kumquat-buildroot/package/nodejs/nodejs.hash

# From https://nodejs.org/dist/v10.15.3/SHASUMS256.txt
sha256 4e22d926f054150002055474e452ed6cbb85860aa7dc5422213a2002ed9791d5  node-v10.15.3.tar.xz

# Hash for license file
sha256 b87be6c1479ed977481115869c2dd8b6d59e5ea55aa09939d6c898242121b2f5  LICENSE
package/nodejs: bump version to 10.15.3 See https://nodejs.org/en/blog/release/v10.15.3/ The host tool "torque" is unfortunately not built by complying to our LDFLAGS, so it is not built with the proper RPATH. We fix that using patchelf, and install it to $(HOST_DIR) to make it available during the build of the target nodejs. Signed-off-by: Martin Bark <martin@barkynet.com> [Thomas: - add explanation in the commit log about torque - install torque in $(HOST_DIR)/bin and not $(HOST_DIR)/usr/bin] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2019-03-14 14:38:11 +01:00			`# From https://nodejs.org/dist/v10.15.3/SHASUMS256.txt`
			`sha256 4e22d926f054150002055474e452ed6cbb85860aa7dc5422213a2002ed9791d5 node-v10.15.3.tar.xz`
nodejs: security bump to version 8.11.1 Fixes the following security issues: - Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6. - Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions. - Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values. While we are at it, also add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2018-03-31 08:11:55 +02:00
			`# Hash for license file`
			`sha256 b87be6c1479ed977481115869c2dd8b6d59e5ea55aa09939d6c898242121b2f5 LICENSE`