{"push_id":1002992969,"size":1,"distinct_size":1,"ref":"refs/heads/v5.7.1-proposal","head":"079748e7983b7e5cb5567087bb0e66b6d78808d7","before":"db164cc9d369063c32e9ea5ed2875fce14d5a906","commits":[{"sha":"079748e7983b7e5cb5567087bb0e66b6d78808d7","author":{"email":"f1782d15e31ad502ea2c097c21cc235811d0cb7c@rocketmail.com","name":"Jeremiah Senkpiel"},"message":"2016-03-02, Version 5.7.1 (Stable)\n\nNotable changes:\n\n* governance: The Core Technical Committee (CTC) added four new members\nto help guide Node.js core development: Evan Lucas, Rich Trott, Ali\nIjaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda).\n\n* openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis)\nhttps://github.com/nodejs/node/pull/5507\n  - Fix a double-free defect in parsing malformed DSA keys that may\npotentially be used for DoS or memory corruption attacks. It is likely\nto be very difficult to use this defect for a practical attack and is\ntherefore considered low severity for Node.js users. More info is\navailable at https://www.openssl.org/news/vulnerabilities.html#2016-0705\n  - Fix a defect that can cause memory corruption in certain very rare\ncases relating to the internal `BN_hex2bn()` and `BN_dec2bn()`\nfunctions. It is believed that Node.js is not invoking the code paths\nthat use these functions so practical attacks via Node.js using this\ndefect are _unlikely_ to be possible. More info is available at\nhttps://www.openssl.org/news/vulnerabilities.html#2016-0797\n  - Fix a defect that makes the CacheBleed Attack\n(https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This\ndefect enables attackers to execute side-channel attacks leading to the\npotential recovery of entire RSA private keys. It only affects the\nIntel Sandy Bridge (and possibly older) microarchitecture when using\nhyper-threading. Newer microarchitectures, including Haswell, are\nunaffected. More info is available at\nhttps://www.openssl.org/news/vulnerabilities.html#2016-0702\n\n* Fixed several regressions that appeared in v5.7.0:\n  - path.relative():\n    - Output is no longer unnecessarily verbose (Brian White)\nhttps://github.com/nodejs/node/pull/5389\n    - Resolving UNC paths on Windows now works correctly (Owen Smith)\nhttps://github.com/nodejs/node/pull/5456\n    - Resolving paths with prefixes now works correctly from the root\ndirectory (Owen Smith) https://github.com/nodejs/node/pull/5490\n  - url: Fixed an off-by-one error with `parse()` (Brian White)\nhttps://github.com/nodejs/node/pull/5394\n  - dgram: Now correctly handles a default address case when offset and\nlength are specified (Matteo Collina)\nhttps://github.com/nodejs/node/pull/5407\n\nPR-URL: https://github.com/nodejs/node/pull/5464","distinct":true,"url":"https://api.github.com/repos/nodejs/node/commits/079748e7983b7e5cb5567087bb0e66b6d78808d7"}]}