‘Merge’ changes of 2.2.1 and 2.1.4

[jellelicht]

Dear maintainer,

Since the 2.2.1 and 2.1.4 releases both contain (unique) important security fixes, could there be one release that contains both? Perhaps call it 2.3.0, to get rid of potential confusion going forward.

Most importantly, it would be nice to have a ‘release’ of the llhttp used to generate the sources for Node 14.18.1, which (I believe) should be the combination of the earlier-mentioned releases. Perhaps some internal discussions can be had to streamline this, since going forward it seems there will always be {current,lts,maintenance} versions of Node that implicitly depend on a proper release of llhttp.

Thanks in advance

[jellelicht]

Polite ping, as this may leave some users of 2.2.1 and 2.1.4 vulnerable to fixed CVEs. In guix, we fixed this by doing exactly what I propose here: we apply e9b36ea6 to the 2.2.1 release, and this seems to work fine in practice (and the generated C sources pass the node test suite).

[jellelicht]

Alternatively, could someone with the right credentials please share an overview of which versions/commits of llhttp were used to generate the c-sources in the currently support Node releases?

[jellelicht]

Ping (polite though :sweat_smile: )

[ShogunPanda]

Released v2.3.0. Note that now all non 6.x and 2.1.x are not supported anymore.