lukechilds/node - node - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
Rod Vagg	107f77594b	2016-10-18 Version 0.10.48 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more information at https://c-ares.haxx.se/adv_20160929.html (Rod Vagg) PR-URL: https://github.com/nodejs/node/pull/9154	9 years ago
Rod Vagg	f5ee3fe10e	2016-09-27 Version 0.10.47 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) * http: - CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) - Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White) * openssl: Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) PR-URL: https://github.com/nodejs/node-private/pull/71	9 years ago
Сковорода Никита Андреевич	e1643ccc5a	doc: fix minor formatting issue in 0.10 changelog This splits one huge commit description into paragraphs, which supposedly was the intended behavior there. PR-URL: https://github.com/nodejs/node/pull/7727 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Michaël Zasso <mic.besace@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Сковорода Никита Андреевич	9ddc915a9c	doc: convert tabs to spaces Convert all instances of tab indentation in *.md files to spaces. This affects only three files. PR-URL: https://github.com/nodejs/node/pull/7727 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Michaël Zasso <mic.besace@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Rod Vagg	71b29bb8a9	2016-06-23 Version 0.10.46 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * libuv: (CVE-2014-9748) Fixes a bug in the read/write locks implementation for Windows XP and Windows 2003 that can lead to undefined and potentially unsafe behaviour. More information can be found at https://github.com/libuv/libuv/issues/515 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. * V8: (CVE-2016-1669) Fixes a potential Buffer overflow vulnerability discovered in V8, more details can be found in the CVE CVE-2016-1669 at https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. Commits: * [`3374f57973`] - deps: update libuv to 0.10.37 (Saúl Ibarra Corretgé) https://github.com/nodejs/node/pull/7293 * [`fcb9145e29`] - deps: backport 3a9bfec from v8 upstream (Myles Borins) https://github.com/nodejs/node-private/pull/43 PR-URL: https://github.com/nodejs/node-private/pull/52	9 years ago
James M Snell	c663a6db05	doc: refactor the changelog by version The changelog was getting rather huge and difficult to manage. It also wasn't very useful in terms of being able to quickly find specific Node.js versions, or tracking the history for a single major release stream. This reorganizes the changelog by versions separated out over multiple files. An index of the most recent versions is provided in the main log. PR-URL: https://github.com/nodejs/node/pull/6503 Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Robert Lindstaedt <robert.lindstaedt@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>	9 years ago