Wed Apr 7 06:21:56 2021 UTC ()
nodejs: updated to 14.16.1

Version 14.16.1 'Fermium' (LTS)

This is a security release.

Notable Changes

Vulnerabilities fixed:

CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
Impacts:
All versions of the 15.x, 14.x, 12.x and 10.x releases lines

CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
Impacts:
All versions of the 15.x, 14.x, 12.x and 10.x releases lines

CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)
This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh
Impacts:
All versions of the 14.x, 12.x and 10.x releases lines


(adam)
diff -r1.208 -r1.209 pkgsrc/lang/nodejs/Makefile
diff -r1.193 -r1.194 pkgsrc/lang/nodejs/distinfo
cvs diff -r1.208 -r1.209 pkgsrc/lang/nodejs/Makefile (expand / switch to unified diff)

--- pkgsrc/lang/nodejs/Makefile 2021/02/24 11:06:12 1.208
+++ pkgsrc/lang/nodejs/Makefile 2021/04/07 06:21:56 1.209
@@ -1,16 +1,16 @@ @@ -1,16 +1,16 @@
1# $NetBSD: Makefile,v 1.208 2021/02/24 11:06:12 adam Exp $ 1# $NetBSD: Makefile,v 1.209 2021/04/07 06:21:56 adam Exp $
2 2
3DISTNAME= node-v14.16.0 3DISTNAME= node-v14.16.1
4EXTRACT_SUFX= .tar.xz 4EXTRACT_SUFX= .tar.xz
5 5
6USE_LANGUAGES= c gnu++14 6USE_LANGUAGES= c gnu++14
7 7
8.include "../../mk/bsd.prefs.mk" 8.include "../../mk/bsd.prefs.mk"
9 9
10# XXX: figure out a way to add rpaths to torque 10# XXX: figure out a way to add rpaths to torque
11MAKE_ENV+= LD_LIBRARY_PATH=${PREFIX}/lib 11MAKE_ENV+= LD_LIBRARY_PATH=${PREFIX}/lib
12 12
13CONFIGURE_ARGS+= --shared-nghttp2 13CONFIGURE_ARGS+= --shared-nghttp2
14CONFIGURE_ARGS+= --with-intl=system-icu 14CONFIGURE_ARGS+= --with-intl=system-icu
15 15
16PYTHON_VERSIONS_ACCEPTED= 27 16PYTHON_VERSIONS_ACCEPTED= 27
cvs diff -r1.193 -r1.194 pkgsrc/lang/nodejs/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/nodejs/distinfo 2021/02/24 11:06:12 1.193
+++ pkgsrc/lang/nodejs/distinfo 2021/04/07 06:21:56 1.194
@@ -1,19 +1,19 @@ @@ -1,19 +1,19 @@
1$NetBSD: distinfo,v 1.193 2021/02/24 11:06:12 adam Exp $ 1$NetBSD: distinfo,v 1.194 2021/04/07 06:21:56 adam Exp $
2 2
3SHA1 (node-v14.16.0.tar.xz) = 52ee20a121bc54990d6e0b3320c26a4be4c38325 3SHA1 (node-v14.16.1.tar.xz) = 3b8001e12cdae8b0e0fb2c1f7a8eb7f314d30cfc
4RMD160 (node-v14.16.0.tar.xz) = 17eaeca8d358432e3b9e149d0eb26ba71fdf7545 4RMD160 (node-v14.16.1.tar.xz) = cf91d50c5833f8f20799bb2bbdfc9152207c50d0
5SHA512 (node-v14.16.0.tar.xz) = ac6f7408df35e2bae8bcad3f461d8e260a2762c77f78d737b0339a592724ff1a98ba171a95e44366e731accfb3208e7cfd6d3edd0f646ddc26a01cfbdbbb655b 5SHA512 (node-v14.16.1.tar.xz) = d4f5fbab69592ae555613b2186090b85a458d2211b6035989aee2617bfd0f6768ca767ec45ce12756a9c452d00af7237edee3b1ae526049e9fcd01f8f67680c0
6Size (node-v14.16.0.tar.xz) = 33301140 bytes 6Size (node-v14.16.1.tar.xz) = 33297064 bytes
7SHA1 (patch-common.gypi) = f0bd2962bf7c8466db24b35a35154897ecad6316 7SHA1 (patch-common.gypi) = f0bd2962bf7c8466db24b35a35154897ecad6316
8SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32 8SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32
9SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3 9SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3
10SHA1 (patch-deps_uvwasi_include_wasi__serdes.h) = 32b85ef5824b96b35aba9280bbe7aa7899d9e5cf 10SHA1 (patch-deps_uvwasi_include_wasi__serdes.h) = 32b85ef5824b96b35aba9280bbe7aa7899d9e5cf
11SHA1 (patch-deps_v8_src_base_atomicops.h) = 05b1f62850c3d4a9a8e94a5263be1c4267cf566d 11SHA1 (patch-deps_v8_src_base_atomicops.h) = 05b1f62850c3d4a9a8e94a5263be1c4267cf566d
12SHA1 (patch-deps_v8_src_base_platform_platform-freebsd.cc) = b47025f33d2991275bbcd15dbabb28900afab0e1 12SHA1 (patch-deps_v8_src_base_platform_platform-freebsd.cc) = b47025f33d2991275bbcd15dbabb28900afab0e1
13SHA1 (patch-deps_v8_src_base_platform_platform-openbsd.cc) = 5e593879dbab095f99e82593272a0de91043f9a8 13SHA1 (patch-deps_v8_src_base_platform_platform-openbsd.cc) = 5e593879dbab095f99e82593272a0de91043f9a8
14SHA1 (patch-deps_v8_src_base_platform_platform-posix.cc) = 84300d917c172e6211a00b76bfb44ee25465ee00 14SHA1 (patch-deps_v8_src_base_platform_platform-posix.cc) = 84300d917c172e6211a00b76bfb44ee25465ee00
15SHA1 (patch-deps_v8_src_base_platform_semaphore.cc) = 802a95f1b1d131e0d85c1f99c659cc68b31ba2f6 15SHA1 (patch-deps_v8_src_base_platform_semaphore.cc) = 802a95f1b1d131e0d85c1f99c659cc68b31ba2f6
16SHA1 (patch-deps_v8_src_codegen_arm_cpu-arm.cc) = 84c75d61bc99c2ff9adeac3152f5b11ebb0e582b 16SHA1 (patch-deps_v8_src_codegen_arm_cpu-arm.cc) = 84c75d61bc99c2ff9adeac3152f5b11ebb0e582b
17SHA1 (patch-deps_v8_src_common_globals.h) = 86637724864389f2b24251904de41669a2f00fbc 17SHA1 (patch-deps_v8_src_common_globals.h) = 86637724864389f2b24251904de41669a2f00fbc
18SHA1 (patch-deps_v8_src_compiler_types.h) = 2a212282ab9d71e98ae56827fdb1d9778a6047a5 18SHA1 (patch-deps_v8_src_compiler_types.h) = 2a212282ab9d71e98ae56827fdb1d9778a6047a5
19SHA1 (patch-deps_v8_src_zone_zone.h) = 651b49d242dac8f713cccc101147ccf61f828ecb 19SHA1 (patch-deps_v8_src_zone_zone.h) = 651b49d242dac8f713cccc101147ccf61f828ecb