Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update node.js to v18 #4422

Merged
merged 1 commit into from
Nov 20, 2022
Merged

chore(deps): update node.js to v18 #4422

merged 1 commit into from
Nov 20, 2022

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 31, 2022

Mend Renovate

This PR contains the following updates:

Package Type Update Change
node major 16.18.1 -> 18.12.1
node engines major 16.18.1 -> 18.12.1

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.


Release Notes

nodejs/node

v18.12.1: 2022-11-04, Version 18.12.1 'Hydrogen' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable changes

The following CVEs are fixed in this release:

  • CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
  • CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
  • CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.

Commits

v18.12.0: 2022-10-25, Version 18.12.0 'Hydrogen' (LTS), @​ruyadorno and @​RafaelGSS

Compare Source

Notable Changes

This release marks the transition of Node.js 18.x into Long Term Support (LTS)
with the codename 'Hydrogen'. The 18.x release line now moves into "Active LTS"
and will remain so until October 2023. After that time, it will move into
"Maintenance" until end of life in April 2025.

v18.11.0: 2022-10-13, Version 18.11.0 (Current), @​danielleadams

Compare Source

Notable changes
watch mode (experimental)

Running in 'watch' mode using node --watch restarts the process when an imported file is changed.

Contributed by Moshe Atlow in #​44366

Other notable changes
  • fs:
    • (SEMVER-MINOR) add FileHandle.prototype.readLines (Antoine du Hamel) #​42590
  • http:
    • (SEMVER-MINOR) add writeEarlyHints function to ServerResponse (Wing) #​44180
  • http2:
    • (SEMVER-MINOR) make early hints generic (Yagiz Nizipli) #​44820
  • lib:
    • (SEMVER-MINOR) refactor transferable AbortSignal (flakey5) #​44048
  • src:
    • (SEMVER-MINOR) add detailed embedder process initialization API (Anna Henningsen) #​44121
  • util:
    • (SEMVER-MINOR) add default value option to parsearg (Manuel Spigolon) #​44631
Commits

v18.10.0: 2022-09-28, Version 18.10.0 (Current), @​RafaelGSS

Compare Source

Notable changes
  • doc:
    • (SEMVER-MINOR) deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #​44588
    • add legendecas to TSC list (Michael Dawson) #​44662
    • move policy docs to the permissions scope (Rafael Gonzaga) #​44222
  • gyp:
    • libnode for ios app embedding (chexiongsheng) #​44210
  • http:
    • (SEMVER-MINOR) throw error on content-length mismatch (sidwebworks) #​44588
  • stream:
    • (SEMVER-MINOR) add ReadableByteStream.tee() (Daeyeon Jeong) #​44505
Commits

v18.9.1: 2022-09-23, Version 18.9.1 (Current), @​RafaelGSS

Compare Source

This is a security release.

Notable changes

The following CVEs are fixed in this release:

  • CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
    • Insufficient fix for macOS devices on v18.5.0
  • CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
  • CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
    • Insufficient fix on v18.5.0
  • CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
    • Insufficient fix on v18.5.0
  • CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
  • CVE-2022-35255: Weak randomness in WebCrypto keygen

More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.

llhttp updated to 6.0.10

llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities.

  • HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
  • HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
  • HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
Commits

v18.9.0: 2022-09-08, Version 18.9.0 (Current), @​RafaelGSS

Compare Source

Notable changes
  • doc
    • add daeyeon to collaborators (Daeyeon Jeong) #​44355
  • lib
    • (SEMVER-MINOR) add diagnostics channel for process and worker (theanarkh) #​44045
  • os
    • (SEMVER-MINOR) add machine method (theanarkh) #​44416
  • report
    • (SEMVER-MINOR) expose report public native apis (Chengzhong Wu) #​44255
  • src
    • (SEMVER-MINOR) expose environment RequestInterrupt api (Chengzhong Wu) #​44362
  • vm
    • include vm context in the embedded snapshot (Joyee Cheung) #​44252
Commits

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 389c787 to 6f52e7d Compare November 9, 2022 23:50
@edalex-ian
Copy link
Member

edalex-ian commented Nov 11, 2022

Two jobs fail here:

  • build_storybook: Relies on some crypto which seems to have changed in 18 (see error digital envelope routines::unsupported) and so it seems the advice is that we need to set the environment variable of NODE_OPTIONS=--openssl-legacy-provider. That doesn't seem like a great situation. ☹️
  • rest-module-testing: This seems to be due to node 18 now preferring IPv6 as can be seen with all the connect ECONNREFUSED ::1:8080. Maybe rather than using localhost we'll need to use 127.0.0.1

@PenghaiZhang
Copy link
Contributor

I will give a try.

@PenghaiZhang
Copy link
Contributor

For the storybook issue, the best fix is definitely upgrading to v7. However, before v7 is formally released, there are two workaround.

  1. Setting NODE_OPTIONS=--openssl-legacy-provider
  2. Add @storybook/builder-webpack5 to dev dependencies and update storybook configuration to build with webpack 5.

I tried the second one, it fixed the original issue but create a new one related to webpack 5.

Error: NormalModuleFactory.beforeResolve (IgnorePlugin) is no longer a waterfall hook, but a bailing hook instead. Do not return the passed object, but modify it instead. Returning false will ignore the request and results in no module created.

@PenghaiZhang
Copy link
Contributor

For the rest module testing failure, if we are going to update to use 127.0.0.1, we will also need to change three things.

  • admin.url in mandatory.properties
  • The testing institution rest
    image
  • Testng code where localhost was expected to see.

@edalex-ian
Copy link
Member

Gah, it's never easy. Rather than that @PenghaiZhang I wonder if Node has an option like the JVM to prefer IPv4. Or otherwise, do we simply get oEQ to listen on IPv6 (as well as IPv4)?

@renovate renovate bot force-pushed the renovate/node-18.x branch from 6f52e7d to 1c03854 Compare November 17, 2022 02:58
@PenghaiZhang
Copy link
Contributor

The build passed !!!???

@renovate renovate bot force-pushed the renovate/node-18.x branch from 1c03854 to 6fbcb27 Compare November 17, 2022 06:10
@edalex-ian
Copy link
Member

Oh wow! It's all working @PenghaiZhang . I note webpack-cli v5 was merged, so perhaps that fixed storybook. Not sure why the just tests suddenly were happy. Perhaps they tweaked node.

Do you see any issue with merging this?

@PenghaiZhang
Copy link
Contributor

Oh wow! It's all working @PenghaiZhang . I note webpack-cli v5 was merged, so perhaps that fixed storybook. Not sure why the just tests suddenly were happy. Perhaps they tweaked node.

Do you see any issue with merging this?

No, I don't see any issue right now. I think it's good to go.

@edalex-ian
Copy link
Member

Alright, I'll drop it in and let's see how we go. (Later we may need to update NPM - I think Node 18 uses/bundles NPM 9 - but let's wait and see.)

@edalex-ian edalex-ian merged commit 0c6dd77 into develop Nov 20, 2022
@edalex-ian edalex-ian deleted the renovate/node-18.x branch November 20, 2022 22:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants