aboutsummaryrefslogtreecommitdiff
path: root/lang/node
Commit message (Collapse)AuthorAge
* node: bump to v20.12.2Hirokazu MORIKAWA2024-04-24
| | | | | | | | | This is a security release. Notable Changes * CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: April 3, 2024 Security ReleasesHirokazu MORIKAWA2024-04-07
| | | | | | | | | | | | | This is a security release Notable Changes * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High) * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium) * llhttp version 9.2.1 * undici version 5.28.4 Changed to use gz according to main-snapshot Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: February 14 2024 Security ReleasesHirokazu MORIKAWA2024-02-16
| | | | | | | | | | | | | | | | | | | | Update to v20.11.1 This is a security release. Notable changes * CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) * CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) * CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High) * CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High) * CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) * CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) * CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) * CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) * undici version 5.28.3 * libuv version 1.48.0 * OpenSSL version 3.0.13+quic1 (Depends on shared library provided by OpenWrt) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v20.11.0Hirokazu MORIKAWA2024-01-13
| | | | | | | | | | | | | | | | | | | | | Notable Changes * crypto: update root certificates to NSS 3.95 (Node.js GitHub Bot) * doc: add MrJithil to collaborators (Jithil P Ponnan) * doc: add Ethan-Arrowood as a collaborator (Ethan Arrowood) * (SEMVER-MINOR) esm: add import.meta.dirname and import.meta.filename (James Sumners) * fs: add c++ fast path for writeFileSync utf8 (CanadaHonk) * (SEMVER-MINOR) module: remove useCustomLoadersIfPresent flag (Chengzhong Wu) * (SEMVER-MINOR) module: bootstrap module loaders in shadow realm (Chengzhong Wu) * (SEMVER-MINOR) src: add --disable-warning option (Ethan Arrowood) * [SEMVER-MINOR) src: create per isolate proxy env template (Chengzhong Wu) * (SEMVER-MINOR) src: make process binding data weak (Chengzhong Wu) * stream: use Array for Readable buffer (Robert Nagy) * stream: optimize creation (Robert Nagy) * (SEMVER-MINOR) test_runner: adds built in lcov reporter (Phil Nash) * (SEMVER-MINOR) test_runner: add Date to the supported mock APIs (Lucas Santos) * (SEMVER-MINOR) test_runner, cli: add --test-timeout flag (Shubham Pandey) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: upgrade to v20.10.0Hirokazu MORIKAWA2023-11-30
| | | | | | | | | | | Notable Changes * --experimental-default-type flag to flip module defaults * Detect ESM syntax in ambiguous JavaScript * New flush option in file system functions * Experimental WebSocket client * vm: fix V8 compilation cache support for vm.Script Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: upgrade to v20.9.0Hirokazu MORIKAWA2023-11-02
| | | | | | | | | node.js version 20.x is now active LTS. mipsel (pistachio) is no longer supported. Due to build difficulties, libuv shared libraries are not used. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: Friday October 13 2023 Security ReleasesHirokazu MORIKAWA2023-10-17
| | | | | | | | | | | | | This is a security release. Notable Changes The following CVEs are fixed in this release: * CVE-2023-44487: nghttp2 Security Release (High) (Depends on shared library provided by OpenWrt) * CVE-2023-45143: undici Security Release (High) * CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) * CVE-2023-39333: Code injection via WebAssembly export names (Low) More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v18.18.1Hirokazu MORIKAWA2023-10-14
| | | | | | | | | | | | Notable Changes This release addresses some regressions that appeared in Node.js 18.18.0: (Windows) FS can not handle certain characters in file name #48673 18 and 20 node images give error - Text file busy (after re-build images) nodejs/docker-node#1968 libuv update in 18.18.0 breaks webpack's thread-loader #49911 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v18.18.0Hirokazu MORIKAWA2023-09-21
| | | | | | Update to v18.18.0 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: August 2023 Security ReleasesHirokazu MORIKAWA2023-08-10
| | | | | | | | | | | | | | | | | Update to v18.17.1 This is a security release. Notable Changes The following CVEs are fixed in this release: * CVE-2023-32002: Policies can be bypassed via Module._load (High) * CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) * CVE-2023-32559: Policies can be bypassed via process.binding (Medium) * OpenSSL Security Releases (Depends on shared library provided by OpenWrt) * OpenSSL security advisory 14th July. * OpenSSL security advisory 19th July. * OpenSSL security advisory 31st July Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v18.17.0Hirokazu MORIKAWA2023-07-23
| | | | | | | | | | | Notable Changes: *Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. *Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: June 20 2023 Security ReleasesHirokazu MORIKAWA2023-06-21
| | | | | | | | | | | | | | | | | | | | | | Update to v18.16.1 The following CVEs are fixed in this release: * CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High) * CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) * CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) * CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) * CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) * OpenSSL Security Releases (Depends on shared library provided by OpenWrt) * OpenSSL security advisory 28th March. * OpenSSL security advisory 20th April. * OpenSSL security advisory 30th May * c-ares vulnerabilities: (Depends on shared library provided by OpenWrt) * GHSA-9g78-jv2r-p7vc * GHSA-8r8p-23f3-64c2 * GHSA-54xr-f67r-4pc4 * GHSA-x6mf-cxr9-8q6v Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v18.16.0Hirokazu MORIKAWA2023-04-14
| | | | | | | | | | | | Description: Update to v18.16.0 Fixed a bug when selecting arm-fpu for vfpv3-d16. Notable changes Add initial support for single executable applications Replace url parser with Ada Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* treewide: refactor to use PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-04-08
| | | | | | | See commit 5c545bdb "treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16" on the main repository. Signed-off-by: Andre Heider <a.heider@gmail.com>
* node: bump to v18.15.0Hirokazu MORIKAWA2023-03-21
| | | | | | | Update to v18.15.0 Fixed bug using system-icu Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v18.14.2Hirokazu MORIKAWA2023-02-27
| | | | | | | Update to v18.14.2 Support for OpenSSL v3.0.x Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.19.1Hirokazu MORIKAWA2023-02-17
| | | | | | | | | | | | | | | Thursday February 16 2023 Security Releases Notable Changes The following CVEs are fixed in this release: * CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) * CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium) * CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium) * CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low) * CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.19.0Hirokazu MORIKAWA2022-12-22
| | | | | | | | | Notable Changes *OpenSSL 1.1.1s *Root certificates updated to NSS 3.85 *Time zone update to 2022f Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.18.0Hirokazu MORIKAWA2022-10-23
| | | | | | Update to v16.18.0 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.17.1Hirokazu MORIKAWA2022-10-05
| | | | | | | | | | | | | | | | | | | | | | The following CVEs are fixed in this release: * CVE-2022-32212: DNS rebinding in --inspect on macOS (High) * Insufficient fix for macOS devices on v18.5.0 * CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) * CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) * CVE-2022-35255: Weak randomness in WebCrypto keygen More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. llhttp updated to 6.0.10 llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities. * HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS). Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.17.0Hirokazu MORIKAWA2022-08-23
| | | | | | | | | | | | | | | | Notable Changes: Experimental command-line argument parser API Experimental ESM Loader Hooks API Experimental test runner Improved interoperability of the Web Crypto API Dependency updates: Updated Corepack to 0.12.1 Updated ICU to 71.1 Updated npm to 8.15.0 Updated Undici to 5.8.0 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: July 7th 2022 Security ReleasesHirokazu MORIKAWA2022-07-10
| | | | | | | | | | | | | | | | Update to v16.16.0 Release for the following issues: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213) HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214) HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215) DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212) https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ No vulnerabilities related with openssl (uses system openssl) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.15.1Hirokazu MORIKAWA2022-06-09
| | | | | | | Upgrade npm to 8.11.0 Suppressed unnecessary builds. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v16.15.0Hirokazu MORIKAWA2022-05-31
| | | | | | | | Description: Update from v16.15.0 Changed handling of host's npm problems due to npm updates. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: Major update from v14 to v16Hirokazu MORIKAWA2022-04-16
| | | | | | | | This update also changes npm from v6 to v8. This change also requires node module packages to be modified. Each package will be updated later. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: January 10th 2022 Security ReleasesHirokazu MORIKAWA2022-01-24
| | | | | | | | | | | | Update to v14.18.3 January 10th 2022 Security Releases: Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) Prototype pollution via console.table properties (Low)(CVE-2022-21824) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to 14.18.2Hirokazu MORIKAWA2021-12-10
| | | | | | | Update to v14.18.2 Remove unneeded c-ares patches Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to 14.18.1 / October 12th 2021 Security ReleasesHirokazu MORIKAWA2021-10-14
| | | | | | | | October 12th 2021 Security Releases: HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959) HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to 14.17.4Hirokazu MORIKAWA2021-07-31
| | | | | | | | | | July 2021 Security Releases: Use after free on close http2 on stream canceling (High) (CVE-2021-22930) Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to 14.17.1Hirokazu MORIKAWA2021-06-18
| | | | | | | | Notable Changes: deps: update ICU to 69.1 (Michaël Zasso) errors: align source-map stacks with spec (Benjamin Coe) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: Reduce node-npm package sizeHirokazu MORIKAWA2021-05-28
| | | | | | Reduce package size by about 1MB. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v14.17.0Hirokazu MORIKAWA2021-05-13
| | | | | | | | | Notable Changes: Diagnostics channel (experimental module) UUID support in the crypto module Experimental support for AbortController and AbortSignal Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: Resolve ICU conflictHirokazu MORIKAWA2021-04-21
| | | | | | | | Resolve conflicts between OpenWrt's ICU package and the ICU shipped with node.js. https://github.com/openwrt/packages/issues/15437 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: bump to v14.16.1Hirokazu MORIKAWA2021-04-11
| | | | | | | | | | | April 2021 Security Releases - OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450) - OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449) - npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774) OpenSSL-related vulnerabilities do not affect the OpenWrt package. Because OpenWrt's OpenSSL shared library has been updated. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: #14983 NODEJS_ICU_SMALL is defaultRobin Rainton2021-04-11
| | | | Signed-off-by: Robin Rainton <robin@rainton.com>
* node: bump to v14.16.0Hirokazu MORIKAWA2021-02-26
| | | | | | | | | | | Update to v14.16.0 February 2021 Security Releases - HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (Critical) (CVE-2021-22883) - DNS rebinding in --inspect (CVE-2021-22884) - OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: make hostpkg icu-enabledHirokazu MORIKAWA2021-02-17
| | | | | | | Made the necessary changes to build the latest version of adguardhome. See this thread : https://github.com/openwrt/packages/pull/14717 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v14.15.5Hirokazu MORIKAWA2021-02-12
| | | | | | | | Description: Update to v14.15.5 upgrade npm to 6.14.11 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v14.15.4Hirokazu MORIKAWA2021-01-11
| | | | | | | | January 2021 Security Releases: use-after-free in TLSWrap (High) (CVE-2020-8265) HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v14.15.3Hirokazu MORIKAWA2020-12-24
| | | | | | | | | | | Maintainer: me @ianchi Compile tested: head r15324-920b692, aarch64, x86_64 Run tested: (qemu 5.2.0) aarch64, x86_64 Description: Update to v14.15.3 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v14.15.1Hirokazu MORIKAWA2020-12-10
| | | | | | Update to v14.15.1 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v12.20.0Hirokazu MORIKAWA2020-11-27
| | | | | | | Update to v12.20.0 Take over maintainership from John Crispin Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v12.19.0Hirokazu MORIKAWA2020-11-08
| | | | | | | Update to v12.19.0 Fixes for the removal of MIPS FPU emulator support. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v12.18.4Hirokazu MORIKAWA2020-09-16
| | | | | | | | | | Vulnerabilities fixed: * CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion (High). * CVE-2020-8252: fs.realpath.native on may cause buffer overflow (Medium). Imported patches from the debian package. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v12.18.3Hirokazu MORIKAWA2020-07-30
| | | | | | | | | | | | upgrade npm to 6.14.6 update openssl to 1.1.1g Vulnerabilities fixed: * CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). * CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). * CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High). Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: Change icu version specificationHirokazu MORIKAWA2020-03-24
| | | | | | modify host icu library path Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v12.16.1Hirokazu MORIKAWA2020-02-21
| | | | | | | | Add some new APIs V8 was updated to 7.8.279.23. This includes performance improvements to object destructuring, RegExp match failures and WebAssembly startup time. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: update to v12.15.0Hirokazu MORIKAWA2020-02-06
| | | | | | | | Update to v12.15.0 Support Python3 : https://github.com/openwrt/packages/issues/8893 Preparing to deprecate nosnapshot builds. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: fix http/2 DoSHirokazu MORIKAWA2019-08-16
| | | | | | | | | | | This is a security release. Node.js, as well as many other implementations of HTTP/2, have been found
vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
* node: fix host build error on macOSHirokazu MORIKAWA2019-08-01
| | | | | | | | | | fix host build error on macOS reference: https://github.com/openwrt/packages/issues/9616 Related: https://github.com/openwrt/packages/issues/7171 (This correspondence is necessary to build with macOS.) Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Powered by cgit, Themed by Ted Yin.