Skip to content

Commit

Permalink
chore(deps): update node.js to v21.6.2 (#408)
Browse files Browse the repository at this point in the history
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [node](https://github.com/nodejs/node) | final | patch | `21.6.1` ->
`21.6.2` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v21.6.2`](https://github.com/nodejs/node/releases/tag/v21.6.2):
2024-02-14, Version 21.6.2 (Current), @&#8203;RafaelGSS

[Compare
Source](https://github.com/nodejs/node/compare/v21.6.1...v21.6.2)

##### Notable changes

This is a security release.

##### Notable changes

- CVE-2024-21892 - Code injection and privilege escalation through Linux
capabilities- (High)
- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded
chunk extension allows DoS attacks- (High)
- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals-
(High)
- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring
- (High)
- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing
variant of the Bleichenbacher attack against
[PKCS#1](https://github.com/PKCS/node/issues/1) v1.5 padding) -
(Medium)
- CVE-2024-21891 - Multiple permission model bypasses due to improper
path traversal sequence sanitization - (Medium)
- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and
--allow-fs-write (Medium)
- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch()
brotli decoding - (Medium)
-   undici version 5.28.3
-   libuv version 1.48.0
-   OpenSSL version 3.0.13+quic1

##### Commits

- \[[`8344719369`](https://github.com/nodejs/node/commit/8344719369)]
- **crypto**: disable [PKCS#1](https://github.com/PKCS/node/issues/1)
padding for privateDecrypt (Michael Dawson)
[nodejs-private/node-private#525](https://github.com/nodejs-private/node-private/pull/525)
- \[[`d093600ac4`](https://github.com/nodejs/node/commit/d093600ac4)]
- **deps**: update archs files for openssl-3.0.13+quic1 (Node.js GitHub
Bot) [#&#8203;51614](https://github.com/nodejs/node/pull/51614)
- \[[`6cd930e5e8`](https://github.com/nodejs/node/commit/6cd930e5e8)]
- **deps**: upgrade openssl sources to quictls/openssl-3.0.13+quic1
(Node.js GitHub Bot)
[#&#8203;51614](https://github.com/nodejs/node/pull/51614)
- \[[`9590c15d3d`](https://github.com/nodejs/node/commit/9590c15d3d)]
- **deps**: upgrade libuv to 1.48.0 (Santiago Gimeno)
[#&#8203;51698](https://github.com/nodejs/node/pull/51698)
- \[[`666096298c`](https://github.com/nodejs/node/commit/666096298c)]
- **deps**: disable io_uring support in libuv by default (Tobias Nießen)
[nodejs-private/node-private#528](https://github.com/nodejs-private/node-private/pull/528)
- \[[`a4edd22e30`](https://github.com/nodejs/node/commit/a4edd22e30)]
- **fs**: protect against modified Buffer internals in
possiblyTransformPath (Tobias Nießen)
[nodejs-private/node-private#497](https://github.com/nodejs-private/node-private/pull/497)
- \[[`6155a1ffaf`](https://github.com/nodejs/node/commit/6155a1ffaf)]
- **http**: add maximum chunk extension size (Paolo Insogna)
[nodejs-private/node-private#518](https://github.com/nodejs-private/node-private/pull/518)
- \[[`777509495e`](https://github.com/nodejs/node/commit/777509495e)]
- **lib**: use cache fs internals against path traversal (RafaelGSS)
[nodejs-private/node-private#516](https://github.com/nodejs-private/node-private/pull/516)
- \[[`9d2ac2b3fc`](https://github.com/nodejs/node/commit/9d2ac2b3fc)]
- **lib**: update undici to v5.28.3 (Matteo Collina)
[nodejs-private/node-private#538](https://github.com/nodejs-private/node-private/pull/538)
- \[[`208b3940c7`](https://github.com/nodejs/node/commit/208b3940c7)]
- **src**: fix HasOnly(capability) in node::credentials (Tobias Nießen)
[nodejs-private/node-private#505](https://github.com/nodejs-private/node-private/pull/505)
- \[[`fc2454f29c`](https://github.com/nodejs/node/commit/fc2454f29c)]
- **src,deps**: disable setuid() etc if io_uring enabled (Tobias Nießen)
[nodejs-private/node-private#528](https://github.com/nodejs-private/node-private/pull/528)
- \[[`ef3eea20be`](https://github.com/nodejs/node/commit/ef3eea20be)]
- **test,doc**: clarify wildcard usage (RafaelGSS)
[nodejs-private/node-private#517](https://github.com/nodejs-private/node-private/pull/517)
- \[[`8547196964`](https://github.com/nodejs/node/commit/8547196964)]
- **zlib**: pause stream if outgoing buffer is full (Matteo Collina)
[nodejs-private/node-private#540](https://github.com/nodejs-private/node-private/pull/540)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/Johannes-Andersen/Johannes).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNzMuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE3My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
  • Loading branch information
renovate[bot] authored Feb 16, 2024
1 parent d00eb85 commit 148448c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM node:21.6.1 AS base
FROM node:21.6.2 AS base
WORKDIR /app

COPY package.json package-lock.json ./
Expand Down

0 comments on commit 148448c

Please sign in to comment.