Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency node to v20 - autoclosed #328

Closed
wants to merge 1 commit into from
Closed

chore(deps): update dependency node to v20 - autoclosed #328

wants to merge 1 commit into from

Conversation

tradeshift-renovate[bot]
Copy link
Contributor

@tradeshift-renovate tradeshift-renovate bot commented Nov 21, 2023 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
node (source) major 18.14.2 -> 20.11.1
@types/node (source) devDependencies major 18.14.2 -> 20.11.30

Release Notes

nodejs/node (node)

v20.11.1: 2024-02-14, Version 20.11.1 'Iron' (LTS), @​RafaelGSS prepared by @​marco-ippolito

Compare Source

Notable changes

This is a security release.

Notable changes
  • CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  • CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  • CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
  • CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
  • CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  • CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  • CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  • CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  • undici version 5.28.3
  • libuv version 1.48.0
  • OpenSSL version 3.0.13+quic1
Commits

v20.11.0: 2024-01-09, Version 20.11.0 'Iron' (LTS), @​UlisesGascon

Compare Source

Notable Changes
Commits

v20.10.0: 2023-11-22, Version 20.10.0 'Iron' (LTS), @​targos

Compare Source

Notable Changes
--experimental-default-type flag to flip module defaults

The new flag --experimental-default-type can be used to flip the default
module system used by Node.js. Input that is already explicitly defined as ES
modules or CommonJS, such as by a package.json "type" field or .mjs/.cjs
file extension or the --input-type flag, is unaffected. What is currently
implicitly CommonJS would instead be interpreted as ES modules under
--experimental-default-type=module:

  • String input provided via --eval or STDIN, if --input-type is unspecified.

  • Files ending in .js or with no extension, if there is no package.json file
    present in the same folder or any parent folder.

  • Files ending in .js or with no extension, if the nearest parent
    package.json field lacks a type field; unless the folder is inside a
    node_modules folder.

In addition, extensionless files are interpreted as Wasm if
--experimental-wasm-modules is passed and the file contains the "magic bytes"
Wasm header.

Contributed by Geoffrey Booth in #​49869.

Detect ESM syntax in ambiguous JavaScript

The new flag --experimental-detect-module can be used to automatically run ES
modules when their syntax can be detected. For “ambiguous” files, which are
.js or extensionless files with no package.json with a type field, Node.js
will parse the file to detect ES module syntax; if found, it will run the file
as an ES module, otherwise it will run the file as a CommonJS module. The same
applies to string input via --eval or STDIN.

We hope to make detection enabled by default in a future version of Node.js.
Detection increases startup time, so we encourage everyone—especially package
authors—to add a type field to package.json, even for the default
"type": "commonjs". The presence of a type field, or explicit extensions
such as .mjs or .cjs, will opt out of detection.

Contributed by Geoffrey Booth in #​50096.

New flush option in file system functions

When writing to files, it is possible that data is not immediately flushed to
permanent storage. This allows subsequent read operations to see stale data.
This PR adds a 'flush' option to the fs.writeFile family of functions which
forces the data to be flushed at the end of a successful write operation.

Contributed by Colin Ihrig in #​50009 and #​50095.

Experimental WebSocket client

Adds a --experimental-websocket flag that adds a WebSocket
global, as standardized by WHATWG.

Contributed by Matthew Aitken in #​49830.

vm: fix V8 compilation cache support for vm.Script

Previously repeated compilation of the same source code using vm.Script
stopped hitting the V8 compilation cache after v16.x when support for
importModuleDynamically was added to vm.Script, resulting in a performance
regression that blocked users (in particular Jest users) from upgrading from
v16.x.

The recent fixes allow the compilation cache to be hit again
for vm.Script when --experimental-vm-modules is not used even in the
presence of the importModuleDynamically option, so that users affected by the
performance regression can now upgrade. Ongoing work is also being done to
enable compilation cache support for vm.CompileFunction.

Contributed by Joyee Cheung in #​49950
and #​50137.

Other notable changes
  • [[`21

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@tradeshift-renovate tradeshift-renovate bot requested review from a team as code owners November 21, 2023 11:37
@tradeshift-renovate tradeshift-renovate bot added dependencies Pull requests that update a dependency file dev labels Nov 21, 2023
@tradeshift-renovate
Copy link
Contributor Author

tradeshift-renovate bot commented Nov 21, 2023 •
edited
Loading

⚠ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined
Command failed: npm ci --ignore-scripts
npm ERR! code EACCES
npm ERR! syscall open
npm ERR! path /home/ubuntu/.npm/_cacache/tmp/dd4b5445
npm ERR! errno -13
npm ERR! 
npm ERR! Your cache folder contains root-owned files, due to a bug in
npm ERR! previous versions of npm which has since been addressed.
npm ERR! 
npm ERR! To permanently fix this problem, please run:
npm ERR!   sudo chown -R 1000:0 "/home/ubuntu/.npm"

npm ERR! A complete log of this run can be found in: /home/ubuntu/.npm/_logs/2024-03-13T17_12_48_347Z-debug-0.log
File name: undefined
Command failed: npm run --if-present format
sh: 1: prettier: not found
File name: undefined
Command failed: npm run --if-present build
sh: 1: tsc: not found
File name: undefined
Command failed: npm run --if-present package
sh: 1: ncc: not found

@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 5 times, most recently from 8f3d283 to e84420c Compare November 24, 2023 16:59
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 6abd801 to b5a20d9 Compare December 5, 2023 09:58
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 226f9a3 to 1f9c49a Compare December 18, 2023 13:47
@tradeshift-renovate
Copy link
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.

@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 5 times, most recently from b0594ba to f8fbca1 Compare January 11, 2024 06:15
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 3 times, most recently from 32128a3 to 04133c6 Compare January 17, 2024 08:31
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 4 times, most recently from 3ae6b56 to ebe8c27 Compare January 29, 2024 03:25
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 2 times, most recently from 559e683 to 19ed286 Compare February 1, 2024 21:51
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 11 times, most recently from 81fc381 to 5bfcd04 Compare February 14, 2024 20:53
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 3 times, most recently from 2b89d02 to f6565af Compare February 29, 2024 20:04
@tradeshift-renovate tradeshift-renovate bot force-pushed the renovate/node-20.x branch 3 times, most recently from 8cd93e8 to b32d618 Compare March 13, 2024 17:12
@wiz-inc-48d099cbad
Copy link

wiz-inc-48d099cbad bot commented Mar 15, 2024 •
edited
Loading

Wiz Scan Summary
IaC Misconfigurations 0C 0H 0M 0L 0I
Vulnerabilities 0C 0H 1M 0L 0I
Total 0C 0H 1M 0L 0I
Secrets 0🔑

@tradeshift-renovate
Copy link
Contributor Author

tradeshift-renovate bot commented Mar 15, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻️ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined
Command failed: npm ci --ignore-scripts
npm ERR! code EACCES
npm ERR! syscall open
npm ERR! path /home/ubuntu/.npm/_cacache/tmp/1816fced
npm ERR! errno -13
npm ERR! 
npm ERR! Your cache folder contains root-owned files, due to a bug in
npm ERR! previous versions of npm which has since been addressed.
npm ERR! 
npm ERR! To permanently fix this problem, please run:
npm ERR!   sudo chown -R 1000:0 "/home/ubuntu/.npm"

npm ERR! A complete log of this run can be found in: /home/ubuntu/.npm/_logs/2024-03-19T18_31_20_098Z-debug-0.log
File name: undefined
Command failed: npm run --if-present format
sh: 1: prettier: not found
File name: undefined
Command failed: npm run --if-present build
sh: 1: tsc: not found
File name: undefined
Command failed: npm run --if-present package
sh: 1: ncc: not found

@tradeshift-renovate tradeshift-renovate bot changed the title chore(deps): update dependency node to v20 chore(deps): update dependency node to v20 - autoclosed Oct 29, 2024
@tradeshift-renovate tradeshift-renovate bot deleted the renovate/node-20.x branch October 29, 2024 16:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tssecurity tssecurity tssecurity approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file dev
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@tssecurity