From 643afd8977be40464ec2aed66972a754aa2585ac Mon Sep 17 00:00:00 2001 From: Hirokazu MORIKAWA Date: Thu, 23 Jan 2025 14:27:18 +0900 Subject: [PATCH] node: January 21, 2025 Security Releases This is a security release. Notable Changes CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High) CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium) CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium) Dependency update: CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium) Signed-off-by: Hirokazu MORIKAWA --- lang/node/Makefile | 6 ++--- lang/node/patches/003-path.patch | 2 +- lang/node/patches/200-uv_gyp.patch | 2 +- lang/node/patches/202-node_gyp.patch | 14 +++++++--- lang/node/patches/204-v8_gyp.patch | 26 +++++++++---------- .../999-fix_building_with_system_icu_76.patch | 25 ------------------ .../patches/999-localhost-no-addrconfig.patch | 2 +- ...able_pointer_authentication_on_arm64.patch | 6 ++--- 8 files changed, 33 insertions(+), 50 deletions(-) delete mode 100644 lang/node/patches/999-fix_building_with_system_icu_76.patch diff --git a/lang/node/Makefile b/lang/node/Makefile index 6d458432da..f041a4ef75 100644 --- a/lang/node/Makefile +++ b/lang/node/Makefile @@ -8,13 +8,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=node -PKG_VERSION:=22.11.0 -PKG_RELEASE:=4 +PKG_VERSION:=22.13.1 +PKG_RELEASE:=1 NODE_MODULE_VERSION:=127 PKG_SOURCE:=$(PKG_NAME)-v$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://nodejs.org/dist/v$(PKG_VERSION) -PKG_HASH:=24e5130fa7bc1eaab218a0c9cb05e03168fa381bb9e3babddc6a11f655799222 +PKG_HASH:=e7d5b1e84e7f3c3cebda81e2b138469eef41ba4ecf16a87fd15fc3f7afa3f701 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-v$(PKG_VERSION) HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/$(PKG_NAME)-v$(PKG_VERSION) diff --git a/lang/node/patches/003-path.patch b/lang/node/patches/003-path.patch index f2000b1e3f..cfe6da54f2 100644 --- a/lang/node/patches/003-path.patch +++ b/lang/node/patches/003-path.patch @@ -1,6 +1,6 @@ --- a/lib/internal/modules/cjs/loader.js +++ b/lib/internal/modules/cjs/loader.js -@@ -1779,7 +1779,8 @@ Module._initPaths = function() { +@@ -1789,7 +1789,8 @@ Module._initPaths = function() { path.resolve(process.execPath, '..') : path.resolve(process.execPath, '..', '..'); diff --git a/lang/node/patches/200-uv_gyp.patch b/lang/node/patches/200-uv_gyp.patch index 75bc8f2e5b..9e3961763a 100644 --- a/lang/node/patches/200-uv_gyp.patch +++ b/lang/node/patches/200-uv_gyp.patch @@ -1,6 +1,6 @@ --- a/deps/uv/uv.gyp +++ b/deps/uv/uv.gyp -@@ -155,6 +155,7 @@ +@@ -156,6 +156,7 @@ 'target_name': 'libuv', 'toolsets': ['host', 'target'], 'type': '<(uv_library)', diff --git a/lang/node/patches/202-node_gyp.patch b/lang/node/patches/202-node_gyp.patch index 84ea6f607e..2b72ab1207 100644 --- a/lang/node/patches/202-node_gyp.patch +++ b/lang/node/patches/202-node_gyp.patch @@ -1,10 +1,18 @@ --- a/node.gyp +++ b/node.gyp -@@ -1350,6 +1350,7 @@ - 'dependencies': [ - 'deps/simdutf/simdutf.gyp:simdutf#host', +@@ -1138,6 +1138,7 @@ + 'includes': [ + 'node.gypi' ], + 'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ], 'include_dirs': [ + 'src', + 'tools/msvs/genfiles', +@@ -1354,6 +1355,7 @@ 'tools', 'src', + ], ++ 'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ], + 'sources': [ + 'tools/js2c.cc', + 'tools/executable_wrapper.h', diff --git a/lang/node/patches/204-v8_gyp.patch b/lang/node/patches/204-v8_gyp.patch index 5dba48a4f8..c6f426aa8e 100644 --- a/lang/node/patches/204-v8_gyp.patch +++ b/lang/node/patches/204-v8_gyp.patch @@ -44,7 +44,7 @@ ], 'sources': [ ' -Date: Sun, 27 Oct 2024 10:08:07 -0400 -Subject: [PATCH] build: fix building with system icu 76 - -ICU 76 decided to reduce overlinking[^1] thus `icu-i18n` will no longer -add `icu-uc` when linking to shared libraries. This results in undefined -symbols/references when trying to build with system ICU 76. - -[^1]: unicode-org/icu@199bc82 ---- - configure.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/configure.py -+++ b/configure.py -@@ -1876,7 +1876,7 @@ def configure_intl(o): - elif with_intl == 'system-icu': - # ICU from pkg-config. - o['variables']['v8_enable_i18n_support'] = 1 -- pkgicu = pkg_config('icu-i18n') -+ pkgicu = pkg_config(['icu-i18n', 'icu-uc']) - if not pkgicu[0]: - error('''Could not load pkg-config data for "icu-i18n". - See above errors or the README.md.''') diff --git a/lang/node/patches/999-localhost-no-addrconfig.patch b/lang/node/patches/999-localhost-no-addrconfig.patch index c431370b78..05147e1e75 100644 --- a/lang/node/patches/999-localhost-no-addrconfig.patch +++ b/lang/node/patches/999-localhost-no-addrconfig.patch @@ -13,7 +13,7 @@ Forwarded: https://github.com/nodejs/node/issues/33816 // // Permission is hereby granted, free of charge, to any person obtaining a // copy of this software and associated documentation files (the -@@ -1342,13 +1343,6 @@ function lookupAndConnect(self, options) +@@ -1368,13 +1369,6 @@ function lookupAndConnect(self, options) hints: options.hints || 0, }; diff --git a/lang/node/patches/999-revert_enable_pointer_authentication_on_arm64.patch b/lang/node/patches/999-revert_enable_pointer_authentication_on_arm64.patch index 83fd1e025a..e281dcb55f 100644 --- a/lang/node/patches/999-revert_enable_pointer_authentication_on_arm64.patch +++ b/lang/node/patches/999-revert_enable_pointer_authentication_on_arm64.patch @@ -1,10 +1,10 @@ --- a/node.gyp +++ b/node.gyp -@@ -1351,6 +1351,7 @@ - 'deps/simdutf/simdutf.gyp:simdutf#host', +@@ -1139,6 +1139,7 @@ + 'node.gypi' ], 'libraries!':[ '-licui18n', '-licuuc', '-licudata', '-lcrypto', '-lssl', '-lz', '-lhttp_parser', '-luv', '-lnghttp2', '-lcares' ], + 'cflags!': ['-mbranch-protection=standard'], 'include_dirs': [ - 'tools', 'src', + 'tools/msvs/genfiles', -- 2.30.2