microservices-demo
microservices-demo copied to clipboard
Published
20 hours ago •
GoogleCloudPlatform
GoogleCloudPlatform
chore(deps): update docker
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| eclipse-temurin | stage | digest | b87713d -> 9fcac9d |
| mcr.microsoft.com/dotnet/aspnet | final | digest | 1d6ca86 -> 789045e |
| mcr.microsoft.com/dotnet/runtime-deps | final | patch | 8.0.1-alpine3.18-amd64 -> 8.0.2-alpine3.18-amd64 |
| mcr.microsoft.com/dotnet/sdk | stage | digest | 8e77ad6 -> 4b684e6 |
| mcr.microsoft.com/dotnet/sdk | stage | patch | 8.0.101 -> 8.0.201 |
| node | final | patch | 20.11.0-alpine -> 20.11.1-alpine |
| python | final | digest | eb53cb9 -> 5c73034 |
Release Notes
nodejs/node (node)
v20.11.1: 2024-02-14, Version 20.11.1 'Iron' (LTS), @RafaelGSS prepared by @marco-ippolito
Notable changes
This is a security release.
Notable changes
- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
- CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
- undici version 5.28.3
- libuv version 1.48.0
- OpenSSL version 3.0.13+quic1
Commits
- [
7079c062bb] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525 - [
186a6e1ffb] - deps: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #51737 - [
686da19abb] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#529 - [
f7b44bfbce] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614 - [
7a30fecea2] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614 - [
480fc169a8] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#497 - [
77ac7c3153] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#519 - [
ed7d149675] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#516 - [
89bd5fc38f] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#539 - [
d01dd4291d] - permission: fix wildcard when children > 1 (Rafael Gonzaga) #51209 - [
40ff37dfcc] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505 - [
3f6addd590] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#529 - [
d6da413aa4] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#517 - [
c213910aea] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#541
Configuration
📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- [ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
