kumquat-buildroot/package/nodejs/nodejs.hash

# From https://nodejs.org/dist/v12.16.3/SHASUMS256.txt
sha256  f0559b0829c7f2ac10bf5b3e157e498227e95e26cdb6af814969c49f367359a3  node-v12.16.3.tar.xz

# Hash for license file
sha256  3f5749f7a58edaadd77843057a90063a18067f472d8b26c0a76905cafa1063e3  LICENSE
package/nodejs: bump to version 12.16.3 Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-05-08 00:43:21 +02:00			`# From https://nodejs.org/dist/v12.16.3/SHASUMS256.txt`
			`sha256 f0559b0829c7f2ac10bf5b3e157e498227e95e26cdb6af814969c49f367359a3 node-v12.16.3.tar.xz`
nodejs: security bump to version 8.11.1 Fixes the following security issues: - Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6. - Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions. - Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values. While we are at it, also add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2018-03-31 08:11:55 +02:00
			`# Hash for license file`
package/nodejs: security bump to version 12.16.0 Fixes the following security issues (12.15.0): - CVE-2019-15606: HTTP header values do not have trailing OWS trimmed - CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header - CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string For more details, see the advisory: https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/ On top of this, 12.16.0 brings a number of changes and bugfixes. Update the license hash for an addition of the (MIT) licensing terms for the uvwsai module: + +- uvwasi, located at deps/uvwasi, is licensed as follows: + """ + MIT License + + Copyright (c) 2019 Colin Ihrig and Contributors + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. + """ While we are at it, adjust the white space in the .hash function to match the new agreements. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-02-17 23:38:49 +01:00			`sha256 3f5749f7a58edaadd77843057a90063a18067f472d8b26c0a76905cafa1063e3 LICENSE`