lukechilds/node - node - Gitea: Git with a cup of tea

13707 Commits

131 Branches

446 Tags

325 MiB

Tree: f6e332da2d

Commit Graph

Author	SHA1	Message	Date
James M Snell	0eae95eae3	deps: update http-parser to version 2.5.1 includes parsing improvements to ensure closer HTTP spec conformance PR-URL: https://github.com/nodejs/node-private/pull/20	9 years ago
James M Snell	da3750f981	src: add --security-revert command line flag The `--security-revert={cvenum}` command line flag is a special purpose flag to be used only in stable or LTS branches when a breaking change is required to address a security vulnerability. Whenever a vulnerability requires a breaking change, and a CVE has been assigned, the flag can be used to force Node to revert to the insecure behavior that was implemented before the fix was applied. Note that this flag is intended to be used only as a last resort in the case a security update breaks existing code. When used, a security warning will be printed to stderr when Node launches. The `--security-revert={cvenum}` flag takes a single CVE number as an argument. Multiple instances of the `--security-revert={cvenum}` flag can be used on the command line to revert multiple changes. Whenever a new `--security-revert={cvenum}` is enabled, it should be documented in the release notes and in the API docs. Master and the first release of a new major (e.g. v6.0) should not have any reverts available. Every time a new `--security-revert={cvenum}` is added, there should be a semver-minor bump in the stable and LTS branch. PR-URL: https://github.com/nodejs/node-private/pull/20	9 years ago

Author

SHA1

Message

Date

James M Snell

0eae95eae3

deps: update http-parser to version 2.5.1

includes parsing improvements to ensure closer HTTP spec conformance

PR-URL: https://github.com/nodejs/node-private/pull/20

9 years ago

James M Snell

da3750f981

src: add --security-revert command line flag

The `--security-revert={cvenum}` command line flag is a special purpose
flag to be used only in stable or LTS branches when a breaking change
is required to address a security vulnerability. Whenever a vulnerability
requires a breaking change, and a CVE has been assigned, the flag can
be used to force Node to revert to the insecure behavior that was
implemented before the fix was applied.

Note that this flag is intended to be used only as a last resort in the
case a security update breaks existing code. When used, a security
warning will be printed to stderr when Node launches.

The `--security-revert={cvenum}` flag takes a single CVE number as an
argument. Multiple instances of the `--security-revert={cvenum}` flag
can be used on the command line to revert multiple changes.

Whenever a new `--security-revert={cvenum}` is enabled, it should be
documented in the release notes and in the API docs.

Master and the first release of a new major (e.g. v6.0) should not have
any reverts available.

Every time a new `--security-revert={cvenum}` is added, there should be
a semver-minor bump in the stable and LTS branch.

PR-URL: https://github.com/nodejs/node-private/pull/20

9 years ago

2 Commits (f6e332da2dbaa03906c93f98285d388885af13ed)