chore(deps): update dependencies-non-major (patch)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
node (source)		patch	20.11.0 -> 20.11.1
pnpm (source)	uses-with	patch	8.10.2 -> 8.10.5
pnpm/action-setup	action	patch	v2.4.0 -> v2.4.1

---

Release Notes

nodejs/node (node)

v20.11.1: 2024-02-14, Version 20.11.1 'Iron' (LTS), @​RafaelGSS prepared by @​marco-ippolito

Compare Source

Notable changes

This is a security release.

Notable changes

• CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
• CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
• CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
• CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
• CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
• CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
• CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
• CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
• undici version 5.28.3
• libuv version 1.48.0
• OpenSSL version 3.0.13+quic1

Commits

• [7079c062bb] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
• [186a6e1ffb] - deps: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #​51737
• [686da19abb] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#529
• [f7b44bfbce] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #​51614
• [7a30fecea2] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #​51614
• [480fc169a8] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#497
• [77ac7c3153] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#519
• [ed7d149675] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#516
• [89bd5fc38f] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#539
• [d01dd4291d] - permission: fix wildcard when children > 1 (Rafael Gonzaga) #​51209
• [40ff37dfcc] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
• [3f6addd590] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#529
• [d6da413aa4] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#517
• [c213910aea] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#541

pnpm/pnpm (pnpm)

v8.10.5

Compare Source

Patch Changes

• Don't fail on an empty pnpm-workspace.yaml file #​7307.

v8.10.4

Compare Source

Patch Changes

• Fixed out-of-memory exception that was happening on dependencies with many peer dependencies, when node-linker was set to hoisted #​6227.

v8.10.3

Compare Source

Patch Changes

• (Important) Increased the default amount of allowed concurrent network request on systems that have more than 16 CPUs #​7285.

• pnpm patch should reuse existing patch when shared-workspace-file=false #​7252.

• Don't retry fetching missing packages, since the retries will never work #​7276.

• When using pnpm store prune --force alien directories are removed from the store #​7272.

• Downgraded npm-packlist because the newer version significantly slows down the installation of local directory dependencies, making it unbearably slow.

  npm-packlist was upgraded in this PR to fix #​6997. We added our own file deduplication to fix the issue of duplicate file entries.

• Fixed a performance regression on running installation on a project with an up to date lockfile #​7297.

• Throw an error on invalid pnpm-workspace.yaml file #​7273.

pnpm/action-setup (pnpm/action-setup)

v2.4.1

Compare Source

Updated the bundled pnpm version to v7 to fix the ERR_INVALID_THIS error.

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.