alt-nodejs18-nodejs (18.20.8-23) stable; urgency=medium

  * ALTNJS-295: derive the alt-nodejs18-npm package version from the bundled
    npm version and debian/changelog in debian/rules, so every Debian revision
    bump also changes the npm package version. Up to now it came only from
    debian/alt-nodejs18-npm.changelog, and the Debian rebuild in build
    6a8cac054c34bf1292240b1a re-shipped the npm package under its previous
    version with different contents.

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 05 Oct 2026 18:37:13 +0400

alt-nodejs18-nodejs (18.20.8-22) stable; urgency=medium

  * SECURITY UPDATE: https.Agent socket-pool names built from a `pfx` array of
    { buf, passphrase } objects collapse to the literal `[object Object]`, so
    requests configured with different mTLS client certificates share one pool
    entry and can reuse each other's authenticated socket or TLS session
    (CVE-2026-56850)
    - debian/patches/CVE-2026-56850.patch: add getPfxAgentKey() to
      lib/https.js and route the `pfx` leg of Agent.prototype.getName()
      through it, so an array-valued `pfx` contributes each entry's raw
      certificate buffer and its effective passphrase to the pool name; a
      non-array `pfx` keeps the name it had. Also adds the upstream
      regression tests test/parallel/test-https-agent-getname.js (new
      assertions) and test/parallel/test-https-agent-pfx-object-array-reuse.js
    - CVE-2026-56850

  * SECURITY UPDATE: dns.resolveAny() aborts the process when a DNS reply
    carries more than 256 A records, which a hostile or merely large
    authoritative answer can trigger repeatedly for a denial of service
    (CVE-2026-58042)
    - debian/patches/CVE-2026-58042.patch: in src/cares_wrap.cc, replace the
      fixed ares_addrttl[256] / ares_addr6ttl[256] TTL buffers with
      std::vectors sized from the reply's ANCOUNT via the new
      GetAnswerCountForTTLBuffer() and MakeAddrTTLBuffer() helpers, so
      naddrttls can no longer come back clamped below the record count and
      trip CHECK_EQ(naddrttls, a_count); also adds the regression test
      test/parallel/test-dns-resolveany-ttl-overflow.js
    - CVE-2026-58042

  * SECURITY UPDATE: the synchronous node:zlib entry points abort the process
    when handed a TypedArray whose byteLength is spoofed with a getter, which
    can be repeated for a denial of service (CVE-2026-58045)
    - debian/patches/CVE-2026-58045.patch: in src/node_zlib.cc, turn the two
      CHECK(Buffer::IsWithinBounds(...)) assertions in
      CompressionStream::Write() into THROW_ERR_OUT_OF_RANGE() so an
      out-of-bounds input or output buffer raises a catchable RangeError with
      code ERR_OUT_OF_RANGE instead of aborting; also adds the upstream
      regression assertions to test/parallel/test-zlib-invalid-input.js
    - CVE-2026-58045

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 18 Sep 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-21) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the
    maxSessionMemory limit
    - debian/patches/CVE-2026-56846.patch: charge retained HTTP/2 header memory
      against the session budget. Http2Session::HandleHeadersFrame() used to
      call DecrementCurrentSessionMemory(stream->current_headers_length_) the
      moment the decoded header block was handed up to JS, even though the JS
      objects built from it can stay alive for the whole lifetime of the
      stream, so a peer that opens many streams with large header blocks and
      never lets them complete (initialWindowSize 0, stalled responses) keeps
      unbounded header memory alive while current_session_memory_ reads as near
      zero, maxSessionMemory never trips and no stream is rejected with
      NGHTTP2_ENHANCE_YOUR_CALM. Http2Stream gains a second counter,
      retained_headers_length_; HandleHeadersFrame() moves
      current_headers_length_ into it instead of decrementing the session
      total, and Http2Session::RemoveStream() drains both counters before
      releasing the stream, so header blocks reachable from JS stay accounted
      for exactly as the maxSessionMemory option documents (no upstream
      Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from
      upstream f14d78b9e020, first in v22.23.2, whose v24.x sibling is
      34ed88a06939 and whose main-branch landing is b7fd13a59a; the doc/api
      wording hunks are dropped)
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 use-after-free when RST_STREAM for a refused stream
    re-enters nghttp2 from inside a receive callback
    - debian/patches/CVE-2026-56848.patch: defer the RST_STREAM purge while
      nghttp2 is in scope. Http2Stream::SubmitRstStream() force-purged pending
      session data through session_->SendPendingData() for every code except
      NGHTTP2_CANCEL, so a refused stream -- onSessionHeaders() answering a
      HEADERS frame for an unknown stream on an already-closed session with
      handle.rstStream(NGHTTP2_REFUSED_STREAM), reached from
      Http2Session::HandleHeadersFrame() inside OnFrameReceive() with
      nghttp2_session_mem_recv() still on the stack -- re-entered
      nghttp2_session_mem_send() inside the active receive operation, where the
      send path can close and free streams the receive is still using
      (heap-use-after-free; triggered remotely by HEADERS for fresh streams
      sent immediately after a GOAWAY with last_stream_id 0). SubmitRstStream()
      now treats NGHTTP2_REFUSED_STREAM while is_in_scope() like the existing
      cancel case: FlushRstStream() only, with the pending data written when
      the enclosing scope unwinds (no upstream Node.js 18 fix exists -- 18.x
      went EOL before disclosure; backported from upstream daa6d25e3dce, first
      in v22.23.2, whose v24.x and v26.x siblings are a77c7f7354c9 and
      23b94c843ae0; the cosmetic re-indent of the pre-existing
      AddPendingRstStream block is not carried)
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-20) stable; urgency=medium

  * resync the alt-nodejs18-npm changelog with the package revision: the npm
    changelog was left at 10.8.2-18.20.8.17 while debian/changelog had advanced
    to 18.20.8-19, so the npm binary package shipped a revision suffix that no
    longer matched the runtime it ships with. Both changelogs are bumped to
    revision 20 rather than only fast-forwarding the npm one, because an
    out-of-sync revision has already been released, so the npm version has to
    move forward on a revision that is still free
  * buildsys-pre-build: assert that the revision suffix in
    debian/alt-nodejs*-npm.changelog matches the debian/changelog version, not
    just that the npm upstream version matches deps/npm/package.json, so a
    forgotten npm changelog bump fails the build instead of silently shipping a
    stale npm revision

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 26 Aug 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-19) stable; urgency=medium

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:33:06 +0400

alt-nodejs18-nodejs (18.20.8-18) stable; urgency=medium

  * SECURITY UPDATE: HTTPS connection and TLS session reuse bypasses a
    per-request checkServerIdentity callback
    - debian/patches/CVE-2026-58040.patch: bind HTTPS identity checks to
      connection and session reuse. Follow-up to the incomplete fix for
      CVE-2026-48934, which bound TLS sessions to the authenticated host in
      lib/_tls_wrap.js but left lib/https.js without any notion of
      checkServerIdentity: https.Agent.getName() did not key on it, so requests
      differing only in their callback shared one socket pool bucket,
      createConnection() cached and replayed TLS sessions purely on
      options._agentKey, and there was no keepSocketAlive() override, so every
      socket was parked in freeSockets. Since lib/_tls_wrap.js only invokes
      options.checkServerIdentity() when the session is not reused, and a reused
      keep-alive socket performs no handshake at all, a request passing its own
      checkServerIdentity could be served over a connection whose identity had
      been accepted by a different callback. https.request() now tags such
      requests -- callback set, not the stock tls.checkServerIdentity and not
      inherited from the agent's own options -- with a unique per-request id
      under a new kPerRequestCheckServerIdentity symbol; getName() mixes the id
      into the agent key, createConnection() neither reads nor writes the
      session cache for tagged requests, and the new https.Agent
      keepSocketAlive() override destroys their sockets instead of parking them,
      so the per-request callback always sees a full handshake while
      agent-level checkServerIdentity keeps reuse unchanged (no upstream
      Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from
      upstream 51123159fe86, first in Node v22.23.2, whose main-branch sibling
      is 52a8ace880db)
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 13 Aug 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-17) stable; urgency=medium

  * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination
    in the bundled llhttp parser
    - debian/patches/CVE-2025-23167.patch: restore terminator validation in the
      loose (non-strict) state machine of the bundled llhttp 6.1.1, which Node
      compiles by default (LLHTTP_STRICT_MODE is never set): headers_almost_done,
      chunk_size_almost_done and the chunk_data_almost_done /
      chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after
      a CR instead of consuming any byte, and res_line_almost_done requires the LF
      after the response status line's CR, so a header block ending in "\r\n\rX"
      or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of
      silently swallowing the byte and parsing the bytes that follow as a second,
      smuggled request; each accept/reject edge was derived from the loose
      machine's own goto graph rather than by copying the strict machine's labels,
      which are not interchangeable between the two halves (no upstream Node.js 18
      fix exists — 18.x went EOL before disclosure, and upstream fixed this by
      replacing the parser wholesale with llhttp 9; approximated from llhttp
      6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2)
    - CVE-2025-23167

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-16) stable; urgency=medium

  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in http.Agent
    - debian/patches/CVE-2026-48931.patch: guard idle keep-alive sockets parked
      in the http.Agent freeSockets pool by swapping the handle's onread
      callback for freeSocketOnReadGuard (installFreeSocketDataGuard) and
      restoring it in reuseSocket, so unsolicited data arriving while the
      HTTPParser is detached destroys the socket instead of being consumed as
      the response to the next request that reuses it; includes the upstream
      follow-up that keeps the guard off the public stream to avoid the
      ERR_STREAM_PREMATURE_CLOSE keep-alive regression (no upstream Node.js 18
      fix exists — 18.x went EOL before disclosure; adapted from 0a22d40180,
      first in v22.23.0, plus eaa292549e, first in v22.23.1)
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 sessions never clean up after GOAWAY on invalid
    protocol errors
    - debian/patches/CVE-2026-48937.patch: detect in Http2Session::OnFrameSent
      a GOAWAY that nghttp2 queued internally via
      nghttp2_session_terminate_session() (frame-size, padding or HPACK
      errors, for which nghttp2 invokes no callback), record it in a new
      internal_goaway_sent_ flag and raise NGHTTP2_ERR_PROTO at the end of
      SendPendingData() so JS tears the session down once the GOAWAY has been
      written; Http2Session::Goaway() sets goaway_initiated_ so an
      application-requested GOAWAY is never mistaken for an internal one,
      stopping the server from indefinitely accepting data on a session it has
      already abandoned (no upstream Node.js 18 fix exists — 18.x went EOL
      before disclosure; adapted from a1a5bb9683, first in v22.23.0, minus the
      IsGracefulCloseInitiated() guard that does not exist in 18.x)
    - CVE-2026-48937

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-15) stable; urgency=medium

  * SECURITY UPDATE: Unicode dot separators defeat the TLS wildcard-depth check
    - debian/patches/CVE-2026-48618.patch: IDNA-normalize the hostname with
      domainToASCII() before splitting it into labels in
      tls.checkServerIdentity(), so the verifier counts the same labels the
      resolver does and a *.example.com certificate no longer matches
      foo。bar.example.com (U+3002/U+FF0E/U+FF61 fold to '.'); IP literals are
      still matched un-normalized so IPv6 IP-Address SANs keep working (no
      upstream Node.js 18 fix exists — 18.x went EOL before disclosure;
      adapted from 2197a47144, first in v22.23.0, plus follow-up 1d87a24050)
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching allows mTLS
    client-certificate authorization bypass
    - debian/patches/CVE-2026-48928.patch: build the SNI matching RegExp in
      tls.Server.prototype.addContext() with the 'i' flag, so an uppercase or
      mixed-case SNI hostname from the ClientHello selects its intended
      per-hostname SecureContext instead of silently falling back to the
      server's default context and bypassing per-tenant client-certificate
      policy, as required by RFC 6066 Section 3 (no upstream Node.js 18 fix
      exists — 18.x went EOL before disclosure; adapted from 39d1d09684,
      first in v22.23.0)
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via session reuse
    with a different servername
    - debian/patches/CVE-2026-48934.patch: bind client TLS sessions to the
      host they were authenticated for — wrap sessions handed to applications
      with a "\0nodejs:tls:session:1\0" + servername prefix in
      onnewsessionclient() and a new explicit TLSSocket.getSession(), and route
      setSession()/tls.connect({ session }) through getSessionForReuse(), which
      refuses a session recorded for a different servername and refuses raw
      unbound sessions on verified client connections, so a session obtained
      from one host can no longer be replayed against another with
      checkServerIdentity() skipped (no upstream Node.js 18 fix exists — 18.x
      went EOL before disclosure; adapted from fd890ba01d plus the regression
      tests from 1662a3ea09, first in v22.23.0)
    - CVE-2026-48934

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-14) stable; urgency=medium

  * SECURITY UPDATE: http2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the http2 client originSet
      size (default 128, configurable via the connect() maxOriginSetSize
      option) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once
      exceeded, so a malicious server can no longer grow originSet without
      bound (no upstream Node.js 18 fix exists — 18.x went EOL before
      disclosure; adapted from c79968e108, first in v22.23.0)
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes
      and reject hostnames/hosts containing an embedded NUL byte in
      dns.lookup(), dnsPromises.lookup() and net.connect()/createConnection(),
      preventing c-string truncation in the resolver bindings from resolving a
      different authority than the one validated (adapted from 7dafafa2, first
      in v22.23.0)
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto cipher output-length signed integer overflow
    - debian/patches/CVE-2026-48933.patch: guard the WebCrypto AES output
      length with TryGetIntCipherOutputLength so inputs near 2 GiB fail cleanly
      instead of overflowing the signed int buffer length and aborting the
      process (adapted from 98fbc89211, first in v22.23.0)
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-13) stable; urgency=medium

  * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in
    the internal string table, letting attacker-controlled JSON.parse input
    degrade performance in a local PoC against V8 10.2.154.26
    - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index
      value stored in a Name's hash_field via a 3-round xorshift-multiply
      with compile-time constants (no upstream Node.js 18 fix exists — 18.x
      went EOL before disclosure; this is an adapted reduced port, no
      rapidhash / HashSeed-view refactor)
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 26 May 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-12) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 14:00:00 +0200

alt-nodejs18-nodejs (18.20.8-11) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Wed, 20 May 2026 12:00:00 +0200

alt-nodejs18-nodejs (18.20.8-10) stable; urgency=medium

  * SECURITY UPDATE: Timing side-channel in Web Cryptography HMAC verification
    - debian/patches/CVE-2026-21713.patch: use CRYPTO_memcmp instead of memcmp
      in HMAC signature verification to prevent timing attacks
    - CVE-2026-21713

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 08:16:37 +0000

alt-nodejs18-nodejs (18.20.8-9) stable; urgency=medium

  * SECURITY UPDATE: HTTP server crash on __proto__ header
    - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and
      trailersDistinct destination maps with { __proto__: null } so a
      __proto__ request header no longer resolves to Object.prototype and
      cause an uncaught TypeError when req.headersDistinct or
      req.trailersDistinct is accessed
    - CVE-2026-21710

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:43:58 +0200

alt-nodejs18-nodejs (18.20.8-8) stable; urgency=medium

  * ALTNJS-243: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 19 Feb 2026 12:00:00 +0400

alt-nodejs18-nodejs (18.20.8-5) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that allowed JavaScript to control
      ArrayBuffer initialization via shared memory, preventing race condition
      that could expose uninitialized memory when using vm module with timeouts
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 12:00:00 +0000

alt-nodejs18-nodejs (18.20.8-4) stable; urgency=high

  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: wrap pskCallback and ALPNCallback
      invocations in try-catch blocks to route exceptions through error
      handlers
    - CVE-2026-21637
  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 05 Feb 2026 15:00:00 +0000

alt-nodejs18-nodejs (18.20.8-3) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 02 Feb 2026 09:00:00 +0100

alt-nodejs18-nodejs (18.20.8-2) stable; urgency=medium

  * Added support for CVE-2025-23166 for Debian 13

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Mon, 08 Dec 2025 16:30:00 +0000

alt-nodejs18-nodejs (18.20.8-1+tuxcare.els1) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2025-23166.patch: fix incorrect ThrowException() call
    in background thread to prevent process crash
    - CVE-2025-23166

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 12 Sep 2025 15:10:57 +0100

alt-nodejs18-nodejs (18.20.8-1) stable; urgency=medium

  * ALTNJS-207: update to 18.20.8

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 03 Jun 2025 14:09:00 +0100 

alt-nodejs18-nodejs (18.20.7-1) stable; urgency=medium

  * ALTNJS-205: update to 18.20.7

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 27 Feb 2025 16:45:00 +0100 

alt-nodejs18-nodejs (18.20.6-1) stable; urgency=medium

  * ALTNJS-202: update to 18.20.6

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 21 Jan 2025 19:30:00 +0100

alt-nodejs18-nodejs (18.20.5-1) stable; urgency=medium

  * ALTNJS-199: update to 18.20.5

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 09 Jan 2025 22:00:00 +0100
 
alt-nodejs18-nodejs (18.20.4-2) stable; urgency=medium

  * ALTNJS-193: Fixed npm changelog for the last update.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 24 Jul 2024 14:20:00 +0200

alt-nodejs18-nodejs (18.20.4-1) stable; urgency=medium

  * ALTNJS-191: Update to 18.20.4.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 15 Jul 2024 14:20:00 +0200

alt-nodejs18-nodejs (18.20.3-1) stable; urgency=medium

  * ALTNJS-187: update to 18.20.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 10 Jun 2024 22:00:00 +0200

alt-nodejs18-nodejs (18.20.2-1) stable; urgency=medium

  * ALTNJS-178: update to 18.20.2

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 12 Apr 2024 13:48:00 +0200

alt-nodejs18-nodejs (18.20.0-1) stable; urgency=medium

  * ALTNJS-174: Update to 18.20.0 version.

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 29 Mar 2024 15:00:00 +0100

alt-nodejs18-nodejs (18.19.1-1) stable; urgency=medium

  * ALTNJS-166: Update to 18.19.1 version.

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 26 Mar 2024 15:00:00 +0100

alt-nodejs18-nodejs (18.18.2-1) stable; urgency=medium

  * ALTNJS-158: Update to 18.18.2 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 31 Oct 2023 14:20:00 +0200

alt-nodejs18-nodejs (18.17.0-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
