Release proposal: v5.7.1 #5464
Merged
Release proposal: v5.7.1 #5464
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Feb 27, 2016
Closed
mscdex
added
the
meta
rvagg
force-pushed
the
v5.7.1-proposal
branch
from
dc229aa to
a6f4bf9
Compare
|
CI with latest cherry-picks https://ci.nodejs.org/job/node-test-commit/2367/ |
|
I've added this PR to the milestone: #5484 |
|
Another potential path issue: #5485 |
|
One more off the list, and another added: #5490. |
|
Okay, all known path issues are handled. |
|
Here is
|
|
I've been avoiding semver-minor and the timers patch for this release, hence 5.7.1, so it's an easier (if just mental, but likely a little lower risk) upgrade for existing users. |
|
@Fishrock123 also, we didn't have anything ready last week and the path fixes couldn't really be rushed so I don't think there's a whole lot we could have changed. |
|
Pretty sure #5389 (comment) (the important patch) was. We should have just landed and released imo. My fault for forgetting about it on Thursday. :/ |
|
Pushed commits to |
Fishrock123
force-pushed
the
v5.7.1-proposal
branch
2 times, most recently
from
fc9d191 to
5f882fa
Compare
Fishrock123
force-pushed
the
v5.7.1-proposal
branch
from
5f882fa to
db164cc
Compare
Fishrock123
force-pushed
the
v5.7.1-proposal
branch
from
db164cc to
079748e
Compare
Notable changes: * governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda). * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) #5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 * Fixed several regressions that appeared in v5.7.0: - path.relative(): - Output is no longer unnecessarily verbose (Brian White) #5389 - Resolving UNC paths on Windows now works correctly (Owen Smith) #5456 - Resolving paths with prefixes now works correctly from the root directory (Owen Smith) #5490 - url: Fixed an off-by-one error with `parse()` (Brian White) #5394 - dgram: Now correctly handles a default address case when offset and length are specified (Matteo Collina) #5407 PR-URL: #5464
PR-URL: #5464
Fishrock123
force-pushed
the
v5.7.1-proposal
branch
from
079748e to
3643670
Compare
|
CITGM before merging https://ci.nodejs.org/job/thealphanerd-smoker/100/ |
|
Building @ https://ci.nodejs.org/job/iojs+release/435/ |
Fishrock123
added a commit
to Fishrock123/node
that referenced
this pull request
Mar 2, 2016
Notable changes: * governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda). * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) nodejs#5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 * Fixed several regressions that appeared in v5.7.0: - path.relative(): - Output is no longer unnecessarily verbose (Brian White) nodejs#5389 - Resolving UNC paths on Windows now works correctly (Owen Smith) nodejs#5456 - Resolving paths with prefixes now works correctly from the root directory (Owen Smith) nodejs#5490 - url: Fixed an off-by-one error with `parse()` (Brian White) nodejs#5394 - dgram: Now correctly handles a default address case when offset and length are specified (Matteo Collina) nodejs#5407 PR-URL: nodejs#5464
|
|
||
| ### Notable changes | ||
|
|
||
| * **governance**: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda). |
There was a problem hiding this comment.
This is really odd in here. If you look at how this displays at https://nodejs.org/en/blog/ it seems like it is related to the Version 5.7.1 release.
Shouldn't this go in a "Weekly Update"?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Not much meat in here yet. The
path.relative(),url.parse()anddgram.send()fixes have not landed yet but there are at least 4 commits queued up in the various pull requests, plus OpenSSL.Milestone @Fishrock123 put together for this is https://github.com/nodejs/node/milestones/5.7.1
We're probably going to have to hold this up until at least we have an OpenSSL risk assessment. Perhaps we can move forward without even needing to bother with an OpenSSL upgrade but more likely we'll include it anyway. Which means the release date will be the 2nd or 3rd, next week.
Will figure out if/how we coordinate across release lines ASAP.
This is all we have so far:
Notable changes