Node API runtime release notesRSS

Security patches

• CWE-1333

Fixes

• Removes write access to unnecessary paths
• Prevents Node Qualified paths from bypassing the deny/shim logic in the require wall.
• Removes access to the ‘module’ module

Fixes

• When running in K8 mode, unhealthy Runtimes now exit if they cannot reach SJM's 'Job' Endpoint.
• Upgrade base Ubuntu image.

Security patches

• CVE-2023-43646
• CVE-2023-28155

Security Patches

• CVE-2022-25883
• CVE-2023-26136

New Feature

• Customers will now see transaction traces and abuse header as part of requests initiated by $http

Fixes

• Fixed proxy authentication errors caused by special characters encoding in proxy url and password.

Security Patches

• CVE-2023-2968

Fixes

• Upgrades undici version to remediate CVE-2023-24807, CVE-2023-23936
• Upgrades http-cache-semantics version to remediate CVE-2022-25881

Fixes

• Users can now use $network.setProxy or $network.setProxyForHttp to set proxies for http endpoints

Improvements

• Allows users to set configurable timeouts for heavy monitors

No changes.