alt-nodejs20-nodejs (20.20.2-6) stable; urgency=medium

  * SECURITY UPDATE: Permission Model bypass via process.report.writeReport()
    path misvalidation
    - debian/patches/CVE-2026-48617.patch: gate writeReport() in
      lib/internal/process/report.js on permission.has('fs.write', ...) for
      the supplied file or the current working directory, throwing
      ERR_ACCESS_DENIED instead of writing a diagnostic report outside the
      --allow-fs-write allow-list
    - CVE-2026-48617
  * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes() in the
    promises API
    - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from
      futimes() in lib/internal/fs/promises.js when the Permission Model is
      enabled, so file timestamps can no longer be modified through a
      read-only FileHandle
    - CVE-2026-48935

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 14:00:00 +0000

alt-nodejs20-nodejs (20.20.2-5) stable; urgency=medium

  * SECURITY UPDATE: HTTP response queue poisoning via TOCTOU race in
    http.Agent
    - debian/patches/CVE-2026-48931.patch: install a libuv handle-level read
      guard (installFreeSocketDataGuard / freeSocketOnReadGuard) on sockets
      parked in the freeSockets pool in lib/_http_agent.js and remove it in
      Agent.prototype.reuseSocket(), destroying any idle pooled socket that
      receives unsolicited data
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 sessions never clean up after an internal GOAWAY
    - debian/patches/CVE-2026-48937.patch: detect an nghttp2-initiated GOAWAY
      in Http2Session::OnFrameSent() and raise NGHTTP2_ERR_PROTO at the end of
      Http2Session::SendPendingData() in src/node_http2.cc, with the new
      goaway_initiated_ / internal_goaway_sent_ flags in src/node_http2.h, so
      the session is destroyed instead of accepting data after a protocol
      error
    - CVE-2026-48937

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 13:00:00 +0000

alt-nodejs20-nodejs (20.20.2-4) stable; urgency=medium

  * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode
    dot separators
    - debian/patches/CVE-2026-48618.patch: normalize the hostname with
      domainToASCII() in lib/tls.js and feed the IDNA-normalized name to
      splitHost() in checkServerIdentity(), while still matching IP
      literals against the original hostname
    - CVE-2026-48618
  * SECURITY UPDATE: case-sensitive SNI context matching allows mTLS
    authorization bypass
    - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the
      servername RegExp built by Server.prototype.addContext() in
      lib/_tls_wrap.js
    - CVE-2026-48928
  * SECURITY UPDATE: TLS host identity verification bypass via session
    reuse with a different servername
    - debian/patches/CVE-2026-48934.patch: bind client sessions to the
      authenticated host in lib/_tls_wrap.js (wrapSessionState /
      getSessionForReuse) and refuse to resume unbound or mismatched
      sessions
    - CVE-2026-48934

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Wed, 29 Jul 2026 12:00:00 +0000

alt-nodejs20-nodejs (20.20.2-3) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth
    - debian/patches/CVE-2026-48619.patch: cap the client-side originSet
      (maxOriginSetSize, default 128) in lib/internal/http2/core.js and
      destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding
    - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes
      in lib/internal/validators.js and reject embedded-NUL hostnames in
      lib/dns.js, lib/internal/dns/promises.js and lib/net.js
    - CVE-2026-48930
  * SECURITY UPDATE: WebCrypto cipher output-length integer overflow
    - debian/patches/CVE-2026-48933.patch: add TryGetIntCipherOutputLength
      in src/crypto/crypto_cipher.h and guard the AES_Cipher output length
      in src/crypto/crypto_aes.cc against signed int overflow
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 00:00:00 +0000

alt-nodejs20-nodejs (20.20.2-2) stable; urgency=medium

  * SECURITY UPDATE: assertion failure in url.format() on malformed IDN
    - debian/patches/CVE-2026-21712.patch: return original href when
      ada::parse fails instead of CHECK(out) crash in BindingData::Format
    - CVE-2026-21712

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 19 May 2026 15:00:00 +0200

alt-nodejs20-nodejs (20.20.2-1) stable; urgency=medium

  * ALTNJS-253: Update to 20.20.2 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 24 Mar 2026 20:26:04 -0400

alt-nodejs20-nodejs (20.20.0-5) stable; urgency=medium

  * ALTNJS-254: Initial build for arm platforms

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 25 Mar 2026 12:00:00 +0400

alt-nodejs20-nodejs (20.20.0-1) stable; urgency=medium

  * ALTNJS-236: update to 20.20.0

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Fri, 16 Jan 2026 14:00:00 +0400

alt-nodejs20-nodejs (20.19.4-2) stable; urgency=medium

  * ALTNJS-220: Initial build for Debian 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 29 Sep 2025 14:20:00 +0200

alt-nodejs20-nodejs (20.19.4-1) stable; urgency=medium

  * ALTNJS-218: update to 20.19.4

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 26 Aug 2025 23:00:00 +0400

alt-nodejs20-nodejs (20.19.3-1) stable; urgency=medium

  * ALTNJS-212: update to 20.19.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 07 Jul 2025 13:35:00 +0200  

alt-nodejs20-nodejs (20.19.2-1) stable; urgency=medium

  * ALTNJS-206: update to 20.19.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 02 Jun 2025 16:45:00 +0100  

alt-nodejs20-nodejs (20.18.3-1) stable; urgency=medium

  * ALTNJS-203: update to 20.18.3

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 27 Feb 2025 16:45:00 +0100  

alt-nodejs20-nodejs (20.18.2-1) stable; urgency=medium

  * ALTNJS-201: update to 20.18.2

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 21 Jan 2025 19:30:00 +0100  

alt-nodejs20-nodejs (20.18.1-1) stable; urgency=medium

  * ALTNJS-197: Update to 20.18.1 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 08 Jan 2025 16:00:00 +0100

alt-nodejs20-nodejs (20.17.0-1) stable; urgency=medium

  * ALTNJS-195: Update to 20.17.0 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 12 Sep 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.16.0-1) stable; urgency=medium

  * ALTNJS-194: Update to 20.16.0 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 12 Aug 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.15.1-2) stable; urgency=medium

  * ALTNJS-193: Fixed npm changelog for the last update.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 24 Jul 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.15.1-1) stable; urgency=medium

  * ALTNJS-190: Update to 20.15.1 version.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 12 Jul 2024 14:20:00 +0200

alt-nodejs20-nodejs (20.14.0-1) stable; urgency=medium

  * ALTNJS-188: Update to 20.14.0 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 11 Jun 2024 15:00:00 +0200

alt-nodejs20-nodejs (20.12.2-1) stable; urgency=medium

  * ALTNJS-177: Update to 20.12.2 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 12 Apr 2024 12:25:00 +0200

alt-nodejs20-nodejs (20.12.0-1) stable; urgency=medium

  * ALTNJS-171: Update to 20.12.0 version

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 27 Mar 2024 15:00:00 +0100

alt-nodejs20-nodejs (20.10.0-1) stable; urgency=medium

  * ALTNJS-164: Update to 20.10.0 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 29 Nov 2023 14:20:00 +0200

alt-nodejs20-nodejs (20.9.0-1) stable; urgency=medium

  * ALTNJS-161: Update to 20.9.0 version

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 30 Oct 2023 14:20:00 +0200

alt-nodejs20-nodejs (20.6.1-1) stable; urgency=medium

  * Update to 20.6.1 version

 -- Release Scout <release-scout@cloudlinux.com>  Fri, 08 Sep 2023 18:23:15 +0000

alt-nodejs20-nodejs (20.6.0-1) stable; urgency=medium

  * Update to 20.6.0 version

 -- Release Scout <release-scout@cloudlinux.com>  Tue, 05 Sep 2023 07:29:09 +0000

alt-nodejs20-nodejs (20.5.0-1) stable; urgency=medium

  * Updated to 20.5.0

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 2 Aug 2023 15:00:00 +0200

alt-nodejs20-nodejs (20.4.0-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 25 Jul 2023 15:00:00 +0200
