Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[pull] main from nodejs:main #302

Merged
merged 4 commits into from
Nov 6, 2023
Merged

[pull] main from nodejs:main #302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bf9dd75
fix: render openssf badge by parsing as mdx (#6093)
bmuenzenmeyer Nov 5, 2023
622c205
meta: correct attribution in v20.6.0 release notes (#6095)
JakobJingleheimer Nov 5, 2023
bfbcfc4
fix: lighthouse only run on the right label attribution
ovflowd Nov 6, 2023
10fb878
blog: update CVE-2023-45143 severity score (#6096)
RafaelGSS Nov 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/lighthouse.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,9 @@ permissions:
jobs:
lighthouse-ci:
# We want to skip our lighthouse analysis on Dependabot PRs
if: startsWith(github.event.pull_request.head.ref, 'dependabot/') == false
if: |
startsWith(github.event.pull_request.head.ref, 'dependabot/') == false &&
github.event.label.name == 'github_actions:pull-request'

name: Lighthouse Report
runs-on: ubuntu-latest
Expand Down
10 changes: 9 additions & 1 deletion pages/en/about/security-reporting.md → pages/en/about/security-reporting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,14 @@

## OpenSSF Best Practices

<a href="https://bestpractices.coreinfrastructure.org/projects/29" style="display: inline-flex;"><img src="https://bestpractices.coreinfrastructure.org/projects/29/badge" style="display: inline;"></a>
<a
href="https://bestpractices.coreinfrastructure.org/projects/29"
style={{ display: 'inline-flex' }}
>
<img

Check warning on line 82 in pages/en/about/security-reporting.mdx

View workflow job for this annotation

GitHub Actions / Lint 

Using `<img>` could result in slower LCP and higher bandwidth. Consider using `<Image />` from `next/image` to automatically optimize images. This may incur additional usage or cost from your provider. See: https://nextjs.org/docs/messages/no-img-element

Check warning on line 82 in pages/en/about/security-reporting.mdx

View workflow job for this annotation

GitHub Actions / Lint 

img elements must have an alt prop, either with meaningful text, or an empty string for decorative images
src="https://bestpractices.coreinfrastructure.org/projects/29/badge"
style={{ display: 'inline' }}
/>
</a>

The Open Source Security Foundation (OpenSSF) [Best Practices badge](https://github.com/coreinfrastructure/best-practices-badge) is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow best practices. Projects can voluntarily self-certify how they follow each best practice. Consumers of the badge can quickly assess which FLOSS projects are following best practices and as a result are more likely to produce higher-quality secure software.
2 changes: 1 addition & 1 deletion pages/en/blog/release/v20.6.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ node --import ./file-that-calls-register.js ./app.js

Using `--import` ensures that the customization hooks are registered before any application code runs, even the entry point.

This feature was contributed by Izaak Schroeder in <https://github.com/nodejs/node/pull/48842> and <https://github.com/nodejs/node/pull/48559>
This feature was contributed by João Lenon and Jacob Smith in <https://github.com/nodejs/node/pull/46826>, Izaak Schroeder and Jacob Smith in <https://github.com/nodejs/node/pull/48842> and <https://github.com/nodejs/node/pull/48559>

#### Module customization `load` hook can now support CommonJS

Expand Down
2 changes: 1 addition & 1 deletion pages/en/blog/vulnerability/october-2023-security-releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ author: Rafael Gonzaga
Updates are now available for the v18.x and v20.x Node.js release lines for the
following issues.

## undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (High) - (CVE-2023-45143)
## undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143)

Undici did not always clear Cookie headers on cross-origin redirects. By design, cookie headers are [forbidden request headers](https://fetch.spec.whatwg.org/#forbidden-request-header), disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch.

Expand Down
Loading