chore(deps): update dependency nodejs/node to v20.5.1 #7304

nicholasdille-bot · 2023-08-10T08:36:07Z

This PR contains the following updates:

Package	Update	Change
nodejs/node	major	`18.17.1` -> `20.5.1`
nodejs/node	minor	`20.0.0` -> `20.5.1`

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

Release Notes

nodejs/node (nodejs/node)

`v20.5.1`: 2023-08-09, Version 20.5.1 (Current), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)
CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
CVE-2023-32005: fs.statfs can bypass the permission model (Low)
CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

[92300b51b4] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[559698abf2] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[1bf3429e8e] - lib,permission: restrict process.binding when pm is enabled (RafaelGSS) nodejs-private/node-private#438
[98a83a67e6] - permission: ensure to resolve path when calling mkdtemp (RafaelGSS) nodejs-private/node-private#464
[1f0cde466b] - permission: handle buffer path on fs calls (RafaelGSS) nodejs-private/node-private#439
[bd094d60ea] - permission: handle fstatfs and add pm supported list (RafaelGSS) nodejs-private/node-private#441
[7337d21484] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
[cf348ec640] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#397

`v20.5.0`: 2023-07-18, Version 20.5.0 (Current), @juanarbol

Compare Source

Notable Changes

[45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
[a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
[986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
[0ef73ff6f0] - (SEMVER-MINOR) test_runner: add shards support (Raz Luvaton) #48639

Commits

[eb0aba59b8] - bootstrap: use correct descriptor for Symbol.{dispose,asyncDispose} (Jordan Harband) #48703
[e2d0195dcf] - bootstrap: hide experimental web globals with flag kNoBrowserGlobals (Chengzhong Wu) #48545
[67a1018389] - build: do not pass target toolchain flags to host toolchain (Ivan Trubach) #48597
[7d843bb942] - child_process: use addAbortListener (atlowChemi) #48550
[4e08160f8c] - child_process: support Symbol.dispose (Moshe Atlow) #48551
[ef7728bf36] - deps: update nghttp2 to 1.55.1 (Node.js GitHub Bot) #48790
[1454f02499] - deps: update nghttp2 to 1.55.0 (Node.js GitHub Bot) #48746
[fa94debf46] - deps: update minimatch to 9.0.3 (Node.js GitHub Bot) #48704
[c73cfcc144] - deps: update acorn to 8.10.0 (Node.js GitHub Bot) #48713
[b7a076a052] - deps: V8: cherry-pick cb00db4 (Keyhan Vakil) #48671
[150e15536b] - deps: upgrade npm to 9.8.0 (npm team) #48665
[c47b2cbd35] - dgram: socket add asyncDispose (atlowChemi) #48717
[002ce31cca] - dgram: use addAbortListener (atlowChemi) #48550
[45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
[69b55d2261] - doc: fix ambiguity in http.md and https.md (an5er) #48692
[caccb051c7] - doc: clarify transform._transform() callback argument logic (Rafael Sofi-zada) #48680
[999ae0c8c3] - doc: fix copy node executable in Windows (Yoav Vainrich) #48624
[7daefaeb44] - doc: drop <b> of v20 changelog (Rafael Gonzaga) #48649
[dd7ea3e1df] - doc: mention git node release prepare (Rafael Gonzaga) #48644
[cc7809df21] - esm: fix emit deprecation on legacy main resolve (Antoine du Hamel) #48664
[67b13d1dba] - events: fix bug listenerCount don't compare wrapped listener (yuzheng14) #48592
[a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
[986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
[e4333ac41f] - http2: use addAbortListener (atlowChemi) #48550
[4a0b66e4f9] - http2: send RST code 8 on AbortController signal (Devraj Mehta) #48573
[1295c76fce] - lib: use addAbortListener (atlowChemi) #48550
[dff6c25a36] - meta: bump actions/checkout from 3.5.2 to 3.5.3 (dependabot[bot]) #48625
[b5cb69ceaa] - meta: bump step-security/harden-runner from 2.4.0 to 2.4.1 (dependabot[bot]) #48626
[332e480b46] - meta: bump ossf/scorecard-action from 2.1.3 to 2.2.0 (dependabot[bot]) #48628
[25c5a0aaee] - meta: bump github/codeql-action from 2.3.6 to 2.20.1 (dependabot[bot]) #48627
[6406f50ab1] - module: add SourceMap.lineLengths (Isaac Z. Schlueter) #48461
[cfa69bd48c] - net: server add asyncDispose (atlowChemi) #48717
[ac11264cc5] - net: use addAbortListener (atlowChemi) #48550
[82d6b13bf6] - permission: add debug log when inserting fs nodes (Rafael Gonzaga) #48677
[f4333b1cdd] - permission: v8.writeHeapSnapshot and process.report (Rafael Gonzaga) #48564
[f691dca6c9] - readline: use addAbortListener (atlowChemi) #48550
[227e6bd898] - src: pass syscall on fs.readFileSync fail operation (Yagiz Nizipli) #48815
[a9a4b73653] - src: make BaseObject iteration order deterministic (Joyee Cheung) #48702
[d99ea4845a] - src: remove kEagerCompile for CompileFunction (Keyhan Vakil) #48671
[df363d0010] - src: deduplicate X509 getter implementations (Tobias Nießen) #48563
[9cf2e1f55b] - src,lib: reducing C++ calls of esm legacy main resolve (Vinicius Lourenço) #48325
[daeb21dde9] - stream: fix deadlock when pipeing to full sink (Robert Nagy) #48691
[5a382d02d6] - stream: use addAbortListener (atlowChemi) #48550
[6e82077dd4] - test: deflake test-net-throttle (Luigi Pinca) #48599
[d378b2c822] - test: move test-net-throttle to parallel (Luigi Pinca) #48599
[dfa0aee5bf] - Revert "test: remove test-crypto-keygen flaky designation" (Luigi Pinca) #48652
[0ef73ff6f0] - (SEMVER-MINOR) test_runner: add shards support (Raz Luvaton) #48639
[e2442bb7ef] - timers: support Symbol.dispose (Moshe Atlow) #48633
[4398ade426] - tools: run fetch_deps.py with Python 3 (Richard Lau) #48729
[38ce95d054] - tools: update doc to unist-util-select@5.0.0 unist-util-visit@5.0.0 (Node.js GitHub Bot) #48714
[b25e78a998] - tools: update lint-md-dependencies to rollup@3.26.2 (Node.js GitHub Bot) #48705
[a1f4ff7c59] - tools: update eslint to 8.44.0 (Node.js GitHub Bot) #48632
[42dc6eb698] - tools: update lint-md-dependencies to rollup@3.26.0 (Node.js GitHub Bot) #48631
[07bfcc45ab] - url: fix canParse false value when v8 optimizes (Yagiz Nizipli) #48817

`v20.4.0`: 2023-07-05, Version 20.4.0 (Current), @RafaelGSS

Compare Source

Notable Changes

Mock Timers

The new feature allows developers to write more reliable and predictable tests for time-dependent functionality.
It includes MockTimers with the ability to mock setTimeout, setInterval from globals, node:timers, and node:timers/promises.

The feature provides a simple API to advance time, enable specific timers, and release all timers.

import assert from 'node:assert';
import { test } from 'node:test';

test('mocks setTimeout to be executed synchronously without having to actually wait for it', (context) => {
  const fn = context.mock.fn();
  // Optionally choose what to mock
  context.mock.timers.enable(['setTimeout']);
  const nineSecs = 9000;
  setTimeout(fn, nineSecs);

  const threeSeconds = 3000;
  context.mock.timers.tick(threeSeconds);
  context.mock.timers.tick(threeSeconds);
  context.mock.timers.tick(threeSeconds);

  assert.strictEqual(fn.mock.callCount(), 1);
});

This feature was contributed by Erick Wendel in #47775.

Support to the explicit resource management proposal

Node is adding support to the explicit resource management
proposal to its resources allowing users of TypeScript/babel to use using/await using with
V8 support for everyone else on the way.

This feature was contributed by Moshe Atlow and Benjamin Gruenbaum in #48518.

Other notable changes

[fe333d2584] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
[60c2ea4e79] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
[5cacdf9e6b] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
[504d1d7bdc] - (SEMVER-MINOR) tls: add ALPNCallback server option for dynamic ALPN negotiation (Tim Perry) #45190

Commits

[8a611a387f] - benchmark: add bar.R (Rafael Gonzaga) #47729
[12fa716cf9] - benchmark: refactor crypto oneshot (Filip Skokan) #48267
[d6ecbde592] - benchmark: add crypto.create*Key (Filip Skokan) #48284
[e60b6dedd8] - bootstrap: unify snapshot builder and embedder entry points (Joyee Cheung) #48242
[40662957b1] - bootstrap: simplify initialization of source map handlers (Joyee Cheung) #48304
[6551538079] - build: fix configure --link-module (Richard Lau) #48522
[f7f32089e7] - build: sync libuv header change (Jiawen Geng) #48429
[f60205c915] - build: update action to close stale PRs (Michael Dawson) #48196
[4f4d0b802e] - child_process: improve spawn performance on Linux (Keyhan Vakil) #48523
[fe333d2584] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
[89aaf16237] - crypto: remove OPENSSL_FIPS guard for OpenSSL 3 (Richard Lau) #48392
[6199e1946c] - deps: upgrade to libuv 1.46.0 (Santiago Gimeno) #48618
[1b2b930fda] - deps: add loong64 config into openssl gypi (Shi Pujin) #48043
[ba8d048929] - deps: update acorn to 8.9.0 (Node.js GitHub Bot) #48484
[d96f921d06] - deps: update zlib to 1.2.13.1-motley-f81f385 (Node.js GitHub Bot) #48541
[ed1d047e8f] - deps: update googletest to ec4fed9 (Node.js GitHub Bot) #48538
[f43d718c67] - deps: update minimatch to 9.0.2 (Node.js GitHub Bot) #48542
[2f66147cbf] - deps: update corepack to 0.19.0 (Node.js GitHub Bot) #48540
[d91b0fde73] - deps: V8: cherry-pick 1a782f6 (Keyhan Vakil) #48523
[112335e342] - deps: update corepack to 0.18.1 (Node.js GitHub Bot) #48483
[2b141c413f] - deps: update icu to 73.2 (Node.js GitHub Bot) #48502
[188b34d4a1] - deps: upgrade npm to 9.7.2 (npm team) #48514
[bf0444b5d9] - deps: update zlib to 1.2.13.1-motley-3ca9f16 (Node.js GitHub Bot) #48413
[b339d80a56] - deps: upgrade npm to 9.7.1 (npm team) #48378
[4132931b87] - deps: update simdutf to 3.2.14 (Node.js GitHub Bot) #48344
[8cd56c1e85] - deps: update ada to 2.5.1 (Node.js GitHub Bot) #48319
[78cffcd645] - deps: update zlib to 982b036 (Node.js GitHub Bot) #48327
[6d00c2e33b] - doc: fix options order (Luigi Pinca) #48617
[7ad2d3a5d1] - doc: update security release stewards (Rafael Gonzaga) #48569
[cc3a056fdd] - doc: update return type for describe (Shrujal Shah) #48572
[99ae0b98af] - doc: run license-builder (github-actions[bot]) #48552
[9750d8205c] - doc: add description of autoAllocateChunkSize in ReadableStream (Debadree Chatterjee) #48004
[417927bb41] - doc: fix filename type in watch result (Dmitry Semigradsky) #48032
[ca2ae86bd7] - doc: unnest mime and MIMEParams from MIMEType constructor (Dmitry Semigradsky) #47950
[bda1228135] - doc: update security-release-process.md (Rafael Gonzaga) #48504
[60c2ea4e79] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
[37bc0eac4a] - doc: improve inspector.close() description (mary marchini) #48494
[2a403cdad5] - doc: link to Runtime Keys in export conditions (Jacob Hummer) #48408
[e2d579e644] - doc: update fs flags documentation (sinkhaha) #48463
[38bf290115] - doc: revise error.md introduction (Antoine du Hamel) #48423
[641a2e9c6d] - doc: add preveen-stack to triagers (Preveen P) #48387
[4ab5e8d2e3] - doc: refine when file is undefined in test events (Moshe Atlow) #48451
[5cacdf9e6b] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
[b9c643e3ef] - doc: add additional info on TSFN dispatch (Michael Dawson) #48367
[17a0e1d1bf] - doc: add link for news from security wg (Michael Dawson) #48396
[3a62994a4f] - doc: fix typo in events.md (Darshan Sen) #48436
[e10a4cdf68] - doc: run license-builder (github-actions[bot]) #48336
[19fde638fd] - fs: call the callback with an error if writeSync fails (killa) #47949
[4cad9fd8bd] - fs: remove unneeded return statement (Luigi Pinca) #48526
[d367b73f43] - fs: use kResistStopPropagation (Chemi Atlow) #48521
[e50c3169af] - fs, stream: initial Symbol.dispose and Symbol.asyncDispose support (Moshe Atlow) #48518
[7d8a0b6eb7] - http: null the joinDuplicateHeaders property on cleanup (Luigi Pinca) #48608
[94ebb02f59] - http: server add async dispose (atlowChemi) #48548
[c6a69e31a3] - http: remove useless ternary in test (geekreal) #48481
[2f0f40328f] - http: fix for handling on boot timers headers and request (Franciszek Koltuniuk) #48291
[5378ad8ab1] - http2: server add asyncDispose (atlowChemi) #48548
[97a58c5970] - https: server add asyncDispose (atlowChemi) #48548
[40ae6eb6aa] - https: fix connection checking interval not clearing on server close (Nitzan Uziely) #48383
[15530fea4c] - lib: merge cjs and esm package json reader caches (Yagiz Nizipli) #48477
[32bda81c31] - lib: reduce url getters on makeRequireFunction (Yagiz Nizipli) #48492
[0da03f01ba] - lib: remove duplicated requires in check_syntax (Yagiz Nizipli) #48508
[97b00c347d] - lib: add option to force handling stopped events (Chemi Atlow) #48301
[fe16749649] - lib: fix output message when repl is used with pm (Rafael Gonzaga) #48438
[8c2c02d28a] - lib: create weakRef only if any signals provided (Chemi Atlow) #48448
[b6ae411ea9] - lib: remove obsolete deletion of bufferBinding.zeroFill (Chengzhong Wu) #47881
[562b3d4856] - lib: move web global bootstrapping to the expected file (Chengzhong Wu) #47881
[f9c0d5acac] - lib: fix blob.stream() causing hanging promises (Debadree Chatterjee) #48232
[0162a0f5bf] - lib: add support for inherited custom inspection methods (Antoine du Hamel) #48306
[159ab6627a] - lib: reduce URL invocations on http2 origins (Yagiz Nizipli) #48338
[f0709fdc59] - module: add SourceMap.findOrigin (Isaac Z. Schlueter) #47790
[4ec2d925b1] - module: reduce url invocations in esm/load.js (Yagiz Nizipli) #48337
[2c363971cc] - net: improve network family autoselection handle handling (Paolo Insogna) #48464
[dbf9e9ffc8] - node-api: provide napi_define_properties fast path (Gabriel Schulhof) #48440
[87ad657777] - node-api: implement external strings (Gabriel Schulhof) #48339
[4efa6807ea] - permission: handle end nodes with children cases (Rafael Gonzaga) #48531
[84fe811108] - repl: display dynamic import variant in static import error messages (Hemanth HM) #48129
[bdcc037470] - report: disable js stack when no context is entered (Chengzhong Wu) #48495
[97bd9ccd04] - src: fix uninitialized field access in AsyncHooks (Jan Olaf Krems) #48566
[404958fc96] - src: fix Coverity issue regarding unnecessary copy (Yagiz Nizipli) #48565
[c4b8edea24] - src: refactor SplitString in util (Yagiz Nizipli) #48491
[5bc13a4772] - src: revert IS_RELEASE (Rafael Gonzaga) #48505
[4971e46051] - src: add V8 fast api to guessHandleType (Yagiz Nizipli) #48349
[954e46e792] - src: return uint32 for guessHandleType (Yagiz Nizipli) #48349
[05009675da] - src: make realm binding data store weak (Chengzhong Wu) #47688
[120ac74352] - src: remove aliased buffer weak callback (Chengzhong Wu) #47688
[6591826e99] - src: handle wasm out of bound in osx will raise SIGBUS correctly (Congcong Cai) #46561
[1b84ddeec2] - src: implement constants binding directly (Joyee Cheung) #48186
[06d49c1f10] - src: implement natives binding without special casing (Joyee Cheung) #48186
[325441abf5] - src: add missing to_ascii method in dns queries (Daniel Lemire) #48354
[84d0eb74b8] - stream: fix premature pipeline end (Robert Nagy) #48435
[3df7368735] - test: add missing assertions to test-runner-cli (Moshe Atlow) #48593
[07eb310b0d] - test: remove test-crypto-keygen flaky designation (Luigi Pinca) #48575
[75aa0a7682] - test: remove test-timers-immediate-queue flaky designation (Luigi Pinca) #48575
[a9756f3126] - test: add Symbol.dispose support to mock timers (Benjamin Gruenbaum) #48549
[0f912a7248] - test: mark test-child-process-stdio-reuse-readable-stdio flaky (Luigi Pinca) #48537
[30f4bc4985] - test: make IsolateData per-isolate in cctest (Joyee Cheung) #48450
[407ce3fdcb] - test: define NAPI_VERSION before including node_api.h (Chengzhong Wu) #48376
[24a8fa95f0] - test: remove unnecessary noop function args to mustNotCall() (Antoine du Hamel) #48513
[09af579775] - test: skip test-runner-watch-mode on IBMi (Moshe Atlow) #48473
[77cb1ee0b2] - test: add missing <algorithm> include for std::find (Sam James) #48380
[7c790ca03c] - test: fix flaky test-watch-mode (Moshe Atlow) #48147
[1398829746] - test: fix test-net-autoselectfamily for kernel without IPv6 support (Livia Medeiros) #48265
[764119ba4b] - test: update url web-platform tests (Yagiz Nizipli) #48319
[f1ead59629] - test: ignore the copied entry_point.c (Luigi Pinca) #48297
[fc5d1bddcb] - test: refactor test-gc-http-client-timeout (Luigi Pinca) #48292
[46a3d068a0] - test: update encoding web-platform tests (Yagiz Nizipli) #48320
[141e5aad83] - test: update FileAPI web-platform tests (Yagiz Nizipli) #48322
[83cfc67099] - test: update user-timing web-platform tests (Yagiz Nizipli) #48321
[2c56835a33] - test_runner: fixed test shorthands return type (Shocker) #48555
[7d01c8894a] - (SEMVER-MINOR) test_runner: add initial draft for fakeTimers (Erick Wendel) #47775
[de4f14c249] - test_runner: add enqueue and dequeue events (Moshe Atlow) #48428
[5ebe3a4ea7] - test_runner: make --test-name-pattern recursive (Moshe Atlow) #48382
[93bf447308] - test_runner: refactor coverage report output for readability (Damien Seguin) #47791
[504d1d7bdc] - (SEMVER-MINOR) tls: add ALPNCallback server option for dynamic ALPN negotiation (Tim Perry) #45190
[203c3cf4ca] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48544
[333907b19d] - tools: speedup compilation of js2c output (Keyhan Vakil) #48160
[10bd5f4d97] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48486
[52de27b9fe] - tools: pin ruff version number (Rich Trott) #48505
[4345526644] - tools: replace sed with perl (Luigi Pinca) #48499
[6c590835f3] - tools: automate update openssl v16 (Marco Ippolito) #48377
[90b5335338] - tools: update eslint to 8.43.0 (Node.js GitHub Bot) #48487
[cd83530a11] - tools: update doc to to-vfile@8.0.0 (Node.js GitHub Bot) #48485
[e500b439bd] - tools: prepare tools/doc for to-vfile 8.0.0 (Rich Trott) #48485
[d623616813] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48417
[a2e107dde4] - tools: update create-or-update-pull-request-action (Richard Lau) #48398
[8009e2c3be] - tools: update eslint-plugin-jsdoc (Richard Lau) #48393
[10385c8565] - tools: add version update to external dependencies (Andrea Fassina) #48081
[b1cef81b18] - tools: update eslint to 8.42.0 (Node.js GitHub Bot) #48328
[0923dc0b8e] - tools: disable jsdoc/no-defaults rule (Luigi Pinca) #48328
[b03146da85] - typings: remove unused primordials (Yagiz Nizipli) #48509
[e9c9d187b9] - typings: fix JSDoc in ESM loader modules (Antoine du Hamel) #48424
[fafe651d23] - url: conform to origin getter spec changes (Yagiz Nizipli) #48319

`v20.3.1`: 2023-06-20, Version 20.3.1 (Current), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

[dac08dafc9] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
[d274c3babc] - crypto,https,tls: disable engines if perms enabled (Tobias Nießen) nodejs-private/node-private#409
[5621c1de38] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[771caa9f1c] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[0459bf9c99] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
[27e20501aa] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#427
[9c17e335f1] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
[b51124c637] - permission: handle fs path traversal (RafaelGSS) nodejs-private/node-private#403
[ebc5927adc] - permission: handle fs.openAsBlob (RafaelGSS) nodejs-private/node-private#405
[c39a43bff5] - permission: handle fs.watchFile (RafaelGSS) nodejs-private/node-private#404
[d0a8264ec9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
[3df13d5a79] - src,permission: restrict inspector when pm enabled (RafaelGSS) nodejs-private/node-private#410

`v20.3.0`: 2023-06-08, Version 20.3.0 (Current), @targos

Compare Source

Notable Changes

[bfcb3d1d9a] - deps: upgrade to libuv 1.45.0, including significant performance improvements to file system operations on Linux (Santiago Gimeno) #48078
[5094d1b292] - doc: add Ruy Adorno to list of TSC members (Michael Dawson) #48172
[2f5dbca690] - doc: mark Node.js 14 as End-of-Life (Richard Lau) #48023
[b1828b325e] - (SEMVER-MINOR) lib: implement AbortSignal.any() (Chemi Atlow) #47821
[f380953103] - module: change default resolver to not throw on unknown scheme (Gil Tayar) #47824
[a94f87ed99] - (SEMVER-MINOR) node-api: define version 9 (Chengzhong Wu) #48151
[9e2b13dfa7] - stream: deprecate asIndexedPairs (Chemi Atlow) #48102

Commits

[35c96156d1] - benchmark: use cluster.isPrimary instead of cluster.isMaster (Deokjin Kim) #48002
[3e6e3abf32] - bootstrap: throw ERR_NOT_SUPPORTED_IN_SNAPSHOT in unsupported operation (Joyee Cheung) #47887
[c480559347] - bootstrap: put is_building_snapshot state in IsolateData (Joyee Cheung) #47887
[50c0a15535] - build: set v8_enable_webassembly=false when lite mode is enabled (Cheng Shao) #48248
[4562805cf6] - build: speed up compilation of mksnapshot output (Keyhan Vakil) #48162
[8b89f13933] - build: add action to close stale PRs (Michael Dawson) #48051
[5d92202220] - build: replace js2c.py with js2c.cc (Joyee Cheung) #46997
[6cf2adc36e] - cluster: use ObjectPrototypeHasOwnProperty (Daeyeon Jeong) #48141
[f564b03c38] - crypto: use openssl's own memory BIOs in crypto_context.cc (GauriSpears) #47160
[ac8dd61fc3] - crypto: remove default encoding from cipher (Tobias Nießen) #47998
[15c2de4407] - crypto: fix setEngine() when OPENSSL_NO_ENGINE set (Tobias Nießen) #47977
[9e2dd5b5e2] - deps: update zlib to 337322d (Node.js GitHub Bot) #48218
[bfcb3d1d9a] - deps: upgrade to libuv 1.45.0 (Santiago Gimeno) #48078
[13930f092f] - deps: update ada to 2.5.0 (Node.js GitHub Bot) #48223
[3047caebec] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
[0db79a0872] - deps: update histogram 0.11.8 (Marco Ippolito) #47742
[99af6716f5] - deps: update histogram to 0.11.7 (Marco Ippolito) #47742
[d4922bc985] - deps: update c-ares to 1.19.1 (Node.js GitHub Bot) #48115
[f6ccdb289f] - deps: update simdutf to 3.2.12 (Node.js GitHub Bot) #48118
[3ed0afc778] - deps: update minimatch to 9.0.1 (Node.js GitHub Bot) #48094
[df7540fb73] - deps: update ada to 2.4.2 (Node.js GitHub Bot) #48092
[07df5c48e8] - deps: update corepack to 0.18.0 (Node.js GitHub Bot) #48091
[d95a5bb559] - deps: update uvwasi to 0.0.18 (Node.js GitHub Bot) #47866
[443477e041] - deps: update uvwasi to 0.0.17 (Node.js GitHub Bot) #47866
[03f67d6d6d] - deps: upgrade npm to 9.6.7 (npm team) #48062
[d3e3a911fd] - deps: update nghttp2 to 1.53.0 (Node.js GitHub Bot) #47997
[f7c4daaf67] - deps: update ada to 2.4.1 (Node.js GitHub Bot) #48036
[c6a752560d] - deps: add loongarch64 into openssl Makefile and gen openssl-loongarch64 (Shi Pujin) #46401
[d194241716] - deps: update undici to 5.22.1 (Node.js GitHub Bot) #47994
[02e919f4a2] - deps,test: update postject to 1.0.0-alpha.6 (Node.js GitHub Bot) #48072
[2c19f596ad] - doc: clarify array args to Buffer.from() (Bryan English) #48274
[d681e5f456] - doc: document watch option for node:test run() (Moshe Atlow) #48256
[96e54ddbca] - doc: reserve 117 for Electron 26 (Calvin) #48245
[9aff8c7818] - doc: update documentation for FIPS support (Richard Lau) #48194
[8c5338648f] - doc: improve the documentation of the stdio opti

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

chore(deps): update dependency nodejs/node to v20.5.1

73738db

nicholasdille-bot added bump/major bump/minor type/renovate labels Aug 10, 2023

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 10, 2023

nicholasdille-bot closed this Aug 10, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 10, 2023 10:23

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 10, 2023

nicholasdille-bot reopened this Aug 10, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 10, 2023 14:33

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 11, 2023

nicholasdille-bot closed this Aug 11, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 11, 2023 00:37

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 11, 2023

nicholasdille-bot reopened this Aug 11, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 11, 2023 04:24

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 11, 2023

nicholasdille-bot closed this Aug 11, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 11, 2023 04:29

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 11, 2023

nicholasdille-bot reopened this Aug 11, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 11, 2023 06:30

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 11, 2023

nicholasdille-bot closed this Aug 11, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 11, 2023 16:28

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 11, 2023

nicholasdille-bot reopened this Aug 11, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 11, 2023 20:22

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 12, 2023

nicholasdille-bot closed this Aug 12, 2023

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 17, 2023

nicholasdille-bot closed this Aug 17, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 17, 2023 08:53

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 17, 2023

nicholasdille-bot reopened this Aug 17, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 17, 2023 16:43

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 17, 2023

nicholasdille-bot closed this Aug 17, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 17, 2023 18:26

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 18, 2023

nicholasdille-bot reopened this Aug 18, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 18, 2023 10:23

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 18, 2023

nicholasdille-bot closed this Aug 18, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 18, 2023 18:31

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 19, 2023

nicholasdille-bot reopened this Aug 19, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 19, 2023 02:29

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 19, 2023

nicholasdille-bot closed this Aug 19, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 19, 2023 12:26

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 19, 2023

nicholasdille-bot reopened this Aug 19, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 19, 2023 14:23

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1~~ chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed Aug 19, 2023

nicholasdille-bot closed this Aug 19, 2023

nicholasdille-bot deleted the renovate/nodejs-node-20.x branch August 19, 2023 22:22

nicholasdille-bot changed the title ~~chore(deps): update dependency nodejs/node to v20.5.1 - autoclosed~~ chore(deps): update dependency nodejs/node to v20.5.1 Aug 20, 2023

nicholasdille-bot reopened this Aug 20, 2023

nicholasdille-bot restored the renovate/nodejs-node-20.x branch August 20, 2023 08:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency nodejs/node to v20.5.1 #7304

chore(deps): update dependency nodejs/node to v20.5.1 #7304

nicholasdille-bot commented Aug 10, 2023

chore(deps): update dependency nodejs/node to v20.5.1 #7304

Are you sure you want to change the base?

chore(deps): update dependency nodejs/node to v20.5.1 #7304

Conversation

nicholasdille-bot commented Aug 10, 2023

⚠ Dependency Lookup Warnings ⚠

Release Notes

v20.5.1: 2023-08-09, Version 20.5.1 (Current), @​RafaelGSS

Notable Changes

Commits

v20.5.0: 2023-07-18, Version 20.5.0 (Current), @​juanarbol

Notable Changes

Commits

v20.4.0: 2023-07-05, Version 20.4.0 (Current), @​RafaelGSS

Notable Changes

Mock Timers

Support to the explicit resource management proposal

Other notable changes

Commits

v20.3.1: 2023-06-20, Version 20.3.1 (Current), @​RafaelGSS

Notable Changes

Commits

v20.3.0: 2023-06-08, Version 20.3.0 (Current), @​targos

Notable Changes

Commits

Configuration

`v20.5.1`: 2023-08-09, Version 20.5.1 (Current), @RafaelGSS

`v20.5.0`: 2023-07-18, Version 20.5.0 (Current), @juanarbol

`v20.4.0`: 2023-07-05, Version 20.4.0 (Current), @RafaelGSS

`v20.3.1`: 2023-06-20, Version 20.3.1 (Current), @RafaelGSS

`v20.3.0`: 2023-06-08, Version 20.3.0 (Current), @targos