lukechilds/node - node - Gitea: Git with a cup of tea

History

Rod Vagg 0e6750d1cd 2016-10-18 Node.js v6.9.0 'Boron' (LTS) Release This release marks the transition of Node.js v6 into Long Term Support (LTS) with the codename 'Boron'. The v6 release line now moves in to "Active LTS" and will remain so until April 2018. After that time it will move in to "Maintenance" until end of life in April 2019. This is also a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * crypto: Don't automatically attempt to load an OpenSSL configuration file, from the `OPENSSL_CONF` environment variable or from the default location for the current platform. Always triggering a configuration file load attempt may allow an attacker to load compromised OpenSSL configuration into a Node.js process if they are able to place a file in a default location. (Fedor Indutny, Rod Vagg) * node: Introduce the `process.release.lts` property, set to `"Boron"`. This value is `"Argon"` for v4 LTS releases and `undefined` for all other releases. (Rod Vagg) * V8: Backport fix for CVE-2016-5172, an arbitrary memory read. The parser in V8 mishandled scopes, potentially allowing an attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. This vulnerability would require an attacker to be able to execute arbitrary JavaScript code in a Node.js process. (Rod Vagg) * v8_inspector: Generate a UUID for each execution of the inspector. This provides additional security to prevent unauthorized clients from connecting to the Node.js process via the v8_inspector port when running with `--inspect`. Since the debugging protocol allows extensive access to the internals of a running process, and the execution of arbitrary code, it is important to limit connections to authorized tools only. Vulnerability originally reported by Jann Horn. (Eugene Ostroukhov) PR-URL: https://github.com/nodejs/node-private/pull/81		8 years ago
..
api	doc: fix typo in zlib.md	8 years ago
api_assets	doc: highlight deprecated API in ToC	8 years ago
changelogs	2016-10-18 Node.js v6.9.0 'Boron' (LTS) Release	8 years ago
ctc-meetings	doc: add CTC meeting minutes 2016-09-07	8 years ago
guides	doc: recommend using port 0 instead of common.PORT	8 years ago
topics	doc: enable no-file-name-articles remark-lint rule	8 years ago
tsc-meetings	tools: enable more remark-lint rules	8 years ago
full-white-stripe.jpg	build: update Node.js logo on Win installer	9 years ago
node.1	doc: make node(1) more consistent with tradition	8 years ago
onboarding-extras.md	doc: enable first-heading-level remark-lint rule	8 years ago
onboarding.md	doc: explain why GitHub merge button is not used	8 years ago
osx_installer_logo.png	build: update Node.js logo on OSX installer	9 years ago
releases.md	doc: add commit formats for release blog posts	8 years ago
template.html	doctool: improve the title of pages in doc	9 years ago
thin-white-stripe.jpg	build: update Node.js logo on Win installer	9 years ago