Explorar o código

package/nodejs: security bump to version 22.15.1

Fixes the following security issues:

- CVE-2025-23166: Improper error handling in async cryptographic operations
  crashes process

- CVE-2025-23165: Corrupted pointer in node::fs::ReadFileUtf8(const
  FunctionCallbackInfo<Value>& args) when args[0] is a string

https://nodejs.org/en/blog/vulnerability/may-2025-security-releases

Update the license hash for the addition of zstd 1.5.6 (BSD-3-Clause):
https://github.com/nodejs/node/commit/f9f611fb584ca2ace35df2669204e7de6a92ea26

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c84fcef123b94a2f66226bc946dbe251126393a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Peter Korsgaard hai 2 meses
pai
achega
11547707dd
Modificáronse 2 ficheiros con 8 adicións e 8 borrados
  1. 7 7
      package/nodejs/nodejs.hash
  2. 1 1
      package/nodejs/nodejs.mk

+ 7 - 7
package/nodejs/nodejs.hash

@@ -1,8 +1,8 @@
-# From https://nodejs.org/dist/v22.13.1/SHASUMS256.txt.asc
-sha256  0a237c413ccbab920640438bf6e1a32edb19845bdc21f0e1cd5b91545ce1c126  node-v22.13.1-linux-arm64.tar.xz
-sha256  f2be8dca2a7a518f6d187aa4b18abbeeafd71096a6d95f73f4d8bc0f8d2394ea  node-v22.13.1-linux-armv7l.tar.xz
-sha256  377a7a1ea66f39251e1657f419e9404d526fcca9910620d0ecf0a870c6308f6b  node-v22.13.1-linux-ppc64le.tar.xz
-sha256  0d2a5af33c7deab5555c8309cd3f373446fe1526c1b95833935ab3f019733b3b  node-v22.13.1-linux-x64.tar.xz
-sha256  cfce282119390f7e0c2220410924428e90dadcb2df1744c0c4a0e7baae387cc2  node-v22.13.1.tar.xz
+# From https://nodejs.org/dist/v22.15.1/SHASUMS256.txt.asc
+sha256  f4ae8ddf7487dfaf7da92fef463ee55cc29d8772d62891361dc3fc8b8e469205  node-v22.15.1-linux-arm64.tar.xz
+sha256  6947386b4c8373b625c6a49b5571bf2226dac7c7b560a9a561a1f81bf71a25ef  node-v22.15.1-linux-armv7l.tar.xz
+sha256  da07858c6404dbe7c627bd7baea33c7825640652ad24468a6feb23c770cf7ce4  node-v22.15.1-linux-ppc64le.tar.xz
+sha256  7dca2ab34ec817aa4781e2e99dfd34d349eff9be86e5d5fbaa7e96cae8ee3179  node-v22.15.1-linux-x64.tar.xz
+sha256  c19f0177d21c621746625e5f37590bd0d79a72043b77b53784cba5f145e7263e  node-v22.15.1.tar.xz
 # Locally calculated
-sha256  9d72cce9b104ecb67feb8af38618511685190ae5a119cc0488ecae66b221000d  LICENSE
+sha256  1ae62e2015784ba438db7b04ebd33f3c4ff3efdb824c111c4ececd99945fd52d  LICENSE

+ 1 - 1
package/nodejs/nodejs.mk

@@ -5,7 +5,7 @@
 ################################################################################
 
 # _VERSION, _SOURCE and _SITE must be kept empty to avoid downloading anything
-NODEJS_COMMON_VERSION = 22.13.1
+NODEJS_COMMON_VERSION = 22.15.1
 NODEJS_COMMON_SOURCE = node-v$(NODEJS_COMMON_VERSION).tar.xz
 NODEJS_COMMON_SITE = http://nodejs.org/dist/v$(NODEJS_COMMON_VERSION)