Commit Graph

682 Commits

Author SHA1 Message Date
Mario Rodas
fc4810bfca nodejs_20: 20.3.1 -> 20.4.0
Changelog: https://github.com/nodejs/node/releases/tag/v20.4.0
2023-07-06 04:20:00 +00:00
Pol Dellaiera
4968ffb38a pkgs/top-level/release: allow nodejs 16.20.1 to be cached on Hydra temporarily 2023-06-23 18:06:16 +02:00
Mario Rodas
12bbce3e6c nodejs_20: 20.3.0 -> 20.3.1
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
- CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
- CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
- CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
- CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

https://github.com/nodejs/node/releases/tag/v20.3.1
2023-06-21 04:20:00 +00:00
Mario Rodas
75f22e0d83 nodejs_18: 18.16.0 -> 18.16.1
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

https://github.com/nodejs/node/releases/tag/v18.16.1
2023-06-21 04:20:00 +00:00
Mario Rodas
805e754620 nodejs_16: 16.20.0 -> 16.20.1
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

https://github.com/nodejs/node/releases/tag/v16.20.1
2023-06-21 04:20:00 +00:00
github-actions[bot]
622850f61f
Merge staging-next into staging 2023-06-09 18:01:50 +00:00
Mario Rodas
42754a724d nodejs_20: 20.2.0 -> 20.3.0
https://github.com/nodejs/node/releases/tag/v20.3.0
2023-06-09 04:20:00 +00:00
Cheng Shao
204136bd95 nodejs: add -licuuc to libv8 pkg-config file
-licuuc is required when linking against libv8 output of nodejs.
2023-05-30 09:37:53 +00:00
Lily Foster
9f6f397165
Merge pull request #206477 from winterqt/build-npm-package-patch-npm
buildNpmPackage: patch npm to work around various roadblocks
2023-05-21 11:16:56 -04:00
Lily Foster
dd23a1203c
nodejs_16: add helper patch for buildNpmPackage 2023-05-20 18:29:43 -04:00
Lily Foster
47efc60157
nodejs: add helper patch for buildNpmPackage 2023-05-20 18:29:36 -04:00
Martin Weinelt
b7a9deb5bd
Merge pull request #229910 from helsinki-systems/nodejs-14-insecure
nodejs_14: is EOL on 2023-04-30, nodejs_16: goes EOL during 23.05 release
2023-05-19 15:21:59 +02:00
Mario Rodas
b1c0f3bec2 nodejs_19: drop
Node.js 19 reaches End-of-Life on 2023-06-01.
2023-05-17 04:20:00 +00:00
Mario Rodas
793d346304 nodejs_20: 20.1.0 -> 20.2.0
https://github.com/nodejs/node/releases/tag/v20.2.0
2023-05-17 04:20:00 +00:00
Theo Paris
025062c31f
nodejs: 20.0.0 -> 20.1.0 (#229774) 2023-05-08 16:41:06 +02:00
ajs124
f68ae132f8 nodejs_16: also mark EOL
because it will reach its EOL 2023-09-11, before the EOL of NixOS 23.05
2023-05-08 13:35:13 +02:00
ajs124
f75ad820a1 nodejs_14: is EOL on 2023-04-30 2023-05-04 16:30:11 +02:00
github-actions[bot]
e4b6ca8521
Merge master into staging-next 2023-04-20 18:01:06 +00:00
Jamie Magee
7c1f952db3
nodejs-20_x: init at 20.0.0 2023-04-19 21:36:44 -07:00
github-actions[bot]
6176f16de2
Merge staging-next into staging 2023-04-14 12:02:03 +00:00
Sergei Trofimovich
916d029b63
Merge pull request #225264 from trofi/nodejs-no-CA
nodejs: explicitly disable __contentAddressed
2023-04-14 08:53:08 +01:00
Mario Rodas
aae28d05fe nodejs-18_x: 18.15.0 -> 18.16.0
https://github.com/nodejs/node/releases/tag/v18.16.0
2023-04-13 04:20:00 +00:00
Mario Rodas
53a1930a17 nodejs-19_x: 19.8.1 -> 19.9.0
https://github.com/nodejs/node/releases/tag/v19.9.0
2023-04-10 04:20:00 +00:00
Sergei Trofimovich
5eea756074 nodejs: explicitly disable __contentAddressed
Without the change attempt to enable content addressing on nodejs
breaks the `nodejs` binary:

    $ nix build -f. nodejs --arg config '{ contentAddressedByDefault = true; }'
    $ LANG=C ./result/bin/node
    #
    # Fatal error in , line 0
    # Check failed: VerifyChecksum(blob).
    #
    #
    #
    #FailureMessage Object: 0x7ffce2820790
     1: 0xb2a2c5  [./result/bin/node]
     2: 0x1866d9a V8_Fatal(char const*, ...) [./result/bin/node]
     3: 0x12d7473 v8::internal::Snapshot::Initialize(v8::internal::Isolate*) [./result/bin/node]
     4: 0xce85e6 v8::Isolate::Initialize(v8::Isolate*, v8::Isolate::CreateParams const&) [./result/bin/node]
     5: 0x9e0614 node::NewIsolate(v8::Isolate::CreateParams*, uv_loop_s*, node::MultiIsolatePlatform*, bool) [./result/bin/node]
     6: 0xafdcb2 node::NodeMainInstance::NodeMainInstance(node::SnapshotData const*, uv_loop_s*, node::MultiIsolatePlatform*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) [./result/bin/node]
     7: 0xa670a3 node::LoadSnapshotDataAndRun(node::SnapshotData const**, node::InitializationResult const*) [./result/bin/node]
     8: 0xa6ac9c node::Start(int, char**) [./result/bin/node]
     9: 0x7f2b7002924e  [/nix/store/h9w6fix9k2lrbc05p4a6inw2r9sywlb1-glibc-2.35-224/lib/libc.so.6]
    10: 0x7f2b70029309 __libc_start_main [/nix/store/h9w6fix9k2lrbc05p4a6inw2r9sywlb1-glibc-2.35-224/lib/libc.so.6]
    11: 0x9da7f5 _start [./result/bin/node]
    Trace/breakpoint trap (core dumped)

Let's override the default by always disable content addressing.
2023-04-08 07:54:46 +01:00
Mario Rodas
05c41a9b3c nodejs-16_x: 16.19.1 -> 16.20.0
https://github.com/nodejs/node/releases/tag/v16.20.0
2023-03-30 04:20:00 +00:00
github-actions[bot]
80a0ae17b5
Merge master into staging-next 2023-03-16 12:01:29 +00:00
github-actions[bot]
b28670c667
Merge staging-next into staging 2023-03-15 12:02:01 +00:00
Mario Rodas
f8cf72796e nodejs-19_x: 19.8.0 -> 19.8.1
https://github.com/nodejs/node/releases/tag/v19.8.1
2023-03-15 04:20:00 +00:00
Mario Rodas
50982761c0 nodejs-19_x: 19.7.0 -> 19.8.0
https://github.com/nodejs/node/releases/tag/v19.8.0
2023-03-14 04:20:00 +00:00
Mario Rodas
708dcbce92 nodejs-18_x: 18.14.2 -> 18.15.0
https://github.com/nodejs/node/releases/tag/v18.15.0
2023-03-07 04:20:00 +00:00
Mario Rodas
78b645172f nodejs-19_x: 19.6.1 -> 19.7.0
https://github.com/nodejs/node/releases/tag/v19.7.0
2023-02-21 04:20:00 +00:00
Mario Rodas
4a5744b789 nodejs-18_x: 18.14.1 -> 18.14.2
https://github.com/nodejs/node/releases/tag/v18.14.2
2023-02-21 04:20:00 +00:00
Mario Rodas
d42631d6c5 nodejs-19_x: 19.6.0 -> 19.6.1
https://github.com/nodejs/node/releases/tag/v19.6.1
2023-02-17 04:20:00 +00:00
Mario Rodas
cfdcb8d7fa nodejs-18_x: 18.14.0 -> 18.14.1
https://github.com/nodejs/node/releases/tag/v18.14.1
2023-02-17 04:20:00 +00:00
Mario Rodas
4313c6360f nodejs-16_x: 16.19.0 -> 16.19.1
https://github.com/nodejs/node/releases/tag/v16.19.1
2023-02-17 04:20:00 +00:00
Mario Rodas
0037110278 nodejs-14_x: 14.21.2 -> 14.21.3
https://github.com/nodejs/node/releases/tag/v14.21.3
2023-02-17 04:20:00 +00:00
Vladimír Čunát
d0d8c15bad
Merge branch 'master' into staging-next
pkgs/development/web/nodejs/v18.nix conflict:
  the fetched patch was already included in this release.
2023-02-03 23:02:19 +01:00
Mario Rodas
bb6c33b6bd nodejs-19_x: 19.5.0 -> 19.6.0
https://github.com/nodejs/node/releases/tag/v19.6.0
2023-02-03 04:20:00 +00:00
Mario Rodas
4a53b3bede nodejs-18_x: 18.13.0 -> 18.14.0
https://github.com/nodejs/node/releases/tag/v18.14.0
2023-02-03 04:20:00 +00:00
github-actions[bot]
e11b11e738
Merge staging-next into staging 2023-01-27 12:01:56 +00:00
Shawn8901
a59dda942c treewide: remove global with lib; statements in pkgs/development 2023-01-26 18:31:02 +01:00
github-actions[bot]
588d9ab6e2
Merge staging-next into staging 2023-01-25 12:02:09 +00:00
Mario Rodas
6e0448abf7 nodejs-19_x: 19.4.0 -> 19.5.0
https://github.com/nodejs/node/releases/tag/v19.5.0
2023-01-24 04:20:00 +00:00
Zhaofeng Li
d62bfb194d nodejs: Fix build on RISC-V 2023-01-23 14:16:29 -07:00
Guillaume Girol
33afbf39f6 treewide: switch to nativeCheckInputs
checkInputs used to be added to nativeBuildInputs. Now we have
nativeCheckInputs to do that instead. Doing this treewide change allows
to keep hashes identical to before the introduction of
nativeCheckInputs.
2023-01-21 12:00:00 +00:00
Anthony Roussel
ba5367b708
nodejs-19_x: 19.2.0 -> 19.4.0 2023-01-13 17:32:18 +01:00
Anthony Roussel
7146e2a152
nodejs-18_x: 18.12.1 -> 18.13.0 2023-01-13 17:27:25 +01:00
Anthony Roussel
920bb038e9
nodejs-16_x: 16.18.1 -> 16.19.0 2023-01-13 17:27:24 +01:00
Anthony Roussel
275ddaec53
nodejs-14_x: 14.21.1 -> 14.21.2 2023-01-13 17:27:24 +01:00
Winter
6a5211f123 nodejs-{16,18,19}_x: backport npm pack fixes from npm v9 2022-12-13 19:40:27 -05:00