[pkgsrc/trunk]: pkgsrc/lang/nodejs12 nodejs12: updated to 12.22.3

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/c0abb0382094
branches:  trunk
changeset: 455552:c0abb0382094
user:      adam <adam%pkgsrc.org@localhost>
date:      Tue Jul 06 07:04:11 2021 +0000

description:
nodejs12: updated to 12.22.3

Version 12.22.3 'Erbium' (LTS)

Notable Changes

Node.js 12.22.2 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows 
installer.


Version 12.22.2 'Erbium' (LTS)

This is a security release.

Notable Changes

Vulnerabilities fixed:

CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to 
information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918

CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory 
allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921

CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High)
This is a vulnerability in the ssri npm mudule which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq

CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium)
This is a vulnerability in the hosted-git-info npm mudule which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362

diffstat:

 lang/nodejs12/Makefile |   5 ++---
 lang/nodejs12/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 8 deletions(-)

diffs (35 lines):

diff -r 521b16beef6e -r c0abb0382094 lang/nodejs12/Makefile
--- a/lang/nodejs12/Makefile    Tue Jul 06 05:58:01 2021 +0000
+++ b/lang/nodejs12/Makefile    Tue Jul 06 07:04:11 2021 +0000
@@ -1,11 +1,10 @@
-# $NetBSD: Makefile,v 1.34 2021/06/24 09:31:26 adam Exp $
+# $NetBSD: Makefile,v 1.35 2021/07/06 07:04:11 adam Exp $
 
-DISTNAME=      node-v12.22.1
+DISTNAME=      node-v12.22.3
 EXTRACT_SUFX=  .tar.xz
 
 USE_LANGUAGES= c gnu++14
 
-PKGREVISION= 2
 .include "../../mk/bsd.prefs.mk"
 
 # XXX: figure out a way to add rpaths to torque
diff -r 521b16beef6e -r c0abb0382094 lang/nodejs12/distinfo
--- a/lang/nodejs12/distinfo    Tue Jul 06 05:58:01 2021 +0000
+++ b/lang/nodejs12/distinfo    Tue Jul 06 07:04:11 2021 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.23 2021/04/07 06:21:06 adam Exp $
+$NetBSD: distinfo,v 1.24 2021/07/06 07:04:11 adam Exp $
 
-SHA1 (node-v12.22.1.tar.xz) = a4bd1a34dfb82960f098f3a9aab04470c0315581
-RMD160 (node-v12.22.1.tar.xz) = 840b4f5835a00136164d9950709957d476cf14bf
-SHA512 (node-v12.22.1.tar.xz) = eaead633611bda04ab9be200aeddf3b4004b8104e9c6af246023b8008003dd3a7103e1508ea690443e59c6591521b04a2d71c7344343f2a20d1c935ef51c66a0
-Size (node-v12.22.1.tar.xz) = 23650180 bytes
+SHA1 (node-v12.22.3.tar.xz) = 0cb24e343ce26a96b20799ec234e5abe44985faa
+RMD160 (node-v12.22.3.tar.xz) = d9d6526d038c0789299e0dd8b25edd2a25c3a872
+SHA512 (node-v12.22.3.tar.xz) = 11684b6df15b6b74b8674ebf2c2bb950d1e52b83f90478638e85dd11a163dc7c62ae888bc4c1c29e89179e0c47fdccc26bee2817d64eb3ff926b2d3e648c351c
+Size (node-v12.22.3.tar.xz) = 23662268 bytes
 SHA1 (patch-common.gypi) = a3fa3b5b974f910b3c8fea640ded4dca262e1ba8
 SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32
 SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3