Marcus Hoffmann
d2865a73fa
Release Notes: https://nodejs.org/en/blog/release/v20.15.1
Fixes the following CVE's:
CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
CVE-2024-22018 - fs.lstat bypasses permission model (Low)
CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
CVE-2024-37372 - Permission model improperly processes UNC paths (Low)
Also these additional CVE's were fixed in the v20.12.1 and v20.12.2 releases [1][2]:
CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
NodeJS tests are passing:
$ ./support/testing/run-tests -o ./outputs/ -k tests.package.test_nodejs -d dl
12:02:58 TestNodeJSModuleHostSrc Starting
12:02:58 TestNodeJSModuleHostSrc Building
13:17:15 TestNodeJSModuleHostSrc Building done
13:17:23 TestNodeJSModuleHostSrc Cleaning up
.13:17:23 TestNodeJSModuleHostBin Starting
13:17:23 TestNodeJSModuleHostBin Building
14:06:15 TestNodeJSModuleHostBin Building done
14:06:20 TestNodeJSModuleHostBin Cleaning up
.14:06:20 TestNodeJSBasic Starting
14:06:20 TestNodeJSBasic Building
14:55:40 TestNodeJSBasic Building done
14:55:45 TestNodeJSBasic Cleaning up
LICENSE hash changed due to changes in vendored components:
* copyright year update and adding spdx identifier [1]
[1] https://nodejs.org/en/blog/release/v20.12.1
[2] https://nodejs.org/en/blog/release/v20.12.2
[3] https://github.com/nodejs/node/commit/d5a316f5ea3fade3140c2ae35c144b500fb5d758
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bffb6a2339)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
40 lines
1.3 KiB
Makefile
40 lines
1.3 KiB
Makefile
################################################################################
|
|
#
|
|
# nodejs
|
|
#
|
|
################################################################################
|
|
|
|
# _VERSION, _SOURCE and _SITE must be kept empty to avoid downloading anything
|
|
NODEJS_COMMON_VERSION = 20.15.1
|
|
NODEJS_COMMON_SOURCE = node-v$(NODEJS_COMMON_VERSION).tar.xz
|
|
NODEJS_COMMON_SITE = http://nodejs.org/dist/v$(NODEJS_COMMON_VERSION)
|
|
|
|
NODEJS_LICENSE = MIT (core code); MIT, Apache and BSD family licenses (Bundled components)
|
|
NODEJS_LICENSE_FILES = LICENSE
|
|
NODEJS_CPE_ID_VENDOR = nodejs
|
|
NODEJS_CPE_ID_PRODUCT = node.js
|
|
|
|
NODEJS_BIN_ENV = $(TARGET_CONFIGURE_OPTS) \
|
|
LDFLAGS="$(NODEJS_LDFLAGS)" \
|
|
LD="$(TARGET_CXX)" \
|
|
npm_config_arch=$(NODEJS_CPU) \
|
|
npm_config_target_arch=$(NODEJS_CPU) \
|
|
npm_config_build_from_source=true \
|
|
npm_config_nodedir=$(STAGING_DIR)/usr \
|
|
npm_config_prefix=$(TARGET_DIR)/usr \
|
|
npm_config_cache=$(BUILD_DIR)/.npm-cache
|
|
|
|
# Define various packaging tools for other packages to use
|
|
NPM = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/npm
|
|
ifeq ($(BR2_PACKAGE_HOST_NODEJS_COREPACK),y)
|
|
COREPACK = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/corepack
|
|
PNPM = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/pnpm
|
|
YARN = $(NODEJS_BIN_ENV) $(HOST_DIR)/bin/yarn
|
|
endif
|
|
|
|
NODEJS_DEPENDENCIES = nodejs-src
|
|
$(eval $(generic-package))
|
|
$(eval $(host-virtual-package))
|
|
|
|
include $(sort $(wildcard package/nodejs/*/*.mk))
|