{"push_id":1323387438,"size":15,"distinct_size":15,"ref":"refs/heads/v0.10-staging","head":"703a906acddc8c02bbb117be516822fdc2aa7183","before":"35b49ed4bb2f08a618867a3ddb8d25097e592494","commits":[{"sha":"bfd6cb569971edd80882f2f29a45027e24b66207","author":{"name":"Shigeki Ohtsu","email":"90c010657c386dfc9f6dc9a4a28ae33e58649405@ohtsu.org"},"message":"deps: upgrade openssl sources to 1.0.1u\n\nThis just replaces all sources of openssl-1.0.1u.tar.gz\ninto deps/openssl/openssl.\n\nPR-URL: https://github.com/nodejs/node/pull/8718\nReviewed-By: Fedor Indutny <fedor@indutny.com>\nReviewed-By: Myles Borins <mborins@us.ibm.com>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/bfd6cb569971edd80882f2f29a45027e24b66207"},{"sha":"884d50b3489d6c8cd206eeb380b225b263cc65d9","author":{"name":"Shigeki Ohtsu","email":"90c010657c386dfc9f6dc9a4a28ae33e58649405@ohtsu.org"},"message":"deps: copy all openssl header files to include dir\n\nAll symlink files in `deps/openssl/openssl/include/openssl/`\nare removed and replaced with real header files to avoid\nissues on Windows. Two files of opensslconf.h in crypto and\ninclude dir are replaced to refer config/opensslconf.h.\n\nPR-URL: https://github.com/nodejs/node/pull/8718\nReviewed-By: Fedor Indutny <fedor@indutny.com>\nReviewed-By: Myles Borins <mborins@us.ibm.com>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/884d50b3489d6c8cd206eeb380b225b263cc65d9"},{"sha":"68f88ea792b83a7f6c72ace8fcd3baa6ec1f4be3","author":{"name":"Shigeki Ohtsu","email":"90c010657c386dfc9f6dc9a4a28ae33e58649405@iij.ad.jp"},"message":"deps: separate sha256/sha512-x86_64.pl for openssl\n\nsha256-x86_64.pl does not exist in the origin openssl distribution. It\nwas copied from sha512-x86_64.pl and both sha256/sha512 scripts were\nmodified so as to generates only one asm file specified as its key\nhash length.\n\nPR: #9451\nPR-URL: https://github.com/joyent/node/pull/9451\nReviewed-By: Julien Gilli <julien.gilli@joyent.com>\n\nPR: #25523\nPR-URL: https://github.com/joyent/node/pull/25523\nReviewed-By: Julien Gilli <jgilli@fastmail.fm>\n\nPR: #25654\nPR-URL: https://github.com/joyent/node/pull/25654\nReviewed-By: Julien Gilli <jgilli@fastmail.fm>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/68f88ea792b83a7f6c72ace8fcd3baa6ec1f4be3"},{"sha":"c66408cd0ce2c993d2cacaf175992e2edd80502f","author":{"name":"Fedor Indutny","email":"12ff1b9004d711c7227c43e8182f8dcf3b93db07@gmail.com"},"message":"deps: fix openssl assembly error on ia32 win32\n\n`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and\nperhaps others) are requiring .686 .\n\nPR: #9451\nPR-URL: https://github.com/joyent/node/pull/9451\nReviewed-By: Julien Gilli <julien.gilli@joyent.com>\n\nPR: #25523\nPR-URL: https://github.com/joyent/node/pull/25523\nReviewed-By: Julien Gilli <jgilli@fastmail.fm>\n\nPR: #25654\nPR-URL: https://github.com/joyent/node/pull/25654\nReviewed-By: Julien Gilli <jgilli@fastmail.fm>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/c66408cd0ce2c993d2cacaf175992e2edd80502f"},{"sha":"1f4a6f5bd189a16c8cf451e3d73a8a06320a44ea","author":{"name":"Shigeki Ohtsu","email":"90c010657c386dfc9f6dc9a4a28ae33e58649405@iij.ad.jp"},"message":"openssl: fix keypress requirement in apps on win32\n\nreapply b910613792dac946b295855963869933a9089044\n\nPR: #9451\nPR-URL: https://github.com/joyent/node/pull/9451\nReviewed-By: Julien Gilli <julien.gilli@joyent.com>\n\nPR: #25523\nPR-URL: https://github.com/joyent/node/pull/25523\nReviewed-By: Julien Gilli <jgilli@fastmail.fm>\n\nPR: #25654\nPR-URL: https://github.com/joyent/node/pull/25654\nReviewed-By: Julien Gilli <jgilli@fastmail.fm>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/1f4a6f5bd189a16c8cf451e3d73a8a06320a44ea"},{"sha":"1cbdb1957d982641bb222413d64f4903da89dac9","author":{"name":"Shigeki Ohtsu","email":"90c010657c386dfc9f6dc9a4a28ae33e58649405@iij.ad.jp"},"message":"deps: add -no_rand_screen to openssl s_client\n\nIn openssl s_client on Windows, RAND_screen() is invoked to initialize\nrandom state but it takes several seconds in each connection.\nThis added -no_rand_screen to openssl s_client on Windows to skip\nRAND_screen() and gets a better performance in the unit test of\ntest-tls-server-verify.\nDo not enable this except to use in the unit test.\n\n(cherry picked from commit 9f0f7c38e6df975dd39735d0e9ef968076369c74)\n\nReviewed-By: James M Snell <jasnell@gmail.com>\nPR-URL: https://github.com/joyent/node/pull/25368","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/1cbdb1957d982641bb222413d64f4903da89dac9"},{"sha":"f2433430cab27144222b96096c64fe3757fe93d1","author":{"name":"Evan Lucas","email":"268eff19096fcf534496275f846170f9618f73a6@me.com"},"message":"http: disallow sending obviously invalid status codes\n\nBack port of\nhttps://github.com/nodejs/node/commit/7e9b0dd6949aaa6afda4da9f41e1d60d9b\nto v0.12\n\nPR-URL: https://github.com/nodejs/node-private/pull/48\nReviewed-By: Fedor Indutny <fedor.indutny@gmail.com>\nReviewed-By: Rod Vagg <rod@vagg.org>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/f2433430cab27144222b96096c64fe3757fe93d1"},{"sha":"3614a173d0a0827bb9f7a1aa65bf9ccc9c7d6784","author":{"name":"Evan Lucas","email":"268eff19096fcf534496275f846170f9618f73a6@me.com"},"message":"http: check reason chars in writeHead\n\nPreviously, the reason argument passed to ServerResponse#writeHead was\nnot being properly validated.  One could pass CRLFs which could lead to\nhttp response splitting. This commit changes the behavior to throw an\nerror in the event any invalid characters are included in the reason.\n\nCVE-2016-5325\n\nPR-URL: https://github.com/nodejs/node-private/pull/48\nReviewed-By: Fedor Indutny <fedor.indutny@gmail.com>\nReviewed-By: Rod Vagg <rod@vagg.org>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/3614a173d0a0827bb9f7a1aa65bf9ccc9c7d6784"},{"sha":"0d7e21ee7bcc79046f898f8c202d2ec87d23d711","author":{"name":"Ben Noordhuis","email":"616e881177e53541ea47e5917a60deb2554e079d@bnoordhuis.nl"},"message":"lib: make tls.checkServerIdentity() more strict\n\nIncorporates changes from commit e345253 (\"tls: better error reporting\nat cert validation\") to test/simple/test-tls-check-server-identity.js\nto make back-porting the patch easier.\n\nCVE-2016-7099\n\nPR-URL: https://github.com/nodejs/node-private/pull/62\nReviewed-By: Rod Vagg <rod@vagg.org>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/0d7e21ee7bcc79046f898f8c202d2ec87d23d711"},{"sha":"fd8ac56c75517dac0634275f4c5f8b4ed88f9dc1","author":{"name":"Ben Noordhuis","email":"616e881177e53541ea47e5917a60deb2554e079d@bnoordhuis.nl"},"message":"v8: fix build errors with g++ 6.1.1\n\nShifting a negative constant value is no longer allowed unless\nthe -fpermissive flag is in effect.  Fixes the following build\nerrors:\n\n\t\t../deps/v8/src/objects.h:5188:47: warning: left shift of negative value [-Wshift-negative-value]\n\t\t\t static const int kElementsKindMask = (-1 << kElementsKindShift) &\n\t\t../deps/v8/src/objects.h:5188:44: error: left operand of shift expression '(-1 << 3)' is negative [-fpermissive]\n\t\t\t static const int kElementsKindMask = (-1 << kElementsKindShift) &\n\t\t../deps/v8/src/objects.h:7376:39: warning: left shift of negative value [-Wshift-negative-value]\n\t\t\t\t\t (~kMaxCachedArrayIndexLength << kArrayIndexHashLengthShift) |\n\t\t../deps/v8/src/objects.h:7376:36: error: left operand of shift expression '(-8 << 26)' is negative [-fpermissive]\n\t\t\t\t\t (~kMaxCachedArrayIndexLength << kArrayIndexHashLengthShift) |\n\nAnd:\n\n\t\t../deps/v8/src/liveedit.cc:205:44: warning: left shift of negative value [-Wshift-negative-value]\n\t\t\t static const int kEmptyCellValue = -1 << kDirectionSizeBits;\n\t\t../deps/v8/src/liveedit.cc:205:41: error: left operand of shift expression '(-1 << 2)' is negative [-fpermissive]\n\t\t\t static const int kEmptyCellValue = -1 << kDirectionSizeBits;\n\nPR-URL: https://github.com/nodejs/node-private/pull/62\nReviewed-By: Rod Vagg <rod@vagg.org>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/fd8ac56c75517dac0634275f4c5f8b4ed88f9dc1"},{"sha":"88dcc7f5bb7388a9fb6e46597aca9894e9b3440f","author":{"name":"Ben Noordhuis","email":"616e881177e53541ea47e5917a60deb2554e079d@bnoordhuis.nl"},"message":"v8: fix -Wsign-compare warning in Zone::New()\n\nUse unsigned types for size calculations.  Fixes a warning that was\ndrowning out everything else because zone-inl.h is included in every\nsource file:\n\n\t\t../deps/v8/src/zone-inl.h: In member function 'void* v8::internal::Zone::New(int)':\n\t\t../deps/v8/src/zone-inl.h:61:32: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]\n\t\t\t if (limit < position || size > limit - position) {\n\nPR-URL: https://github.com/nodejs/node-private/pull/62\nReviewed-By: Rod Vagg <rod@vagg.org>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/88dcc7f5bb7388a9fb6e46597aca9894e9b3440f"},{"sha":"fc259c7dc489b82b166e58053fba86ed7707e0ae","author":{"name":"Сковорода Никита Андреевич","email":"ee703e0b9616fa9399fb931135678151090ca207@gmail.com"},"message":"buffer: zero-fill uninitialized bytes in .concat()\n\nThis makes sure that no uninitialized bytes are leaked when the specified\n`totalLength` input value is greater than the actual total length of the\nspecified buffers array, e.g. in Buffer.concat([Buffer.alloc(0)], 100).\n\nPR-URL: https://github.com/nodejs/node-private/pull/67\nReviewed-By: Anna Henningsen <anna@addaleax.net>\nReviewed-By: Rod Vagg <rod@vagg.org>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/fc259c7dc489b82b166e58053fba86ed7707e0ae"},{"sha":"03f4920d6a8b4ac1d990f7659f2815075c8c896b","author":{"name":"Rod Vagg","email":"b188db099f2f059a691751fd624f34546de70910@vagg.org"},"message":"crypto: don't build hardware engines\n\nCompile out hardware engines.\n\n`ENGINE_load_builtin_engines()` is not called in v0.10 so this does\nnot represent a known security vulnerability.\n\nBackport of\nhttps://github.com/nodejs/node-private/pull/58\n\nPR-URL: https://github.com/nodejs/node-private/pull/68\nReviewed-By: Fedor Indutny <fedor.indutny@gmail.com>\nReviewed-By: Ben Noordhuis <info@bnoordhuis.nl>","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/03f4920d6a8b4ac1d990f7659f2815075c8c896b"},{"sha":"848d650dade802c835b4b3a1e29c7581e79494ed","author":{"name":"Rod Vagg","email":"b188db099f2f059a691751fd624f34546de70910@vagg.org"},"message":"2016-09-27 Version 0.10.47 (Maintenance) Release\n\nThis is a security release. All Node.js users should consult the\nsecurity release summary at\nhttps://nodejs.org/en/blog/vulnerability/september-2016-security-releases/\nfor details on patched vulnerabilities.\n\nNotable changes:\n\n* buffer: Zero-fill excess bytes in new `Buffer` objects created with\n  `Buffer.concat()` while providing a `totalLength` parameter that\n  exceeds the total length of the original `Buffer` objects being\n  concatenated. (Сковорода Никита Андреевич)\n* http:\n  - CVE-2016-5325 - Properly validate for allowable characters in the\n    `reason` argument in `ServerResponse#writeHead()`. Fixes a\n    possible response splitting attack vector. This introduces a new\n    case where `throw` may occur when configuring HTTP responses,\n    users should already be adopting try/catch here. Originally\n    reported independently by Evan Lucas and Romain Gaucher.\n    (Evan Lucas)\n  - Invalid status codes can no longer be sent. Limited to 3 digit\n    numbers between 100 - 999. Lack of proper validation may also\n    serve as a potential response splitting attack vector. Backported\n    from v4.x. (Brian White)\n* openssl: Upgrade to 1.0.1u, fixes a number of defects impacting\n  Node.js: CVE-2016-6304 (\"OCSP Status Request extension unbounded\n  memory growth\", high severity), CVE-2016-2183, CVE-2016-6303,\n  CVE-2016-2178 and CVE-2016-6306.\n* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation\n  check whereby a TLS server may be able to serve an invalid wildcard\n  certificate for its hostname due to improper validation of `*.` in\n  the wildcard string. Originally reported by Alexander Minozhenko\n  and James Bunton (Atlassian). (Ben Noordhuis)\n\nPR-URL: https://github.com/nodejs/node-private/pull/71","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/848d650dade802c835b4b3a1e29c7581e79494ed"},{"sha":"703a906acddc8c02bbb117be516822fdc2aa7183","author":{"name":"Rod Vagg","email":"b188db099f2f059a691751fd624f34546de70910@vagg.org"},"message":"Working on v0.10.48","distinct":true,"url":"https://api.github.com/repos/janeasystems/node/commits/703a906acddc8c02bbb117be516822fdc2aa7183"}]}
{"actor":{"display_login":"joaocgreis"}}