Wed Jun 3 08:41:24 2020 UTC ()
nodejs: updated to 14.4.0

Version 14.4.0 (Current)

Notable changes

This is a security release.

Vulnerabilities fixed:

CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).

Commits

- crypto: update root certificates
- (SEMVER-MINOR) deps: update nghttp2 to 1.41.0
- (SEMVER-MINOR) http2: implement support for max settings entries
- napi: fix memory corruption vulnerability
- tls: emit session after verifying certificate
- tools: update certdata.txt


(adam)
diff -r1.183 -r1.184 pkgsrc/lang/nodejs/Makefile
diff -r1.171 -r1.172 pkgsrc/lang/nodejs/distinfo
cvs diff -r1.183 -r1.184 pkgsrc/lang/nodejs/Makefile (expand / switch to unified diff)

--- pkgsrc/lang/nodejs/Makefile 2020/06/02 08:22:45 1.183
+++ pkgsrc/lang/nodejs/Makefile 2020/06/03 08:41:24 1.184
@@ -1,21 +1,20 @@ @@ -1,21 +1,20 @@
1# $NetBSD: Makefile,v 1.183 2020/06/02 08:22:45 adam Exp $ 1# $NetBSD: Makefile,v 1.184 2020/06/03 08:41:24 adam Exp $
2 2
3DISTNAME= node-v14.3.0 3DISTNAME= node-v14.4.0
4EXTRACT_SUFX= .tar.xz 4EXTRACT_SUFX= .tar.xz
5 5
6USE_LANGUAGES= c gnu++14 6USE_LANGUAGES= c gnu++14
7 7
8PKGREVISION= 1 
9.include "../../mk/bsd.prefs.mk" 8.include "../../mk/bsd.prefs.mk"
10 9
11# XXX: figure out a way to add rpaths to torque 10# XXX: figure out a way to add rpaths to torque
12MAKE_ENV+= LD_LIBRARY_PATH=${PREFIX}/lib 11MAKE_ENV+= LD_LIBRARY_PATH=${PREFIX}/lib
13 12
14CONFIGURE_ARGS+= --shared-nghttp2 13CONFIGURE_ARGS+= --shared-nghttp2
15CONFIGURE_ARGS+= --shared-openssl 14CONFIGURE_ARGS+= --shared-openssl
16CONFIGURE_ARGS+= --with-intl=system-icu 15CONFIGURE_ARGS+= --with-intl=system-icu
17 16
18CHECK_PORTABILITY_SKIP+= tools/macos-installer/pkgbuild/npm/scripts/preinstall 17CHECK_PORTABILITY_SKIP+= tools/macos-installer/pkgbuild/npm/scripts/preinstall
19 18
20.if ${MACHINE_ARCH} == "i386" 19.if ${MACHINE_ARCH} == "i386"
21# 64 bit atomic ops are required 20# 64 bit atomic ops are required
cvs diff -r1.171 -r1.172 pkgsrc/lang/nodejs/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/nodejs/distinfo 2020/05/20 06:58:35 1.171
+++ pkgsrc/lang/nodejs/distinfo 2020/06/03 08:41:24 1.172
@@ -1,19 +1,19 @@ @@ -1,19 +1,19 @@
1$NetBSD: distinfo,v 1.171 2020/05/20 06:58:35 adam Exp $ 1$NetBSD: distinfo,v 1.172 2020/06/03 08:41:24 adam Exp $
2 2
3SHA1 (node-v14.3.0.tar.xz) = 5c83a27cf71559f8afdc30572f51860a3f900bca 3SHA1 (node-v14.4.0.tar.xz) = 410b41fc6723af146914d1359ef2c19646d3bde2
4RMD160 (node-v14.3.0.tar.xz) = 0095c9ddf3890dfd6e3291cd734bddad04c1e6fe 4RMD160 (node-v14.4.0.tar.xz) = 830ab17bad8cbb9d04877216c157e86cb149c58f
5SHA512 (node-v14.3.0.tar.xz) = 3afcc430bad57150baa8d1c0e5ef0f64691ef6549a052be654a86313fe28f31e7fdfeea4d2b3993798a7141bc6d7b1642747d1bc2636139e2f2fd79441580148 5SHA512 (node-v14.4.0.tar.xz) = f1a7c788a8a149b942ec2b90a4314baaa5355c381029eda45002728ce7209925c016323b0ec1e0dfe2359fddb24f494df125805d0d266b738a333dcddb3f59c3
6Size (node-v14.3.0.tar.xz) = 32985344 bytes 6Size (node-v14.4.0.tar.xz) = 33005312 bytes
7SHA1 (patch-common.gypi) = f0bd2962bf7c8466db24b35a35154897ecad6316 7SHA1 (patch-common.gypi) = f0bd2962bf7c8466db24b35a35154897ecad6316
8SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32 8SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32
9SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3 9SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3
10SHA1 (patch-deps_v8_src_base_atomicops.h) = d1ef20a3fee1d188687bd76836ada6f2c8e0787f 10SHA1 (patch-deps_v8_src_base_atomicops.h) = d1ef20a3fee1d188687bd76836ada6f2c8e0787f
11SHA1 (patch-deps_v8_src_base_platform_platform-freebsd.cc) = b47025f33d2991275bbcd15dbabb28900afab0e1 11SHA1 (patch-deps_v8_src_base_platform_platform-freebsd.cc) = b47025f33d2991275bbcd15dbabb28900afab0e1
12SHA1 (patch-deps_v8_src_base_platform_platform-openbsd.cc) = 5e593879dbab095f99e82593272a0de91043f9a8 12SHA1 (patch-deps_v8_src_base_platform_platform-openbsd.cc) = 5e593879dbab095f99e82593272a0de91043f9a8
13SHA1 (patch-deps_v8_src_base_platform_platform-posix.cc) = 0d80cc6587af9220832de112834e9f50242f819f 13SHA1 (patch-deps_v8_src_base_platform_platform-posix.cc) = 0d80cc6587af9220832de112834e9f50242f819f
14SHA1 (patch-deps_v8_src_base_platform_semaphore.cc) = 802a95f1b1d131e0d85c1f99c659cc68b31ba2f6 14SHA1 (patch-deps_v8_src_base_platform_semaphore.cc) = 802a95f1b1d131e0d85c1f99c659cc68b31ba2f6
15SHA1 (patch-deps_v8_src_common_globals.h) = 86637724864389f2b24251904de41669a2f00fbc 15SHA1 (patch-deps_v8_src_common_globals.h) = 86637724864389f2b24251904de41669a2f00fbc
16SHA1 (patch-deps_v8_src_compiler_types.h) = 2a212282ab9d71e98ae56827fdb1d9778a6047a5 16SHA1 (patch-deps_v8_src_compiler_types.h) = 2a212282ab9d71e98ae56827fdb1d9778a6047a5
17SHA1 (patch-deps_v8_src_zone_zone.h) = 651b49d242dac8f713cccc101147ccf61f828ecb 17SHA1 (patch-deps_v8_src_zone_zone.h) = 651b49d242dac8f713cccc101147ccf61f828ecb
18SHA1 (patch-deps_v8_tools_run-llprof.sh) = 39aa3faf77492ef8dd35b411b7b0e4605b469af3 18SHA1 (patch-deps_v8_tools_run-llprof.sh) = 39aa3faf77492ef8dd35b411b7b0e4605b469af3
19SHA1 (patch-node.gypi) = 4a104dba6c22702211009bc60a6be6f87554e2fa 19SHA1 (patch-node.gypi) = 4a104dba6c22702211009bc60a6be6f87554e2fa