CVS commit: pkgsrc/lang/nodejs12

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Jul  6 07:04:11 UTC 2021

Modified Files:
        pkgsrc/lang/nodejs12: Makefile distinfo

Log Message:
nodejs12: updated to 12.22.3

Version 12.22.3 'Erbium' (LTS)

Notable Changes

Node.js 12.22.2 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows 
installer.

Version 12.22.2 'Erbium' (LTS)

This is a security release.

Notable Changes

Vulnerabilities fixed:

CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to 
information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918

CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory 
allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921

CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High)
This is a vulnerability in the ssri npm mudule which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq

CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium)
This is a vulnerability in the hosted-git-info npm mudule which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362


To generate a diff of this commit:
cvs rdiff -u -r1.34 -r1.35 pkgsrc/lang/nodejs12/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/lang/nodejs12/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/nodejs12/Makefile
diff -u pkgsrc/lang/nodejs12/Makefile:1.34 pkgsrc/lang/nodejs12/Makefile:1.35
--- pkgsrc/lang/nodejs12/Makefile:1.34  Thu Jun 24 09:31:26 2021
+++ pkgsrc/lang/nodejs12/Makefile       Tue Jul  6 07:04:11 2021
@@ -1,11 +1,10 @@
-# $NetBSD: Makefile,v 1.34 2021/06/24 09:31:26 adam Exp $
+# $NetBSD: Makefile,v 1.35 2021/07/06 07:04:11 adam Exp $
 
-DISTNAME=      node-v12.22.1
+DISTNAME=      node-v12.22.3
 EXTRACT_SUFX=  .tar.xz
 
 USE_LANGUAGES= c gnu++14
 
-PKGREVISION= 2
 .include "../../mk/bsd.prefs.mk"
 
 # XXX: figure out a way to add rpaths to torque

Index: pkgsrc/lang/nodejs12/distinfo
diff -u pkgsrc/lang/nodejs12/distinfo:1.23 pkgsrc/lang/nodejs12/distinfo:1.24
--- pkgsrc/lang/nodejs12/distinfo:1.23  Wed Apr  7 06:21:06 2021
+++ pkgsrc/lang/nodejs12/distinfo       Tue Jul  6 07:04:11 2021
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.23 2021/04/07 06:21:06 adam Exp $
+$NetBSD: distinfo,v 1.24 2021/07/06 07:04:11 adam Exp $
 
-SHA1 (node-v12.22.1.tar.xz) = a4bd1a34dfb82960f098f3a9aab04470c0315581
-RMD160 (node-v12.22.1.tar.xz) = 840b4f5835a00136164d9950709957d476cf14bf
-SHA512 (node-v12.22.1.tar.xz) = eaead633611bda04ab9be200aeddf3b4004b8104e9c6af246023b8008003dd3a7103e1508ea690443e59c6591521b04a2d71c7344343f2a20d1c935ef51c66a0
-Size (node-v12.22.1.tar.xz) = 23650180 bytes
+SHA1 (node-v12.22.3.tar.xz) = 0cb24e343ce26a96b20799ec234e5abe44985faa
+RMD160 (node-v12.22.3.tar.xz) = d9d6526d038c0789299e0dd8b25edd2a25c3a872
+SHA512 (node-v12.22.3.tar.xz) = 11684b6df15b6b74b8674ebf2c2bb950d1e52b83f90478638e85dd11a163dc7c62ae888bc4c1c29e89179e0c47fdccc26bee2817d64eb3ff926b2d3e648c351c
+Size (node-v12.22.3.tar.xz) = 23662268 bytes
 SHA1 (patch-common.gypi) = a3fa3b5b974f910b3c8fea640ded4dca262e1ba8
 SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32
 SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3