FastStone Image Viewer 歷史版本列表
更新時間：2022-03-03
更新細節：
更新時間：2022-02-24
更新細節：
更新時間：2022-02-23
更新細節：
What's new in this version:
Notable Changes:
- doc: deprecate notice for process methods
- stream: revert map spec compliance
- build: remove broken x32 arch support
- (SEMVER-MINOR) esm: support https remotely and http locally under flag
- (SEMVER-MINOR) fs: support copy of relative links with cp and cpSync
- (SEMVER-MINOR) lib: add FormData global when fetch is enabled
- (SEMVER-MINOR) readline: bind keystroke ctrl+6 to redo
- process: deprecate multipleResolves Documentation-only
Dependency Updates:
- deps: upgrade npm to 8.5.1
- deps: update undici to 3e267ece5f
- deps: upgrade npm to 8.5.0
更新時間：2022-02-11
更新細節：
What's new in this version:
Add fetch API:
- Adds experimental support to the fetch API. This adds a --experimental-fetch flag that installs the fetch, Request, Reponse and Headers globals.
- (SEMVER-MINOR) lib: add fetch
Add stream methods:
- (SEMVER-MINOR) stream: add iterator helper find
- (SEMVER-MINOR) stream: add toArray
- (SEMVER-MINOR) stream: add forEach method
- (SEMVER-MINOR) stream: support some and every
Other Notable Changes:
- (SEMVER-MINOR) node-api: add node_api_symbol_for()
- module: unflag esm json modules
- deps: upgrade npm to 8.4.1
更新時間：2022-01-19
更新細節：
What's new in this version:
Changed:
- (SEMVER-MINOR) child_process: add support for URL to cp.fork
- (SEMVER-MINOR) crypto: alias webcrypto.subtle and webcrypto.getRandomValues on crypto
- doc: add Mesteery to collaborators
- (SEMVER-MINOR) events: graduate capturerejections to supported
- (SEMVER-MINOR) events: add EventEmitterAsyncResource to core
- (SEMVER-MINOR) loader: return package format from defaultResolve if known
- (SEMVER-MINOR) perf_hooks: multiple fixes for Histogram
- (SEMVER-MINOR) stream: add filter method to readable
- (SEMVER-MINOR) stream: add isReadable helper
- (SEMVER-MINOR) stream: add map method to Readable
更新時間：2022-01-11
更新細節：
What's new in this version:
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531):
- Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
- Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option
- More details will be available at CVE-2021-44531 after publication
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532):
- Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
- Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
- More details will be available at CVE-2021-44532 after publication
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533):
- Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
- Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
- More details will be available at CVE-2021-44533 after publication
Prototype pollution via console.table properties (Low)(CVE-2022-21824):
- Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype.
- Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to
- More details will be available at CVE-2022-21824 after publication
- Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability
更新時間：2021-12-18
更新細節：
What's new in this version:
- OpenSSL-3.0.1 contains a fix for CVE-2021-4044: Invalid handling of X509_verify_cert() internal errors in libssl (Moderate). This is a vulnerability in OpenSSL that may be exploited through Node.js
Other Notable Changes:
lib:
- make AbortSignal cloneable/transferable
deps:
- upgrade npm to 8.3.0
doc:
- add @bnb as a collaborator
process:
- add getActiveResourcesInfo()
timers:
- add experimental scheduler api
更新時間：2021-12-01
更新細節：
What's new in this version:
- (SEMVER-MINOR) async_hooks: expose async_wrap providers
- (SEMVER-MINOR) deps: update V8 to 9.6.180.14
- (SEMVER-MINOR) lib: add reason to AbortSignal
- (SEMVER-MINOR) src: add x509.fingerprint512 to crypto module
- stream: deprecate thenable support
- stream: fix finished regression when working with legacy Stream
更新時間：2021-11-10
更新細節：
What's new in this version:
Fixed:
- doc: add VoltrexMaster to collaborators
- (SEMVER-MINOR) esm: add support for JSON import assertion
- (SEMVER-MINOR) lib: add unsubscribe method to non-active DC channels
- (SEMVER-MINOR) lib: add return value for DC channel.unsubscribe
- (SEMVER-MINOR) v8: multi-tenant promise hook api
更新時間：2021-10-21
更新細節：
What's new in this version:
Fixed distribution for native addon builds:
- This release fixes an issue introduced in Node.js v17.0.0, where some V8 headers were missing from the distributed tarball, making it impossible to build native addons. These headers are now included.
Fixed stream issues:
- Fixed a regression in stream.promises.pipeline, which was introduced in version 16.10.0, is fixed. It is now possible again to pass an array of streams to the function.
- Fixed a bug in stream.Duplex.from, which didn't work properly when an async generator function was passed to it