Changelog for
npm4-4.9.1-20.1.x86_64.rpm :
Wed Jan 9 13:00:00 2019 adam.majerAATTsuse.de
Backport security fixes from NodeJS 6.x:
* debugger: prevent the debugger from listening on 0.0.0.0.
It now defaults to 127.0.0.1.
CVE-2018-12120.patch - (CVE-2018-12120, bsc#1117625)
* cli: add --max-http-header-size flag (max_header_size.patch)
* deps: upgrade OpenSSL sources to 1.0.2q
(openssl_1_0_2q.patch - CVE-2018-0734, bsc#1113652,
CVE-2018-5407, bsc#1113534)
* http:
+ add maxHeaderSize property (max_header_size.patch)
+ Headers received by HTTP servers must not exceed 8192 bytes
in total to prevent possible Denial of Service attacks.
(CVE-2018-12121.patch - CVE-2018-12121, bsc#1117626)
+ A timeout of 40 seconds now applies to servers receiving
HTTP headers. This value can be adjusted with
server.headersTimeout. Where headers are not completely
received within this period, the socket is destroyed on
the next received chunk. In conjunction with
server.setTimeout(), this aids in protecting against
excessive resource retention and possible Denial of Service.
(CVE-2018-12122.patch - CVE-2018-12122, bsc#1117627)
+ Two-byte characters are now strictly disallowed for the path
option in HTTP client requests. Paths containing characters
outside of the range \\u0021 - \\u00ff will now be rejected
with a TypeError. This behavior can be reverted if necessary
by supplying the --security-revert=CVE-2018-12116 command
line argument (this is not recommended).
(CVE-2018-12116.patch - CVE-2018-12116, bsc#1117630)
* util: Fix a bug that would allow a hostname being spoofed when
parsing URLs with url.parse() with the \'javascript:\' protocol.
(CVE-2018-12123.patch - CVE-2018-12123, bnc#1117629)
- env_shebang.patch: dropped in favour of programmatic update
Mon Nov 26 13:00:00 2018 adam.majerAATTsuse.de
- flaky_test_rerun.patch: Rerun failing tests in case of flakiness
Fri Oct 5 14:00:00 2018 adam.majerAATTsuse.de
- fix_ci_tests.patch: skip parallel/test-tick-processor on arm.
Unreliable test in shared environment.
- enable unit tests build failures
Mon Oct 1 14:00:00 2018 adam.majerAATTsuse.de
- test-ca-bumps.patch: update certificates used in unit tests
Thu Aug 23 14:00:00 2018 adam.majerAATTsuse.de
- CVE-2018-12115.patch: buffer: avoid overrun on UCS-2 string write
(CVE-2018-12115, bsc#1105019)
- openssl_1_0_2p.patch: deps: Upgrade to OpenSSL 1.0.2p, fixing:
* Client DoS due to large DH parameter (CVE-2018-0732, bsc#1097158)
* ECDSA key extraction via local side-channel
Sun Jul 29 14:00:00 2018 jengelhAATTinai.de
- Ensure neutrality of description.
- Use %make_install.
Fri Jun 15 14:00:00 2018 adam.majerAATTsuse.de
- Recommend same major version npm package (bsc#1097748)
Thu May 24 14:00:00 2018 adam.majerAATTsuse.de
- env_shebang.patch: use absolute paths in executable shebang lines
- versioned.patch: updated to move shebang modifications to above
patch.
Fri May 11 14:00:00 2018 adam.majerAATTsuse.de
- icu_61_namespacefix.patch: Fix building with ICU61.1 (bsc#1091764)
Thu Apr 5 14:00:00 2018 adam.majerAATTsuse.de
- Install license with %license, not %doc (bsc#1082318)
Wed Apr 4 14:00:00 2018 adam.majerAATTsuse.de
- Fix some node-gyp permissions
Tue Apr 3 14:00:00 2018 adam.majerAATTsuse.de
- New upstream maintenance 4.9.1:
* Security fixes:
+ Fix for \'path\' module regular expression denial of service
(bsc#1087459, CVE-2018-7158)
+ Reject spaces in HTTP Content-Length header values
(bsc#1087453, CVE-2018-7159)
* Upgrade to OpenSSL 1.0.2o
* deps: reject interior blanks in Content-Length
* deps: upgrade http-parser to v2.8.0
- fix_ci_tests.patch: refreshed
Thu Mar 22 13:00:00 2018 adam.majerAATTsuse.de
- remove any old manpage files in %pre from before update-alternatives
were used to manage symlinks to these manpages.
Tue Feb 13 13:00:00 2018 adam.majerAATTsuse.de
- Add Recommends and BuildRequire on python2 for npm. node-gyp
requires this old version of python for now. This is only needed
for binary modules.
Tue Jan 30 13:00:00 2018 roAATTsuse.de
- even on recent codestreams there is no binutils gold on s390
only on s390x
Thu Dec 21 13:00:00 2017 adam.majerAATTsuse.de
- Enable CI tests in %check target
+ fix_ci_ssl_tests.patch: Disable testing of obsolete curves
which are not enabled OpenSUSE\'s OpenSSL library
+ fix_ci_tests.patch:
- DNS queries in buildroots are failing with EAI_AGAIN
- disable test-module-loading-globalpaths.js - we have
hardcoded global paths
+ versioned.patch: call versioned node binary for tests
Sat Dec 9 13:00:00 2017 qantas94heavyAATTgmail.com
- New upstream maintenance release 4.8.7:
* deps/openssl: updated to 1.0.2n (only applies to SLE 12 SP1
and lower) (bsc#1072322)
[ CVE-2017-3738 CVE-2017-15896 ]
- Remove unnecessary curl BuildRequires
Wed Nov 29 13:00:00 2017 qantas94heavyAATTgmail.com
- Change BuildRequires from openssl-devel to libopenssl-1_0_0-devel
due to Tumbleweed/Leap 15 change to OpenSSL 1.1.0 as default
Thu Nov 16 13:00:00 2017 adam.majerAATTsuse.de
- Update nodejs.keyring based on current Release Team as found on
https://github.com/nodejs/node#release-team
Mon Nov 13 13:00:00 2017 adam.majerAATTsuse.de
- Fix permissions of node-gyp. This should be executable to allow
building of binary node modules.
Mon Nov 13 13:00:00 2017 adam.majerAATTsuse.de
- New upstream maintenance release 4.8.6:
* crypto: upgrade openssl sources to 1.0.2m
[OpenSSL Security Advisory (bsc#1066242, bsc#1056058)
CVE-2017-3735 CVE-2017-3736]
* deps: add support for more modern versions of INTL
- 0f3e69db.patch: removed, upstreamed
- icu59.patch: removed, upstreamed
Wed Oct 25 14:00:00 2017 qantas94heavyAATTgmail.com
- New upstream maintenance release 4.8.5:
* zlib: (CVE-2017-14919: only affects TW) In zlib v1.2.9, a
change was made that causes an exception to be thrown when a
raw deflate stream is initialized with windowBits set to 8.
Node.js will now gracefully set windowBits to 9 (replicating
the legacy behavior) to avoid a DOS vector.
Thu Oct 19 14:00:00 2017 adam.majerAATTsuse.de
- Replace {{node_version_major}} with RPM define %node_version_number
for simpler spec file review.
- Make sure npm program remains executable
Wed Aug 2 14:00:00 2017 adam.majerAATTsuse.de
- Fix update-alternative handling in %postun - don\'t remove
links on upgrades.
Wed Jul 12 14:00:00 2017 adam.majerAATTsuse.de
- New LTS upstream version 4.8.4
* v8: disable V8 snapshots. The hashseed embedded in the snapshot
is currently the same for all runs of the binary. This opens
node up to collision attacks which could result in a Denial
of Service. We have temporarily disabled snapshots until a more
robust solution is found (bnc#1048299, CVE-2017-11499).
* http: fixes http.get with numeric authorization options that
created/used uninitialized buffers as the authentication string
* The c-ares function ares_parse_naptr_reply(), which is used for
parsing NAPTR responses, could be triggered to read memory
outside of the given input buffer if the passed in DNS response
packet was crafted in a particular way.
(CVE-2017-1000381, bnc#1044946)
Fri Jul 7 14:00:00 2017 adam.majerAATTsuse.de
- Depend on nodejs-common that is then used to pick correctly
versioned node or npm binary. This is required since 3rd party
modules use `/usr/bin/env node` which breaks if multiple versions
of NodeJS are installed at the same time and non-default version
is used (for example, to compile a native module)
Thu Jul 6 14:00:00 2017 adam.majerAATTsuse.de
- npm_search_paths.patch: Since concurrent installations are now
possible, node manual pages are moved once again back under npm
searcheable locations only.
- versioned.patch: All files are now under versioned directoies
and names. node and npm symlinks are now managed by
update-alternatives
- node-gyp-addon-gypi.patch: Reference versioned directories only
Tue Jun 13 14:00:00 2017 adam.majerAATTsuse.de
- Fix typo in node-gyp-addon-gypi.patch patch
Tue May 30 14:00:00 2017 adam.majerAATTsuse.de
- 0f3e69db.patch, icu59.patch: GCC 7 compilation fixes for v8
backported and add missing ICU59 headers (bnc#1041283)
Tue May 23 14:00:00 2017 adam.majerAATTsuse.de
- New upstream LTS release 4.8.3
* v8: trigger OOM crash if memory allocation fails
* src: fix base64 decoding in rare edgecase
* tls:
+ fix segfault on destroy after partial read
+ keep track of stream that is closed
+ TLSSocket emits \'error\' on handshake failure
- nodejs-libpath.patch: updated
Wed Apr 5 14:00:00 2017 qantas94heavyAATTgmail.com
- New upstream maintenance release 4.8.2
* crypto: fix memory leak if certificate is revoked (#12089)
- Changes not applicable to openSUSE in 4.8.2:
* deps: upgrade zlib to 1.2.11 (#10980)
- Changes in LTS release 4.8.1
* buffer: The performance of .toJSON() is now up to 2859% faster
on average.
* IPC: Batched writes have been enabled for process IPC on
platforms that support Unix Domain Sockets. Performance gains
may be up to 40% for some workloads.
* http: Control characters are now always rejected when using
http.request().
* node: Heap statistics now support values larger than 4GB.
- Modify 8334.diff:
* Bring patch in line with upstream changes (#8334)
Sun Feb 26 13:00:00 2017 qantas94heavyAATTgmail.com
- New upstream LTS release 4.8.0
* child_process: add shell option to spawn()
* crypto: add ALPN Support
* crypto: allow adding extra certs to well-known CAs
* deps/v8: expose statistics about heap spaces
* fs: add the fs.mkdtemp() function
* process: add process.memoryUsage().external
* process: add process.cpuUsage()
- Modify 8334.diff:
* Remove merged reference counting code (#9409)
Fri Feb 3 13:00:00 2017 adam.majerAATTsuse.de
- New upstream LTS release 4.7.3
* deps: upgrade openssl sources to 1.0.2k
(CVE-2017-3731, CVE-2017-3732, CVE-2016-7055,
bnc#1022085, bnc#1022086, bnc#1009528)
- No changes in LTS version 4.7.2
- Adjusted 8334.diff to be inline with accepted changes
- Merge nodejs4.changes from SLE and devel project
Fri Jan 6 13:00:00 2017 qantas94heavyAATTgmail.com
- Add basic check that Node.js loads successfully to spec file
Wed Jan 4 13:00:00 2017 qantas94heavyAATTgmail.com
- New upstream LTS release 4.7.1
* build: shared library support is now working for AIX builds
* repl: passing options to the repl will no longer overwrite
defaults
* timers: recanceling a cancelled timers will no longer throw
Fri Dec 9 13:00:00 2016 qantas94heavyAATTgmail.com
- New upstream LTS version 4.7.0
* build: introduce the configure --shared option for embedders
* debugger: make listen address configurable in debugger server
* dgram: generalized send queue to handle close, fixing a
potential throw when dgram socket is closed in the
listening event handler
* http: introduce the 451 status code \"Unavailable For
Legal Reasons\"
* gtest: the test reporter now outputs tap comments as yamlish
* tls: introduce secureContext for tls.connect (useful for
caching client certificates, key, and CA certificates)
* tls: fix memory leak when writing data to TLSWrap instance
during handshake
* src: node no longer aborts when c-ares initialization fails
- Modify 8334.diff:
* ported and updated system CA store for the new node crypto code
- Refresh nodejs-libpath.patch
Thu Dec 1 13:00:00 2016 qantas94heavyAATTgmail.com
- New upstream LTS version 4.6.2
* build:
+ It is now possible to build the documentation from the release tarball.
* buffer:
+ Buffer.alloc() will no longer incorrectly return a zero filled buffer
when an encoding is passed.
* deps:
+ Upgrade npm in LTS to 2.15.11.
* repl:
+ Enable tab completion for global properties.
* url:
+ url.format() will now encode all \"#\" in search.
Wed Nov 23 13:00:00 2016 adam.majerAATTsuse.de
- Add missing conflicts to base package. It\'s not possible to have
concurrent nodejs installations.
Fri Nov 18 13:00:00 2016 adam.majerAATTsuse.de
- Package unification across various branches of NodeJS. Package
for 4.x, 6.x and current (7.x) branches of NodeJS are now
handled via GitHub repository.
- remove support-arm64-build.patch: no longer required
- remove nodejs-libpath64.patch: obsolete
Tue Nov 8 13:00:00 2016 adam.majerAATTsuse.de
- npm4 should provide versioned nodejs-npm and npm allowing
nodejs-packaging to continue to function properly in Leap 42.2
(bnc #1009011)
Wed Oct 19 14:00:00 2016 qantas94heavyAATTgmail.com
- New upstream LTS version 4.6.1
* c-ares: fix for single-byte buffer overwrite, CVE-2016-5180
more information at https://c-ares.haxx.se/adv_20160929.html
(bnc #1007728)
Tue Oct 4 14:00:00 2016 adam.majerAATTsuse.de
- npm4 now provides nodejs-npm to ease upgrades for Leap
Thu Sep 29 14:00:00 2016 adam.majerAATTsuse.de
- enable usage of system certificate store on SLE11SP4 by
requiring openssl1 (boo#1000036)
- nodejs-libpath.patch:
* adapt patch from main nodejs project so it builds on SLE11
- New upstream LTS version 4.6.0
* openssl update (not applicable for SLE12SP2, Leap 42.2 and later)
+ upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178,
CVE-2016-6306, CVE-2016-7052)
+ remove support for dynamic 3rd party engine modules
* http: Properly validate for allowable characters in input
user data. This introduces a new case where throw may occur
when configuring HTTP responses, users should already
be adopting try/catch here. (CVE-2016-5325, bnc#985201)
* tls: properly validate wildcard certificates
(CVE-2016-7099, bnc#1001652)
* buffer: Zero-fill excess bytes in new Buffer objects created
with Buffer.concat()
Fri Aug 26 14:00:00 2016 adam.majerAATTsuse.de
- New upstream LTS version 4.5.0 (bnc#997405)
* buffer:
+ backport new buffer constructor APIs to v4.x
+ backport --zero-fill-buffers cli option
+ ignore negative allocation lengths
* build
+ add Intel Vtune profiling support
* repl
+ copying tabs shouldn\'t trigger completion
* src
+ add node::FreeEnvironment public API
* test
+ run v8 tests from node tree
* V8
+ Add post mortem data to improve object inspection and
function\'s context variables inspection
* upgrade libuv to 1.9.1
* upgrade npm to 2.15.9
- 8334.diff
* use system CA store instead of one provided by Node
- Refresh patches
Wed Aug 10 14:00:00 2016 adam.majerAATTsuse.de
- use system OpenSSL with Leap 42.2 and SLE12:SP2
- simplify source code integrity check
+ use GPG service instead of explicit BR
+ add empty checksum so GPG service is run - it\'s not detached signature
like it thinks it is.
Mon Jul 4 14:00:00 2016 adam.majerAATTsuse.de
- rename patches to have a .patch suffix, for consistancy
- npm_search_paths.patch:
Change defaultPrefix to /usr/local if it is detected to be
/usr. This is in attempt to prevent globally installed npm-managed
packages from installing into the zypper managed prefix.
- refreshed patches support-arm64-build.patch
- use upstream .xz instead of .gz tarball
Fri Jul 1 14:00:00 2016 adam.majerAATTsuse.de
- New upstream version 4.4.7
* debugger:
+ All properties of an array (aside from length) can now be printed
in the repl
* Upgrade npm to 2.15.8 (Rebecca Turner)
* Fix for a bug that became more prevalent with the stream changes
that landed in v4.4.5. (Anna Henningsen). \'reset awaitDrain after manual
.resume()\'
* V8:
+ Fix for a bug in crankshaft that was causing crashes on arm64
(Myles Borins)
+ Add missing classes to postmortem info such as JSMap and JSSet
(evan.lucas)
- Add upstream release keyring
- Verify upstream sources during %prep
Mon Jun 27 14:00:00 2016 adam.majerAATTsuse.de
- Use build flags to enable/disable gdb usage instead of
configure script. Easier to find and change in future.
- Fix paths, and have to fix lots of paths because they
are all more or less hardcoded relative paths.
- Renumber patches allowing upstream patches to be inserted
before our own.
Fri Jun 24 14:00:00 2016 adam.majerAATTsuse.de
- New upstream version 4.4.6
+ fix buffer overflow vulnerability discovered in v8
(CVE-2016-1669)
Thu Jun 16 14:00:00 2016 adam.majerAATTsuse.de
- Change detection of library paths from runtime to compile time.
nodejs-libpath.patch, nodejs-libpath64.patch
Wed Jun 15 14:00:00 2016 adam.majerAATTsuse.de
- This package is in response to FATE#320396 and ECO#317945
and references bnc#958943
It\'s to be part of Web and Scripting Module
- Use build conditional for intree_openssl
- Fix permissions of some supplies javascript files - they are
not executables
- General cleanup of the package
Wed Jun 15 14:00:00 2016 adam.majerAATTsuse.de
- Tighten dependencies so we don\'t end up with mixed versions
installed.
Tue Jun 14 14:00:00 2016 adam.majerAATTsuse.de
- Dedup manpages
- Conflict with other providers of NodeJS packages. This is
important if we want to provide NodeJS v6.x branch along with
v4.x branch
Mon Jun 6 14:00:00 2016 adam.majerAATTsuse.de
- \'New\' package of 4.x LTS branch of NodeJS, based on v6.2.1
from Tumbleweed
- Fix search paths to actually look where modules are installed
