buildroot/package/nodejs, branch 2019.02-op-build

package/nodejs: security bump to version 8.15.1

2019-03-26T14:01:42+00:00

Fixes the following security issues: Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) OpenSSL: 0-byte record padding oracle (CVE-2019-1559) For more details, see the CHANGELOG: https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.1 Signed-off-by: Peter Korsgaard

package/nodejs: bump version to v8.15.0

2019-01-04T07:34:13+00:00

Fixes regressions introduced by the v8.14.0 security release. From the announcement: The 8.14.0 security release introduced some unexpected breakages on the 8.x release line. This is a special release to fix a regression in the HTTP binary upgrade response body and add a missing CLI flag to adjust the max header size of the http parser. https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.0 Signed-off-by: Peter Korsgaard

package/nodejs: security bump to version 8.14.0

2018-12-10T10:47:50+00:00

Fixes the following security vulnerabilities: - Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) - Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) - Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) - Node.js: HTTP request splitting (CVE-2018-12116) - OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) - OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) For more details, see the announcement: https://nodejs.org/en/blog/release/v8.14.0/ Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

package/nodejs: use per-build cache directories

2018-10-15T11:21:34+00:00

When two Buildroot builds run in parallel, and they both happen to call npm at roughly the same time, the two npm instances may conflict when accessing the npm cache, which is by default ~/.npm Although npm is supposed to lock access to the cache, it seems it does sometimes fail to do so properly, bailling out in error, when it would never ever crash at all when not running in parallel. We suspect that the sequence leading to such failures are something like: npm-1 npm-2 lock(retry=few, sleep=short) . does-stuff() . . lock(retry=few, sleep=short) . # can't lock local cache . download-module() . # can't download . exit(1) unlock() As per the docs [0], few = 10, short = 10. So if the first npm (npm-1) takes more than 100s (which can happen behind slow links and/or big modules that contain native code that is compiled), then the second npm (npm-2) will bail out (the download would fail if there is no network access, for example, and only local modules are used). Point npm to use a per-build cache directory, so they no longer compete across builds. That would still need some care when we do top-level parallel builds, though. Note also that the conflicts are not totally eliminated: two or more npm instances may still compete for some other resource that has not yet been identified. But, at least, the conflict window has been drastically shortened now, to the point where it now seldom occurs. Signed-off-by: "Yann E. MORIN" Signed-off-by: Peter Korsgaard

arch: allow GCC target options to be optionally overwritten

2018-09-23T20:17:57+00:00

The BR2_GCC_TARGET_* configuration variables are copied to corresponding GCC_TARGET_* variables which may then be optionally modified or overwritten by architecture specific makefiles. All makefiles must use the new GCC_TARGET_* variables instead of the BR2_GCC_TARGET_* versions. Signed-off-by: Mark Corbin [Thomas: simplify include of arch/arch.mk] Signed-off-by: Thomas Petazzoni

package/nodejs: bump version to 8.12.0

2018-09-12T16:11:09+00:00

See https://nodejs.org/en/blog/release/v8.12.0/ Signed-off-by: Martin Bark Signed-off-by: Thomas Petazzoni

Merge branch 'next'

2018-09-07T11:13:17+00:00

Signed-off-by: Peter Korsgaard

package/nodejs: use host-libopenssl

2018-08-20T22:00:08+00:00

host-nodejs is configured to build openssl by using its included openssl source code which is based on openssl 1.0.2. If host-libopenssl was already built its header files are being picked up during host-nodejs build, this was verified by adding debug code to $(HOST_DIR)/include/openssl/opensslv.h. This situation was not a problem as long as host-libopenssl was the same version than the openssl code included in nodejs. Some code in host-nodejs-8.11.4/src/node_crypto.cc is guarded by #if OPENSSL_VERSION_NUMBER < 0x10100000L to be used only with openssl 1.0.x. This leads to problems if host-libopenssl 1.1.x was built before. Due to the usage of its header files some code in node_crypto.cc is not built leading to many linking errors later on, for example: node_crypto.cc:(.text+0x1a1): undefined reference to `DH_get0_pqg' When the nodejs package originally was added to buildroot back in March 2013: https://git.buildroot.net/buildroot/commit/?id=b31bc7d4387095091a109eb879464d54d37a5eab We did not have a host-libopenssl package back then, it was added one month later: https://git.buildroot.net/buildroot/commit/?id=7842789cb539b6b64d61b03f5c8dbe6813f01da7 To fix the problem we use host-libopenssl for host-nodejs. By using host-libopenssl the build time of nodejs is reduced by ~15s. Signed-off-by: Bernd Kuhls Reviewed-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

package/nodejs: security bump version to 8.11.4

2018-08-19T19:29:11+00:00

Release notes: https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/ Fixes CVE-2018-12115, also CVEs were fixed in included OpenSSL code which do not use for the target build. Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

package/nodejs: security bump to version 8.11.3

2018-06-17T12:04:29+00:00

Fixes the following security issues: - (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang - (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup - (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 See https://nodejs.org/en/blog/release/v8.11.3/ for more details Signed-off-by: Martin Bark Signed-off-by: Thomas Petazzoni