summaryrefslogtreecommitdiffstats
path: root/package/nodejs/nodejs.hash
Commit message (Collapse)AuthorAgeFilesLines
* package/nodejs: security bump to version 8.15.1Peter Korsgaard2019-03-261-2/+2
| | | | | | | | | | | | Fixes the following security issues: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) OpenSSL: 0-byte record padding oracle (CVE-2019-1559) For more details, see the CHANGELOG: https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.1 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to v8.15.0Peter Korsgaard2019-01-041-2/+2
| | | | | | | | | | | | | | Fixes regressions introduced by the v8.14.0 security release. From the announcement: The 8.14.0 security release introduced some unexpected breakages on the 8.x release line. This is a special release to fix a regression in the HTTP binary upgrade response body and add a missing CLI flag to adjust the max header size of the http parser. https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.0 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: security bump to version 8.14.0Peter Korsgaard2018-12-101-2/+2
| | | | | | | | | | | | | | | | | | | Fixes the following security vulnerabilities: - Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) - Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) - Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) - Node.js: HTTP request splitting (CVE-2018-12116) - OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) - OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) For more details, see the announcement: https://nodejs.org/en/blog/release/v8.14.0/ Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/nodejs: bump version to 8.12.0Martin Bark2018-09-121-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.12.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/nodejs: security bump version to 8.11.4Bernd Kuhls2018-08-191-2/+2
| | | | | | | | | | | Release notes: https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/ Fixes CVE-2018-12115, also CVEs were fixed in included OpenSSL code which do not use for the target build. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: security bump to version 8.11.3Martin Bark2018-06-171-2/+2
| | | | | | | | | | | | | | | | | | | Fixes the following security issues: - (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang - (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup - (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 See https://nodejs.org/en/blog/release/v8.11.3/ for more details Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/nodejs: bump version to 8.11.2Martin Bark2018-05-171-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.11.2/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* nodejs: security bump to version 8.11.1Peter Korsgaard2018-03-311-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: - Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6. - Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions. - Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values. While we are at it, also add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.10.0Martin Bark2018-03-091-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.10.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.9.4Martin Bark2018-01-301-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.9.4/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: security bump to version 8.9.3Martin Bark2017-12-181-2/+2
| | | | | | | | See https://nodejs.org/en/blog/release/v8.9.3/ [Peter: mention that this fixes security issues] Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.9.1Martin Bark2017-11-081-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.9.1/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.8.1Martin Bark2017-10-261-2/+2
| | | | | | | | | Fixes a regression introduced in 8.8.0. See https://nodejs.org/en/blog/release/v8.8.1/ Peter: apply on top of 8.8.0, mention that it fixes regression] Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* nodejs: security bump to version 8.8.0Peter Korsgaard2017-10-261-2/+2
| | | | | | | | | | | | | | | | Fixes CVE-2017-14919 - In zlib v1.2.9, a change was made that causes an error to be raised when a raw deflate stream is initialized with windowBits set to 8. On some versions this crashes Node and you cannot recover from it, while on some versions it throws an exception. Node.js will now gracefully set windowBits to 9 replicating the legacy behavior to avoid a DOS vector. For more details, see the announcement: https://nodejs.org/en/blog/vulnerability/oct-2017-dos/ Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Peter Korsgaard &lt;<a href="mailto:peter@korsgaard.com">peter@korsgaard.com</a>&gt;<br> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.6.0Martin Bark2017-10-011-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.6.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.5.0Bernd Kuhls2017-09-241-2/+2
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
* package/nodejs: bump version to 8.4.0Martin Bark2017-09-061-2/+2
| | | | | | | | | | See https://nodejs.org/en/blog/release/v8.4.0/ An update to v8 6.0.286 has removed the need for mkpeephole and 0002-add-missing-stdarg-includes.patch Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 8.2.1Martin Bark2017-07-251-2/+2
| | | | | | | https://nodejs.org/en/blog/release/v8.2.1/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: security bump to version 8.1.4Martin Bark2017-07-131-2/+2
| | | | | | | | | | | | | | | Fixes CVE-2017-1000381 - The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. This patch checks that there is enough data for the required elements of an NAPTR record (2 int16, 3 bytes for string lengths) before processing a record. See https://nodejs.org/en/blog/release/v8.1.4/ [Peter: add CVE info] Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.1.2Martin Bark2017-06-201-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.1.2/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 8.0.0Martin Bark2017-06-051-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v8.0.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 7.10.0Martin Bark2017-05-061-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v7.10.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 7.9.0Martin Bark2017-04-141-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v7.9.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 7.8.0Martin Bark2017-04-131-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v7.8.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 7.7.3Martin Bark2017-03-181-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v7.7.3/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 7.7.2Martin Bark2017-03-141-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v7.7.2/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: remove 0.10.x supportMartin Bark2017-03-141-3/+0
| | | | | | | | nodejs 0.10.x is now end of life and is no longer maintained so remove it. See https://github.com/nodejs/LTS Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* nodejs: bump to version 6.9.4Peter Korsgaard2017-01-091-2/+2
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* nodejs: bump to version 6.9.2Peter Korsgaard2016-12-221-2/+2
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* nodejs: security bump 0.10.x series to 0.10.48Peter Korsgaard2016-12-031-2/+2
| | | | | | | | c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more information at https://c-ares.haxx.se/adv_20160929.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 6.9.1Patrick Devlin2016-11-141-2/+2
| | | | | | | | | https://nodejs.org/en/blog/release/v6.9.1/ The patches from 6.7.0 have been copied to 6.9.1. Signed-off-by: Patrick Devlin <cloudyparts@icloud.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 6.7.0Martin Bark2016-09-301-2/+2
| | | | | | | | | | | | | https://nodejs.org/en/blog/release/v6.7.0/ The patches from 6.2.1 have been copied to 6.7.0 with the following changes: - Add 0002-inspector-don-t-build-when-ssl-support-is-disabled.patch to disable the new V8 inspector when openssl is not included. Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 0.10.47Martin Bark2016-09-301-2/+2
| | | | | | | https://nodejs.org/en/blog/release/v0.10.47/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 6.2.1Martin Bark2016-06-031-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v6.2.1/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 0.10.45Martin Bark2016-05-091-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v0.10.45/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 6.1.0Martin Bark2016-05-091-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v6.1.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 6.0.0Martin Bark2016-04-281-2/+2
| | | | | | | | | | | | | | | | See https://nodejs.org/en/blog/release/v6.0.0/ The patches from 5.11.0 have been copied to 6.0.0 with the following changes: - Removed 0001-Remove-dependency-on-Python-bz2-module.patch, 0003-Fix-va_list-not-declared.patch and 0004-Fix-support-for-uClibc-ng.patch as all 3 have been fixed upstream - Renamed 0002-gyp-force-link-command-to-use-CXX.patch to 0001-gyp-force-link-command-to-use-CXX.patch Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 5.11.0Martin Bark2016-04-261-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v5.11.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 0.10.44Martin Bark2016-04-261-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v0.10.44/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 5.10.1Martin Bark2016-04-131-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v5.10.1/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 5.9.1Martin Bark2016-03-261-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v5.9.1/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 5.8.0Martin Bark2016-03-101-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v5.8.0/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 0.10.43Martin Bark2016-03-081-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v0.10.43/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 5.7.1Martin Bark2016-03-061-2/+2
| | | | | | | See https://nodejs.org/en/blog/release/v5.7.1/ Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* Merge branch 'next'Peter Korsgaard2016-03-021-2/+2
|\ | | | | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/nodejs: bump version to 5.6.0Martin Bark2016-02-161-2/+2
| | | | | | | | | | | | | | | | This is an important security release. See https://nodejs.org/en/blog/release/v5.6.0/ for further details Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | package/nodejs: security bump for 0.10.x to version 0.10.42Jörg Krause2016-02-181-2/+2
|/ | | | | | | | | | | | | | Fixes security vulnerabilites [1]: - CVE-2016-2086 - CVE-2016-2216 Also switch to the xz compressed tar file now available for v0.10 builds from v0.10.42 onward. [1] https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/ Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump to version 5.5.0Martin Bark2016-02-071-2/+2
| | | | | | | | | | | Patches from 5.3.0 have been copied over with the following exceptions: - Removed 0005-Fix-crash-in-GetInterfaceAddresses.patch as this has been applied upstream - Renamed 0006-Fix-support-for-uClibc-ng.patch to 0005-Fix-support-for-uClibc-ng.patch Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: removed version 0.12.9Martin Bark2015-12-231-3/+0
| | | | | | | | | Remove 0.12.9 to rationalise the number of nodejs releases supported by buildroot. Going forward buildroot will only support the latest release of nodejs and the 0.10.x branch for armv5 support. Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/nodejs: bump version to 5.3.0Martin Bark2015-12-231-2/+2
| | | | | | | | | | | | | | Replace 4.2.3 with 5.3.0. 5.3.0 is the current Stable release. See https://nodejs.org/en/blog/release/v5.3.0 for details on the release. Copied 4.2.3 patched to 5.3.0 with the following exceptions: - Removed 0004-fix-arm-vfpv2.patch, committed upstream and included in 5.3.0. See https://github.com/nodejs/node/commit/84dea1bd0c - Added 0004-Fix-va_list-not-declared.patch, fix for a new bug. This has already been fixed upstream but is not in 5.3.0 Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud