alt-nodejs20-nodejs (20.20.2-10) stable; urgency=medium

  * SECURITY UPDATE: Permission Model allow-list radix tree grants an
    unlisted sibling path when three or more --allow-fs-read /
    --allow-fs-write entries share a common prefix
    - debian/patches/CVE-2026-58043.patch: in
      FSPermission::RadixTree::Node::CreateChild(), stop unconditionally
      marking an internal split node as an explicit leaf when a new,
      longer allow-list entry is inserted past it, so a node created only
      to branch to more specific sibling entries (e.g. secret1, secret2,
      secret3) no longer becomes an implicitly granted path of its own
      (e.g. secret)
    - CVE-2026-58043

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Tue, 08 Sep 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-9) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 header blocks handed to JS stop being charged
    against maxSessionMemory while they can still be kept alive, letting a
    remote peer exhaust memory with many stalled streams carrying large
    header blocks (CVE-2026-56846)
    - debian/patches/CVE-2026-56846.patch: add a second per-stream counter
      Http2Stream::retained_headers_length_ in src/node_http2.h, move
      current_headers_length_ into it in Http2Session::HandleHeadersFrame()
      instead of calling DecrementCurrentSessionMemory() there, and drain
      both counters from the session total in Http2Session::RemoveStream()
      so the header memory is un-charged only once the stream is gone;
      also adds the upstream regression test
      test/parallel/test-http2-max-session-memory-stalled-headers.js,
      adapted in two ways: the header block is built as an object with a
      multi-valued cookie field because Http2Session#request() rejects
      upstream's flat header array, and the server is created with
      maxHeaderListPairs raised to 4096 so AddHeader()'s pair-count
      branch cannot be what the test measures, leaving the
      session-memory branch as the only route
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 heap use-after-free when RST_STREAM is submitted
    for a refused stream from inside an nghttp2 receive callback, which
    re-enters nghttp2's send path and frees streams the active receive is
    still using (CVE-2026-56848)
    - debian/patches/CVE-2026-56848.patch: in
      Http2Stream::SubmitRstStream() (src/node_http2.cc), defer the reset
      when Http2Session::is_in_scope() and the code is
      NGHTTP2_REFUSED_STREAM by calling FlushRstStream() and returning,
      instead of falling through to the SendPendingData() force purge;
      also adds the upstream regression test
      test/parallel/test-http2-rst-stream-reentrancy.js
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-8) stable; urgency=medium

  * SECURITY UPDATE: HTTPS identity check not bound to connection or TLS
    session reuse (incomplete fix for CVE-2026-48934)
    - debian/patches/CVE-2026-58040.patch: tag request options in
      https.request() with a per-request kPerRequestCheckServerIdentity symbol
      when the caller supplies its own checkServerIdentity and the Agent was
      not constructed with one, key Agent.prototype.getName() on that tag,
      skip both the TLS session resume and the session caching listener in
      createConnection() for tagged requests, and add an
      Agent.prototype.keepSocketAlive() override in lib/https.js that refuses
      to park such a socket in freeSockets
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 27 Aug 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-7) stable; urgency=medium

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:39:40 +0400

alt-nodejs20-nodejs (20.20.2-6) stable; urgency=medium

  * SECURITY UPDATE: Permission Model bypass via process.report.writeReport()
    path misvalidation
    - debian/patches/CVE-2026-48617.patch: gate writeReport() in
      lib/internal/process/report.js on permission.has('fs.write', ...) for
      the supplied file or the current working directory, throwing
      ERR_ACCESS_DENIED instead of writing a diagnostic report outside the
      --allow-fs-write allow-list
    - CVE-2026-48617
  * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes() in the
    promises API
    - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from
      futimes() in lib/internal/fs/promises.js when the Permission Model is
      enabled, so file timestamps can no longer be modified through a
      read-only FileHandle
    - CVE-2026-48935

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 14:00:00 +0000

alt-nodejs20-nodejs (20.20.2-5) stable; urgency=medium

  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in
    http.Agent
    - debian/patches/CVE-2026-48931.patch: install a libuv handle-level read
      guard (installFreeSocketDataGuard / freeSocketOnReadGuard) on sockets
      parked in the freeSockets pool in lib/_http_agent.js and remove it in
      Agent.prototype.reuseSocket(), destroying any idle pooled socket that
      receives unsolicited data
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 sessions never clean up after an internal GOAWAY
    - debian/patches/CVE-2026-48937.patch: detect an nghttp2-initiated GOAWAY
      in Http2Session::OnFrameSent() and raise NGHTTP2_ERR_PROTO at the end of
      Http2Session::SendPendingData() in src/node_http2.cc, with the new
      goaway_initiated_ / internal_goaway_sent_ flags in src/node_http2.h, so
      the session is destroyed instead of accepting data after a protocol
      error
    - CVE-2026-48937

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 13:00:00 +0000

alt-nodejs20-nodejs (20.20.2-4) stable; urgency=medium

  * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode
    dot separators
    - debian/patches/CVE-2026-48618.patch: normalize the hostname with
      domainToASCII() in lib/tls.js and feed the IDNA-normalized name to
      splitHost() in checkServerIdentity(), while still matching IP
      literals against the original hostname
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching allows mTLS
    authorization bypass
    - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the
      servername RegExp built by Server.prototype.addContext() in
      lib/_tls_wrap.js
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via session
    reuse with a different servername
    - debian/patches/CVE-2026-48934.patch: bind client sessions to the
      authenticated host in lib/_tls_wrap.js (wrapSessionState /
      getSessionForReuse) and refuse to resume unbound or mismatched
      sessions
    - CVE-2026-48934

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-3) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the client-side originSet
      (maxOriginSetSize, default 128) in lib/internal/http2/core.js and
      destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes
      in lib/internal/validators.js and reject embedded-NUL hostnames in
      lib/dns.js, lib/internal/dns/promises.js and lib/net.js
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto cipher output-length integer overflow
    - debian/patches/CVE-2026-48933.patch: add TryGetIntCipherOutputLength
      in src/crypto/crypto_cipher.h and guard the AES_Cipher output length
      in src/crypto/crypto_aes.cc against signed int overflow
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 00:00:00 +0000

alt-nodejs20-nodejs (20.20.2-2) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 15:00:00 +0200

alt-nodejs20-nodejs (20.20.2-1) stable; urgency=medium

  * ALTNJS-253: Update to 20.20.2 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 24 Mar 2026 20:26:04 -0400

alt-nodejs20-nodejs (20.20.0-5) stable; urgency=medium

  * ALTNJS-254: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 25 Mar 2026 12:00:00 +0400

alt-nodejs20-nodejs (20.20.0-1) stable; urgency=medium

  * ALTNJS-236: update to 20.20.0

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Fri, 16 Jan 2026 14:00:00 +0400

alt-nodejs20-nodejs (20.19.4-2) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs20-nodejs (20.19.4-1) stable; urgency=medium

  * ALTNJS-218: update to 20.19.4

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 26 Aug 2025 23:00:00 +0400

alt-nodejs20-nodejs (20.19.3-1) stable; urgency=medium

  * ALTNJS-212: update to 20.19.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 07 Jul 2025 13:35:00 +0200  

alt-nodejs20-nodejs (20.19.2-1) stable; urgency=medium

  * ALTNJS-206: update to 20.19.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 02 Jun 2025 16:45:00 +0100  

alt-nodejs20-nodejs (20.18.3-1) stable; urgency=medium

  * ALTNJS-203: update to 20.18.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 27 Feb 2025 16:45:00 +0100  

alt-nodejs20-nodejs (20.18.2-1) stable; urgency=medium

  * ALTNJS-201: update to 20.18.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 21 Jan 2025 19:30:00 +0100  

alt-nodejs20-nodejs (20.18.1-1) stable; urgency=medium

  * ALTNJS-197: Update to 20.18.1 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 08 Jan 2025 16:00:00 +0100

alt-nodejs20-nodejs (20.17.0-1) stable; urgency=medium

  * ALTNJS-195: Update to 20.17.0 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 12 Sep 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.16.0-1) stable; urgency=medium

  * ALTNJS-194: Update to 20.16.0 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 12 Aug 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.15.1-2) stable; urgency=medium

  * ALTNJS-193: Fixed npm changelog for the last update.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 24 Jul 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.15.1-1) stable; urgency=medium

  * ALTNJS-190: Update to 20.15.1 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 12 Jul 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.14.0-1) stable; urgency=medium

  * ALTNJS-188: Update to 20.14.0 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 11 Jun 2024 15:00:00 +0200

alt-nodejs20-nodejs (20.12.2-1) stable; urgency=medium

  * ALTNJS-177: Update to 20.12.2 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 12 Apr 2024 12:25:00 +0200

alt-nodejs20-nodejs (20.12.0-1) stable; urgency=medium

  * ALTNJS-171: Update to 20.12.0 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 27 Mar 2024 15:00:00 +0100

alt-nodejs20-nodejs (20.10.0-1) stable; urgency=medium

  * ALTNJS-164: Update to 20.10.0 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 29 Nov 2023 14:20:00 +0200

alt-nodejs20-nodejs (20.9.0-1) stable; urgency=medium

  * ALTNJS-161: Update to 20.9.0 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 30 Oct 2023 14:20:00 +0200

alt-nodejs20-nodejs (20.6.1-1) stable; urgency=medium

  * Update to 20.6.1 version

 -- Release Scout <release-scout@cloudlinux.com>  Fri, 08 Sep 2023 18:23:15 +0000

alt-nodejs20-nodejs (20.6.0-1) stable; urgency=medium

  * Update to 20.6.0 version

 -- Release Scout <release-scout@cloudlinux.com>  Tue, 05 Sep 2023 07:29:09 +0000

alt-nodejs20-nodejs (20.5.0-1) stable; urgency=medium

  * Updated to 20.5.0

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 2 Aug 2023 15:00:00 +0200

alt-nodejs20-nodejs (20.4.0-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
