See #11680

* CVE-2018-20685

- CVE-2020-10543
- CVE-2020-10878
- CVE-2020-12723

fixes #11658

fixes tpaste which no longer work without https

See #11626

See #11633

fixes #11627

the security upgrade depends on ABI breaking update of http-parser. Use
the bundled http-parser to avoid other breakage.

needed by nodejs security updates

ref #11607

(cherry picked from commit 96775809)

backport fix that adds newline to each cert in the bundle. The reason is
that trailing newline is no requirement so self generated certs may not
have it.

fixes #8379

(cherry picked from commit 86d72829)

(cherry picked from commit 975b6a39)

CVE-2019-9511, CVE-2019-9512, CVE-2019-9513, CVE-2019-9514,
CVE-2019-9515, CVE-2019-9516, CVE-2019-9517, CVE-2019-9518

Ref #10759

(cherry picked from commit 578c9733)

I used to maintaine nodejs.

(cherry picked from commit db17a03a)

(cherry picked from commit b407868d)

(cherry picked from commit bd257371)

(cherry picked from commit 4a95996f)

(cherry picked from commit 0a6b57fa)

See #11581

CVE-2020-10957, CVE-2020-10958, CVE-2020-10967,
CVE-2020-7046, CVE-2020-7957

Upgrade pigeonhole plugin to 0.5.10

ref #11557

See #11541

see #11559

fixes #11539

CVE-2020-2752
CVE-2020-2812
CVE-2020-2814
CVE-2020-2760

ref #11508

See #11509

ref #10890

ref #10794