Update dependency node to v16.20.2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
node		minor	16.18.1 -> 16.20.2
node	engines	minor	16.18.1 -> 16.20.2

---

Release Notes

nodejs/node (node)

v16.20.2: 2023-08-09, Version 16.20.2 'Gallium' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-32002: Policies can be bypassed via Module._load (High)
• CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
• CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 14th July.
  • OpenSSL security advisory 19th July.
  • OpenSSL security advisory 31st July

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

• [40c3958a5a] - deps: update archs files for OpenSSL-1.1.1v (RafaelGSS) #​49043
• [a9ac9da89a] - deps: fix openssl crypto clean (RafaelGSS) #​49043
• [362d4c7494] - deps: upgrade openssl sources to OpenSSL_1_1_1v (RafaelGSS) #​49043
• [d8ccfe9ad4] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#445
• [242aaa0caa] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#459

v16.20.1: 2023-06-20, Version 16.20.1 'Gallium' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
• CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
• CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
• CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
• CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 28th March.
  • OpenSSL security advisory 20th April.
  • OpenSSL security advisory 30th May
• c-ares vulnerabilities:
  • GHSA-9g78-jv2r-p7vc
  • GHSA-8r8p-23f3-64c2
  • GHSA-54xr-f67r-4pc4
  • GHSA-x6mf-cxr9-8q6v

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

• [5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
• [5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #​48156
• [c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #​48115
• [155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #​48369
• [8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #​48369
• [1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
• [e42ff4b018] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#429
• [10042683c8] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
• [a6f4e87bc9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
• [b77000f4d7] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #​47851

v16.20.0: 2023-03-29, Version 16.20.0 'Gallium' (LTS), @​BethGriggs

Compare Source

Notable Changes

• deps:
  • update undici to 5.20.0 (Node.js GitHub Bot) #​46711
  • update c-ares to 1.19.0 (Michaël Zasso) #​46415
  • upgrade npm to 8.19.4 (npm team) #​46677
  • update corepack to 0.17.0 (Node.js GitHub Bot) #​46842
• (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #​44376

Commits

• [de6dd67790] - crypto: avoid hang when no algorithm available (Richard Lau) #​46237
• [4617512788] - crypto: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) #​46185
• [24972164fc] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #​46711
• [85f88c6a8d] - deps: V8: cherry-pick 90be99f (Michaël Zasso) #​46646
• [b4ebe6d47b] - deps: update c-ares to 1.19.0 (Michaël Zasso) #​46415
• [56cbc7fdda] - deps: V8: cherry-pick c2792e5 (Jiawen Geng) #​44961
• [7af9bdb31e] - deps: upgrade npm to 8.19.4 (npm team) #​46677
• [962a7471b5] - deps: update corepack to 0.17.0 (Node.js GitHub Bot) #​46842
• [748bc96e35] - deps: update corepack to 0.16.0 (Node.js GitHub Bot) #​46710
• [a467782499] - deps: update corepack to 0.15.3 (Node.js GitHub Bot) #​46037
• [1913b6763d] - deps: update corepack to 0.15.2 (Node.js GitHub Bot) #​45635
• [809371a15f] - module: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) #​45147
• [086bb2f8d4] - Revert "src: let http2 streams end after session close" (Rich Trott) #​46721
• [6a01d39120] - (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #​44376
• [d081032a60] - test: fix test-net-connect-reset-until-connected (Vita Batrla) #​46781
• [efe1be47ec] - test: skip test depending on overlapped-checker when not available (Antoine du Hamel) #​45015
• [fc47d58abe] - test: remove cjs loader from stack traces (Geoffrey Booth) #​44197
• [cf76d0790d] - test: fix WPT title when no META title is present (Filip Skokan) #​46804
• [0d1485b924] - test: fix default WPT titles (Filip Skokan) #​46778
• [088e9cde3d] - test: add WPTRunner support for variants and generating WPT reports (Filip Skokan) #​46498
• [908c4dff44] - test: mark test-crypto-key-objects flaky on Linux (Richard Lau) #​46684
• [768e56227e] - tools: make utils.SearchFiles deterministic (Bruno Pitrus) #​44496

v16.19.1: 2023-02-16, Version 16.19.1 'Gallium' (LTS), @​richardlau

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
• CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
• CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

Fixed by an update to undici:

• CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
  • See GHSA-5r9g-qh6m-jxff for more information.
• CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
  • See GHSA-r6ch-mqf9-qc9w for more information.

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.

Commits

• [7fef050447] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
• [b558e9f476] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
• [160adb7ffc] - crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #​45495
• [d0ece30948] - crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #​45377
• [2d9ae4f184] - deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
• [d80e8312fd] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #​46568
• [de5c8d2c2f] - deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #​46568
• [1a8ccfe908] - deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #​46568
• [693789780b] - doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #​45846
• [f95ef064f4] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
• [b02d895137] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
• [d7f83c420c] - test: avoid left behind child processes (Richard Lau) #​46276

v16.19.0: 2022-12-13, Version 16.19.0 'Gallium' (LTS), @​richardlau

Compare Source

Notable Changes

OpenSSL 1.1.1s

This update is a bugfix release and does not address any security
vulnerabilities.

Root certificates updated to NSS 3.85

Certificates added:

• Autoridad de Certificacion Firmaprofesional CIF A626340
• Certainly Root E1
• Certainly Root R1
• D-TRUST BR Root CA 1 2020
• D-TRUST EV Root CA 1 2020
• DigiCert TLS ECC P384 Root G5
• DigiCert TLS RSA4096 Root G5
• E-Tugra Global Root CA ECC v3
• E-Tugra Global Root CA RSA v3
• HiPKI Root CA - G1
• ISRG Root X2
• Security Communication ECC RootCA1
• Security Communication RootCA3
• Telia Root CA v2
• vTrus ECC Root CA
• vTrus Root CA

Certificates removed:

• Cybertrust Global Root
• DST Root CA X3
• GlobalSign Root CA - R2
• Hellenic Academic and Research Institutions RootCA 2011

Time zone update to 2022f

Time zone data has been updated to 2022f. This includes changes to Daylight
Savings Time (DST) for Fiji and Mexico. For more information, see
https://mm.icann.org/pipermail/tz-announce/2022-October/000075.html.

Other Notable Changes

• [33707dcd03] - dgram: add dgram send queue info (theanarkh) #​44149

Dependency updates:

• [3b2b70d792] - deps: upgrade npm to 8.19.3 (npm team) #​45322

Experimental features:

• [1e0dcd1ee0] - cli: add --watch (Moshe Atlow) #​44366
• [8c73279ebb] - util: add default value option to parsearg (Manuel Spigolon) #​44631

Commits

• [bbef3c42f6] - build: add version info to timezone update PR (Darshan Sen) #​45021
• [cc2c7648e0] - build: support Python 3.11 (Luigi Pinca) #​45191
• [ac24c80663] - build: remove redundant condition from common.gypi (Richard Lau) #​45076
• [03dcbe3030] - build: fix bad upstream merge (Stephen Gallagher) #​44642
• [1e0dcd1ee0] - cli: add --watch (Moshe Atlow) #​44366
• [96d131665e] - cluster: use inspector utils (Moshe Atlow) #​44592
• [704836033a] - crypto: update root certificates (Luigi Pinca) #​45490
• [5a776d4a69] - deps: update timezone to 2022f (Richard Lau) #​45613
• [3b2b70d792] - deps: upgrade npm to 8.19.3 (npm team) #​45322
• [9fbc8b21db] - deps: update corepack to 0.15.1 (Node.js GitHub Bot) #​45331
• [87e3d002ca] - deps: update corepack to 0.15.0 (Node.js GitHub Bot) #​45235
• [e972ff7b13] - deps: V8: backport bbd800c (Chengzhong Wu) #​44947
• [af9d8217c0] - deps: V8: cherry-pick b953542 (Chengzhong Wu) #​44947
• [38202d321b] - deps: update undici to 5.12.0 (Node.js GitHub Bot) #​45236
• [7c0da6adf9] - deps: update archs files for OpenSSL-1.1.1s (RafaelGSS) #​45274
• [1149ead6f7] - deps: upgrade openssl sources to OpenSSL_1_1_1s (RafaelGSS) #​45274
• [cd54bce4f5] - deps: update timezone (Node.js GitHub Bot) #​44950
• [2901abe4f0] - deps: update undici to 5.11.0 (Node.js GitHub Bot) #​44929
• [c80cf97033] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #​44775
• [33707dcd03] - dgram: add dgram send queue info (theanarkh) #​44149
• [c708d9bb94] - doc: fix typo in parseArgs default value (Tobias Nießen) #​45083
• [5a0efa05d2] - node-api: handle no support for external buffers (Michael Dawson) #​45181
• [db31de634e] - readline: refactor to avoid unsafe regex primordials (Antoine du Hamel) #​43475
• [fbc52e5729] - src: disambiguate terms used to refer to builtins and addons (Joyee Cheung) #​44135
• [953072d3db] - src: let http2 streams end after session close (Santiago Gimeno) #​45153
• [54608d8dc3] - src: split property helpers from node::Environment (Chengzhong Wu) #​44056
• [6733556783] - test: add test to validate changelogs for releases (Richard Lau) #​45325
• [821d832cef] - test: mark test-watch-mode* as flaky on all platforms (Pierrick Bouvier) #​45049
• [02a18eac69] - test: fix test-runner-inspect (Moshe Atlow) #​44620
• [197df63f74] - test: add a test to ensure the correctness of timezone upgrades (Darshan Sen) #​45299
• [42e9d8016a] - test: fix textdecoder test for small-icu builds (Richard Lau) #​45225
• [6d736a56d8] - test: fix watch mode test flake (Moshe Atlow) #​44739
• [543d3d2bf3] - test: deflake watch mode tests (Moshe Atlow) #​44621
• [97f6caf4eb] - test: split watch mode inspector tests to sequential (Moshe Atlow) #​44551
• [499750ff7a] - test: update list of known globals (Antoine du Hamel) #​45255
• [64d343af74] - test_runner: support using --inspect with --test (Moshe Atlow) #​44520
• [99ee5e484d] - test_runner: fix duration_ms to be milliseconds (Moshe Atlow) #​44450
• [37e909251c] - test_runner: support programmatically running --test (Moshe Atlow) #​44241
• [0ae5694f88] - tools: update certdata.txt (Luigi Pinca) #​45490
• [891368cefd] - tools: remove faulty early termination logic from update-timezone.mjs (Darshan Sen) #​44870
• [543493c242] - tools: fix timezone update tool (Darshan Sen) #​44870
• [c77f660b75] - tools: fix create-or-update-pull-request-action hash on GHA (Antoine du Hamel) #​45166
• [58c30dd049] - tools: update gr2m/create-or-update-pull-request-action (Luigi Pinca) #​45022
• [749a4b3e5e] - tools: use Python 3.11 in GitHub Actions workflows (Luigi Pinca) #​45191
• [6f541d99a5] - tools: have test-asan use ubuntu-20.04 (Filip Skokan) #​45581
• [e7ed56f501] - tools: make license-builder.sh comply with shellcheck 0.8.0 (Rich Trott) #​41258
• [cc819b4bf8] - tools: fix typo in avoid-prototype-pollution lint rule (Antoine du Hamel) #​44446
• [254358c81e] - tools: refactor avoid-prototype-pollution lint rule (Antoine du Hamel) #​43476
• [8c73279ebb] - util: add default value option to parsearg (Manuel Spigolon) #​44631

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.