Update NodeJs to 6.2.1 (security update) #891
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Notable changes
Buffer()
andBuffer.allocUnsafe()
. This fixes a possible security concern (reported by Feross Aboukhadijeh) where user input is passed unchecked to the Buffer constructor orallocUnsafe()
as it can expose parts of the memory slab used by other Buffers in the application. Note that negative lengths are not supported by the Buffer API and user input to the constructor should always be sanitised and type-checked. (Anna Henningsen) #7051npm/npm@42d71be
npm/npm#12685 When usingnpm ls <pkg>
without a semver specifier,npm ls
would skip any packages in your tree that matched by name, but had a prerelease version in theirpackage.json
. (@zkat)npm/npm@f04e05
npm/npm#10013read-package-tree@5.1.4
: Fixes an issue wherenpm install
would fail if yournode_modules
was symlinked. (@iarna)b894413
#12372 Changing a nested dependency in annpm-shrinkwrap.json
and then runningnpm install
would not get up the updated package. This corrects that. (@misterbyrne)npm@3.9.0
, which is the result of our Windows testing push -- the test suite (should) pass on Windows now. We're working on getting AppVeyor to a place where we can just rely on it like Travis.