buildroot/package/nodejs, branch 2018.02.1

nodejs: security bump to version 8.11.1

2018-04-06T18:10:02+00:00

Fixes the following security issues: - Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6. - Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions. - Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values. While we are at it, also add a hash for the license file. Signed-off-by: Peter Korsgaard (cherry picked from commit 7f02604553bc3c8449d6a112818f038e99abbdaf) Signed-off-by: Peter Korsgaard

package/nodejs: bump version to 8.10.0

2018-03-30T21:12:27+00:00

See https://nodejs.org/en/blog/release/v8.10.0/ Signed-off-by: Martin Bark Signed-off-by: Peter Korsgaard (cherry picked from commit df33aae5f59eaaf40e800acdfefc83e57216ffe8) Signed-off-by: Peter Korsgaard

package/nodejs: bump version to 8.9.4

2018-01-30T21:50:40+00:00

See https://nodejs.org/en/blog/release/v8.9.4/ Signed-off-by: Martin Bark Signed-off-by: Peter Korsgaard

package/nodejs: security bump to version 8.9.3

2017-12-18T20:39:46+00:00

See https://nodejs.org/en/blog/release/v8.9.3/ [Peter: mention that this fixes security issues] Signed-off-by: Martin Bark Signed-off-by: Peter Korsgaard

package/*/Config.in: fix help text check-package warnings

2017-12-18T08:22:54+00:00

This commit fixes the warnings reported by check-package on the help text of all package Config.in files, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. The vast majority of warnings fixed were caused by too long lines. A few warnings were related to spaces being used instead of a tab to indent the help text. Signed-off-by: Thomas Petazzoni

package/nodejs: bump version to 8.9.1

2017-11-08T18:45:42+00:00

See https://nodejs.org/en/blog/release/v8.9.1/ Signed-off-by: Martin Bark Signed-off-by: Peter Korsgaard

package/nodejs: bump version to 8.8.1

2017-10-26T11:22:53+00:00

Fixes a regression introduced in 8.8.0. See https://nodejs.org/en/blog/release/v8.8.1/ Peter: apply on top of 8.8.0, mention that it fixes regression] Signed-off-by: Martin Bark Signed-off-by: Peter Korsgaard

nodejs: security bump to version 8.8.0

2017-10-26T11:19:34+00:00

Fixes CVE-2017-14919 - In zlib v1.2.9, a change was made that causes an error to be raised when a raw deflate stream is initialized with windowBits set to 8. On some versions this crashes Node and you cannot recover from it, while on some versions it throws an exception. Node.js will now gracefully set windowBits to 9 replicating the legacy behavior to avoid a DOS vector. For more details, see the announcement: https://nodejs.org/en/blog/vulnerability/oct-2017-dos/ Signed-off-by: Peter Korsgaard Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Korsgaard

package/nodejs: bump version to 8.6.0

2017-10-01T21:12:07+00:00

See https://nodejs.org/en/blog/release/v8.6.0/ Signed-off-by: Martin Bark Signed-off-by: Peter Korsgaard

package/nodejs: bump version to 8.5.0

2017-09-24T12:27:08+00:00

Signed-off-by: Bernd Kuhls Signed-off-by: Arnout Vandecappelle (Essensium/Mind)