path for utf8 encoding (Yagiz Nizipli) #​45412
    • improve textdecoder decode performance (Yagiz Nizipli) #​45294
    • (SEMVER-MINOR) add MIME utilities (#​21128) (Bradley Farias) #​21128
Commits

Configuration

📅 Schedule: Branch creation - "every 2 weeks on Monday before 7am" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot force-pushed the renovate/node-18.x branch 5 times, most recently from 6fb5fb7 to 757c780 Compare May 9, 2022 14:26
@renovate renovate bot force-pushed the renovate/node-18.x branch 5 times, most recently from 747d97f to c32378b Compare May 19, 2022 00:39
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 77c2f50 to 64ef3f2 Compare June 13, 2022 11:39
@renovate renovate bot force-pushed the renovate/node-18.x branch from 64ef3f2 to f4129a2 Compare June 16, 2022 23:21
@renovate renovate bot changed the title chore(deps): update node.js to v18 chore(deps): update Node.js to v18 Jun 27, 2022
@renovate renovate bot changed the title chore(deps): update Node.js to v18 chore(deps): update node.js to v18 Jun 28, 2022
@renovate renovate bot force-pushed the renovate/node-18.x branch 3 times, most recently from 6af83ea to 0e70541 Compare July 8, 2022 19:59
@renovate renovate bot force-pushed the renovate/node-18.x branch from 0e70541 to 47577cb Compare July 14, 2022 19:23
@renovate renovate bot changed the title chore(deps): update node.js to v18 chore(deps): update node.js to v18 - autoclosed Jul 16, 2022
@renovate renovate bot closed this Jul 16, 2022
@renovate renovate bot deleted the renovate/node-18.x branch July 16, 2022 19:58
@renovate renovate bot changed the title chore(deps): update node.js to v18 - autoclosed chore(deps): update node.js to v18 Jul 16, 2022
@renovate renovate bot reopened this Jul 16, 2022
@renovate renovate bot restored the renovate/node-18.x branch July 16, 2022 21:54
@renovate renovate bot force-pushed the renovate/node-18.x branch from 47577cb to b932d79 Compare July 27, 2022 19:33
@renovate renovate bot force-pushed the renovate/node-18.x branch from b932d79 to b506e0d Compare August 25, 2022 00:26
@renovate renovate bot force-pushed the renovate/node-18.x branch from b506e0d to 6f4d051 Compare September 25, 2022 21:14
@renovate renovate bot force-pushed the renovate/node-18.x branch from 6f4d051 to 4290ab2 Compare November 20, 2022 17:12
@renovate renovate bot changed the title chore(deps): update node.js to v18 chore(deps): update node.js to v18.12.1 Nov 20, 2022
@renovate renovate bot force-pushed the renovate/node-18.x branch from 4290ab2 to 6d782d5 Compare January 16, 2023 08:53
@renovate renovate bot changed the title chore(deps): update node.js to v18.12.1 chore(deps): update node.js to v18.13.0 Jan 16, 2023
@renovate renovate bot force-pushed the renovate/node-18.x branch from 6d782d5 to 44ecb5c Compare February 2, 2023 20:27
@renovate renovate bot changed the title chore(deps): update node.js to v18.13.0 chore(deps): update node.js to v18.14.0 Feb 2, 2023
@renovate renovate bot force-pushed the renovate/node-18.x branch from 44ecb5c to 70aee99 Compare February 16, 2023 22:14
@renovate renovate bot changed the title chore(deps): update node.js to v18.14.0 chore(deps): update node.js to v18.14.1 Feb 16, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants