CVS commit: [pkgsrc-2026Q2] pkgsrc/lang/nodejs22

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Mon Jul 13 13:40:46 UTC 2026

Modified Files:
        pkgsrc/lang/nodejs22 [pkgsrc-2026Q2]: Makefile distinfo

Log Message:
Pullup ticket #7155 - requested by taca
lang/nodejs22: security fix

Revisions pulled up:
- lang/nodejs22/Makefile                                        1.24
- lang/nodejs22/distinfo                                        1.22

---
   Module Name: pkgsrc
   Committed By:        adam
   Date:                Mon Jun 22 08:56:21 UTC 2026

   Modified Files:
        pkgsrc/lang/nodejs22: Makefile distinfo

   Log Message:
   nodejs22: updated to 22.23.0

   22.23.0 'Jod' (LTS)

   Notable Changes

   (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
   (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
   (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
   (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
   (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
   (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
   (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
   (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
   (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
   (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
   (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low


To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.23.2.1 pkgsrc/lang/nodejs22/Makefile
cvs rdiff -u -r1.21 -r1.21.2.1 pkgsrc/lang/nodejs22/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/nodejs22/Makefile
diff -u pkgsrc/lang/nodejs22/Makefile:1.23 pkgsrc/lang/nodejs22/Makefile:1.23.2.1
--- pkgsrc/lang/nodejs22/Makefile:1.23  Fri May 22 08:06:31 2026
+++ pkgsrc/lang/nodejs22/Makefile       Mon Jul 13 13:40:46 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.23 2026/05/22 08:06:31 adam Exp $
+# $NetBSD: Makefile,v 1.23.2.1 2026/07/13 13:40:46 bsiegert Exp $
 
-DISTNAME=      node-v22.22.3
+DISTNAME=      node-v22.23.0
 EXTRACT_SUFX=  .tar.xz
 
 USE_LANGUAGES= c c++

Index: pkgsrc/lang/nodejs22/distinfo
diff -u pkgsrc/lang/nodejs22/distinfo:1.21 pkgsrc/lang/nodejs22/distinfo:1.21.2.1
--- pkgsrc/lang/nodejs22/distinfo:1.21  Fri May 22 08:06:31 2026
+++ pkgsrc/lang/nodejs22/distinfo       Mon Jul 13 13:40:46 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.21 2026/05/22 08:06:31 adam Exp $
+$NetBSD: distinfo,v 1.21.2.1 2026/07/13 13:40:46 bsiegert Exp $
 
-BLAKE2s (node-v22.22.3.tar.xz) = f9d9161faf78a8c477ab15c82652f362e6a43cfe5bf03d5d9187033a68723fad
-SHA512 (node-v22.22.3.tar.xz) = b5d3952772040c4de3865c147260a46fb53ab4e0fbf106172d4a2025de0ab02734bea91e4749d8937a20d70bd1b736a22447c308e34ef22dbfb51314328b83c2
-Size (node-v22.22.3.tar.xz) = 51315600 bytes
+BLAKE2s (node-v22.23.0.tar.xz) = 192ec4a87ecba4119ae3a8de52e7f65b9285176fd996b6df1f44c7da07d9e333
+SHA512 (node-v22.23.0.tar.xz) = bb8c7d03a616e0c45ff04df6ea377ff742ac99a6109cb1b441162dae0d9d52740701e0ac87f6d436de6b15216114e030453e99103e4e228f1401b392631a631d
+Size (node-v22.23.0.tar.xz) = 51343344 bytes
 SHA1 (patch-common.gypi) = 41fc3ddf9e43c0b0a3d6ef845e7ee2847f4e12ce
 SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32
 SHA1 (patch-deps_uv_common.gypi) = 29f0c382b68f77749a71ce39fa2ca37338ca18ec