NW.js v0.31.2 Released with Both Chromium and Node.js Security Update
NW.js 0.31.2 is here with Node.js v10.4.1 and Chromium 67 security update, which fixed:
- High CVE-2018-6149: Out of bounds write in V8
- CVE-2018-7161: Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup
- CVE-2018-1000168: Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0
- CVE-2018-7162: Fixes Denial of Service vulnerability by updating the TLS implementation to not crash upon receiving
Chromium 67 contains usual under-the-hood performance and stability tweaks, but there are also some cool new features to explore. It supports WebXR Origin Trial, Generic Sensors and many more. Please check upstream information for details. For a complete list of all features (including experimental features) in this release, see the Chrome 67 milestone hotlist.
We've made the 0.31 branch ready soon after Chromium beta bumps to 67. Thanks to the testers for their valuable feedback and bug reports. We've been working on 2 branches simultaneously: a released branch on current Chromium stable and a beta branch on Chromium beta.
- Update Chromium to 67.0.3396.87
- Update Node.js to v10.4.1
- Fix: Window.open undefined reference with https (#6676)
- Fix: Geolocation not working in webview. (#6644)
Full ChangeLog: https://github.com/nwjs/nw.js/blob/nw31/CHANGELOG.md
Binary for other platforms: https://dl.nwjs.io/v0.31.2/
There are 2 builds for each platform - normal build, and SDK build. Normal build doesn't have devtools, only SDK build does. lt can be opened by pressing F12 (Cmd-Alt-I on OSX). SDK packages also have more development tools to be exposed in the following releases, as well as the NaCl support.
Our build infrastructure enables live binary build from git tip so you can access to the latest binary from https://dl.nwjs.io/live-build/
See our mailing list to discuss on this release: https://groups.google.com/d/msg/nwjs-general/Vmeo1PvuVT0/o_bV6EAtBgAJ