nodejs (18.19.0+dfsg-6~deb12u1) bookworm-security; urgency=medium
* Upstream update.
* CVE-2023-23918: Permissions policies can be bypassed via
process.mainModule. Closes #1031834.
* CVE-2023-23919: OpenSSL error handling issues in nodejs crypto
library. Closes: #1031834.
* CVE-2023-23920: Insecure loading of ICU data through ICU_DATA
environment variable. Closes: #1031834.
* CVE-2023-30590: DiffieHellman do not generate keys after setting a
private key. Closes: #1039990.
* CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR.
Closes: #1039990.
* CVE-2023-30588: Process interuption due to invalid Public Key information
in x509 certificates. Closes: #1039990.
* CVE-2023-32559: Permissions policies can be bypassed via process.binding.
Closes: #1050739.
* CVE-2023-30581: mainModule.proto bypass experimental policy mechanism.
Closes: #1039990.
* CVE-2023-32002: Permissions policies can be bypassed via Module._load.
Closes: #1050739.
* CVE-2023-32006: Permissions policies can impersonate other modules in
using module.constructor.createRequire(). Closes: #1050739.
* CVE-2023-38552: Integrity checks according to policies can be
circumvented. Closes: #1054892.
* CVE-2023-39333: Code injection via WebAssembly export names.
Closes: #1054892.
-- Jérémy Lal <kapouer@melix.org> Wed, 20 Dec 2023 18:07:36 +0100
nodejs (18.19.0+dfsg-6) unstable; urgency=medium
* patch: remove useless and badly done icu_74 patch
-- Jérémy Lal <kapouer@melix.org> Sun, 03 Dec 2023 22:41:14 +0100
nodejs (18.19.0+dfsg-5) unstable; urgency=medium
* patch: disable openssl test that depends on error message format
-- Jérémy Lal <kapouer@melix.org> Sun, 03 Dec 2023 22:41:00 +0100
nodejs (18.19.0+dfsg-4) unstable; urgency=medium
* patch:
+ remove a failed attempt for test dns-resolveany-bad-ancount
skip it, it uselessly hangs.
+ disable some icu test to allow transition to 74
+ fix test-crypto-dh.js to pass with openssl 3.0.11, 3.1.4
+ riscv64: some tests have been fixed, but new ones fail
-- Jérémy Lal <kapouer@melix.org> Sun, 03 Dec 2023 15:00:35 +0100
nodejs (18.19.0+dfsg-3) unstable; urgency=medium
* patch: drop fixed openssl test patch
* patch: allow bad-ancount test to fail
-- Jérémy Lal <kapouer@melix.org> Sat, 02 Dec 2023 02:12:25 +0100
nodejs (18.19.0+dfsg-2) unstable; urgency=medium
* patch: fix test_dns_resolveany_bad_ancount_timeout.patch
-- Jérémy Lal <kapouer@melix.org> Fri, 01 Dec 2023 19:07:23 +0100
nodejs (18.19.0+dfsg-1) experimental; urgency=medium
[ Jérémy Lal ]
* New upstream version 18.19.0+dfsg
+ tests pass with openssl 3.1, closes: #1055416
+ tests pass with libc-ares >= 1.23.0, closes: #1054690
* Harmonize stack size patch for arm64. Closes: 1030284
* Install dir usr/lib/<tripler>/nodejs. Fix #1035463
* No longer force gcc 11 for sid
* Fix Vcs fields to point to the right branch
* builtins: set correct version in builtins headers
* dfsg-exclude for non-preferred form for modification:
+ deps/ada
+ deps/minimatch
+ test/fixtures/postject-copy
* component: ./ada
* copyright:
+ add missing authors to histogram
+ drop unnecessary snapshot.blob exclusion
+ licenses for ada
+ deps/cares now using Expat
+ document some new files
* patches:
+ test-process-versions must use system versions
+ drop the test using postject
+ build using ada component instead of deps/ada
+ minimatch is actually not needed for build
+ fix test-runner-output, forwarded
+ mark parallel/test-debugger-preserve-breaks as flaky,
it is failing in sbuild for now
+ fix test-dns-resolveany-bad-ancount to work with c-ares,
also to not hang the testsuite in sbuild
[ Yadd ]
* Declare compliance with policy 4.6.2
-- Jérémy Lal <kapouer@melix.org> Fri, 01 Dec 2023 01:23:44 +0100
nodejs (18.13.0+dfsg1-1) unstable; urgency=medium
[ Bo YU ]
* Fix FTBFS on riscv64. Closes: 1028404
[ Jérémy Lal ]
* doc-generator: update types
* copyright: deps/v8/third_party/ittapi
* copyright: Files-Excluded snapshot.blob, new orig tarball
-- Jérémy Lal <kapouer@melix.org> Fri, 17 Feb 2023 00:39:15 +0100
nodejs (18.13.0+dfsg-1) unstable; urgency=medium
* New upstream version 18.13.0+dfsg
* Drop applied patches
* Add tracing, crypto headers to /usr/include/nodejs
* riscv64: mark flaky tests. Closes: 1026065
* copyright: remove uv/android* files
* Drop n/a lintian overrides for zlib
* lintian-overrides: update false source-is-missing
-- Jérémy Lal <kapouer@melix.org> Fri, 06 Jan 2023 21:15:20 +0100
nodejs (18.12.1+dfsg-2) unstable; urgency=medium
* Patch: fix test suite for icu 72.1
-- Jérémy Lal <kapouer@melix.org> Wed, 09 Nov 2022 18:16:06 +0100
nodejs (18.12.1+dfsg-1) unstable; urgency=medium
* New upstream version 18.12.1+dfsg
* Fixes CVE-2022-43548: DNS rebinding in --inspect via invalid
octal IP address (Medium).
Closes: #1023518.
* Build using gcc-11, g++-11, fixes mips64el and riscv64 builds,
https://github.com/nodejs/node/issues/44126
* Patch: fix link to home in html doc. Closes: #1018153
-- Jérémy Lal <kapouer@melix.org> Sun, 06 Nov 2022 00:14:11 +0100
nodejs (18.12.0+dfsg-1) unstable; urgency=medium
* New upstream version 18.12.0+dfsg
* Add flaky new debugger test
* watch nodejs 18 LTS
-- Jérémy Lal <kapouer@melix.org> Thu, 27 Oct 2022 15:02:24 +0200
nodejs (18.11.0+dfsg-4) experimental; urgency=medium
* Patch: fix mipsel build failure
* Patch: drop mips/no_jitless, fixed upstream
-- Jérémy Lal <kapouer@melix.org> Wed, 26 Oct 2022 01:23:22 +0200
nodejs (18.11.0+dfsg-3) experimental; urgency=medium
* Revert "Build using gcc-11, g++-11"
* Skip buggy watch mode tests
-- Jérémy Lal <kapouer@melix.org> Mon, 17 Oct 2022 14:04:02 +0200
nodejs (18.11.0+dfsg-2) experimental; urgency=medium
* Do not use --shared-ngctp2/http3 switch
-- Jérémy Lal <kapouer@melix.org> Fri, 14 Oct 2022 16:23:40 +0200
nodejs (18.11.0+dfsg-1) experimental; urgency=medium
* New upstream version 18.11.0+dfsg
* armhf: minimal target is vfpv3-d16 (Closes: #1021546).
* copyright: update for a new file
* Drop nghttp3, ngtcp2 deps: useless without openssl-quic
* Refresh patches
-- Jérémy Lal <kapouer@melix.org> Fri, 14 Oct 2022 15:30:25 +0200
nodejs (18.10.0+dfsg-6) unstable; urgency=medium
* Move builtins dependencies to libnode108 (Closes: #1021107).
* Mark another flaky test for riscv64
-- Jérémy Lal <kapouer@melix.org> Mon, 10 Oct 2022 10:49:19 +0200
nodejs (18.10.0+dfsg-5) unstable; urgency=medium
* Breaks: node-jest (<< 29~)
-- Jérémy Lal <kapouer@melix.org> Sun, 09 Oct 2022 17:42:53 +0200
nodejs (18.10.0+dfsg-4) unstable; urgency=medium
* Backport armel test failure fix
* Allow undici-related test failures on riscv64 for now
-- Jérémy Lal <kapouer@melix.org> Sat, 01 Oct 2022 15:05:49 +0200
nodejs (18.10.0+dfsg-3) unstable; urgency=medium
* Avoid depending on node to build node. Fix build.
* Allow failure of another version of an already flaky test,
seen to be failing on i386 - possibly on 32-bits architectures.
-- Jérémy Lal <kapouer@melix.org> Fri, 30 Sep 2022 01:23:56 +0200
nodejs (18.10.0+dfsg-2) unstable; urgency=medium
* Revert /etc/default/nodejs and wrapper - env is enough
Also avoids future bugs with node's process.execPath
* Depends on externalized builtins (Closes: #1020980)
-- Jérémy Lal <kapouer@melix.org> Thu, 29 Sep 2022 23:55:15 +0200
nodejs (18.10.0+dfsg-1) unstable; urgency=medium
[ Yadd ]
* Drop /usr/lib/nodejs support
[ Jérémy Lal ]
* New upstream version 18.10.0+dfsg
* Configurable builtins paths:
+ upstream patch implementing it
+ augment upstream patch to support acorn, acorn-walk
+ configure flags for acorn, undici, cjs-module-lexer
+ use pkgjs-ln for system-installed modules
+ exclude acorn, undici, cjs-module-lexer,
they are all distributed and built in their own package
* Allow custom flags to be set in /etc/defaults/nodejs
* Patch openssl.conf used for tests to allow smoil keys,
and disable some failing tests while waiting for upstream
to upgrade their test keys. (Closes: #1020592)
* Use shared ngtcp2, nghttp3
* doc-generator:
+ fix node_modules setup using pkgjs-ln
+ update type-parser.mjs
-- Jérémy Lal <kapouer@melix.org> Thu, 29 Sep 2022 11:50:59 +0200
nodejs (18.8.0+dfsg-1) experimental; urgency=medium
* New upstream version 18.8.0+dfsg
* Drop patches applied upstream
-- Jérémy Lal <kapouer@melix.org> Sat, 03 Sep 2022 16:53:05 +0200
nodejs (18.7.0+dfsg-5) unstable; urgency=medium
* Tighten dependency with armv6k-support
-- Jérémy Lal <kapouer@melix.org> Thu, 01 Sep 2022 18:33:49 +0200
nodejs (18.7.0+dfsg-4) unstable; urgency=medium
* lintian overrides:
+ fix embedded-library zlib
+ slightly more info about source-is-missing
* copyright: fix license short name for base64
-- Jérémy Lal <kapouer@melix.org> Tue, 30 Aug 2022 15:52:53 +0200
nodejs (18.7.0+dfsg-3) unstable; urgency=medium
* Rename and DEP-3 latest armel patch
* Restore build using gcc 11,
it was removed by mistake in the previous upload
-- Jérémy Lal <kapouer@melix.org> Mon, 29 Aug 2022 17:03:45 +0200
nodejs (18.7.0+dfsg-2) unstable; urgency=medium
* Build on armel where armv6k, vfpv2 is supported:
+ control: add Architecture: armel
+ control: depends armv6-support:armel, vfpv2-support:armel
+ rules: set -march=armv6k
+ patch: add --with-arm-version configure.py flag
-- Jérémy Lal <kapouer@melix.org> Mon, 29 Aug 2022 00:09:15 +0200
nodejs (18.7.0+dfsg-1) unstable; urgency=medium
* New upstream version 18.7.0+dfsg
* Update flaky riscv64: sequential/test-cpu-prof-drained.
Closes: #1016707.
* copyright: deps/base64 BSD-2-clause
-- Jérémy Lal <kapouer@melix.org> Fri, 12 Aug 2022 17:21:50 +0200
nodejs (18.6.0+dfsg-5) unstable; urgency=medium
* Build-Depends gcc-11, g++-11.
Allow transition while waiting for #1016628 to be sorted out.
-- Jérémy Lal <kapouer@melix.org> Thu, 04 Aug 2022 17:32:43 +0200
nodejs (18.6.0+dfsg-4) unstable; urgency=medium
* Patches: Closes: #1016305
+ upstream fix getaddrinfo without network
+ fix test failing with libuv1 >= 1.44.2
* Patch: upstream fix ppc64 crash with regexp. Closes: #1016381.
* Drop RES_OPTIONS to avoid test failures with localhost
-- Jérémy Lal <kapouer@melix.org> Mon, 01 Aug 2022 22:37:57 +0200
nodejs (18.6.0+dfsg-3) unstable; urgency=medium
* Patch: add sequential/test-worker-prof to failing riscv64 tests
-- Jérémy Lal <kapouer@melix.org> Mon, 18 Jul 2022 23:22:08 +0200
nodejs (18.6.0+dfsg-2) experimental; urgency=medium
* Fix path where to look for @types/node
when fixing permissions.
Also use execute_after_dh_fixperms.
-- Jérémy Lal <kapouer@melix.org> Sat, 16 Jul 2022 17:38:26 +0200
nodejs (18.6.0+dfsg-1) experimental; urgency=medium
* New upstream version 18.6.0+dfsg
* Patches:
+ work around IPv6 getaddrinfo EAI_AGAIN localhost failure
with some tests on zandonai
+ reenable global fetch and its tests
* Build-Depends node-undici
* Bump Standards-Version, no change
* Fix @types/node permissions
* lintian overrides:
+ drop unneeded libnode108 lines
+ update to new format
+ ignore source-is-missing for regenerated doc
* copyright:
+ tools/rpm/ no longer here
+ fix order of paragraphs
+ fix wildcard
+ remove useless Licenses
-- Jérémy Lal <kapouer@melix.org> Sat, 16 Jul 2022 15:35:17 +0200
nodejs (18.4.0+dfsg-2) experimental; urgency=medium
* Breaks libnode72 << 13 because of bullseye/security
(Closes: #1013968)
* Fix bash-completion link (Closes: #977792)
* Patch: disable fetch until undici is accepted (Closes: #1014214)
-- Jérémy Lal <kapouer@melix.org> Mon, 04 Jul 2022 11:37:13 +0200
nodejs (18.4.0+dfsg-1) experimental; urgency=medium
* New upstream version 18.4.0+dfsg
* lintian-overrides:
+ drop node-acorn/*, no longer a component
+ improve embedded-library zlib and comment it
* copyright:
+ remove useless files and paragraphs
+ fix order of paragraphs
* patches:
+ remove very old unapplied files
+ fix non-utf8 encoding in one patch
+ fix mipsel compilation failure
* unidici missing: do not crash, just have no exports
* postpone usr/include/nodejs renaming, do it
in libnode-dev.files.
* Fix badly reverted usr/include/nodejs rename:
/usr/include/node is for n-api, nodejs for old addons
* hardening flags: -pie is no longer needed
-- Jérémy Lal <kapouer@melix.org> Tue, 21 Jun 2022 21:14:28 +0200
nodejs (18.3.0+dfsg-1) experimental; urgency=medium
* New upstream version 18.3.0+dfsg
* Follow upstream make install:
+ let node install its own headers
+ keep a symlink to /usr/include/nodejs,
will be removed when node-gyp is updated
* watch latest version
* gbp on master
* Add noautodbgsym to README.source profiles
* Clean debian/nodejs.bash-completion
* Drop openssl-cnf.patch, upstream use openssl 3
* Skip another test using undici
* Bump libnode abi
-- Jérémy Lal <kapouer@melix.org> Tue, 14 Jun 2022 10:40:33 +0200
nodejs (16.15.1+dfsg-1) unstable; urgency=medium
* New upstream version 16.15.1+dfsg
* Fix completion generation, support "nodejs" cli
Closes: #977792
* Patch to fix mipsel crypto init error strings (Closes: #1011101)
* Patch: more flaky riscv64 cpu tests (Closes: #1012670)
-- Jérémy Lal <kapouer@melix.org> Mon, 13 Jun 2022 09:11:34 +0200
nodejs (16.15.0+dfsg-1) unstable; urgency=medium
* New upstream version 16.15.0+dfsg
* Go back to +dfsg
* dfsg-exclude undici (missing source for compiled wasm)
* Will B-D undici <!pkg.nodejs.nobuiltin> when available
* bash-completion from node --completion-bash (Closes: #977792)
* Patches:
+ build/skip-crypto-engine-check no longer needed
+ test-diagnostic-dir-cpu-prof is flaky on riscv64
(Closes: #1011100)
* Update README.source
* Fix undici source name
* Update openssl.cnf to fix tests on mipsel (Closes: #1011339)
* Improve doc-generator
-- Jérémy Lal <kapouer@melix.org> Fri, 27 May 2022 15:48:16 +0200
nodejs (16.14.2+dfsg1-1) unstable; urgency=medium
* Repack dfsg1, reimport without node-acorn
* OPENSSL_CONF: absolute path with openssl 3 (Closes: #1006246)
* Mark test-cpu-prof-exit as flaky on riscv64
-- Jérémy Lal <kapouer@melix.org> Wed, 11 May 2022 11:02:01 +0200
nodejs (16.14.2+dfsg-5) unstable; urgency=medium
* Patches:
+ skip failing arch-dependent assertions.
Closes: #1010069
+ free test-crypto-engine from build artifacts.
Closes: #1010497
+ test-cpu-prof-worker-argv flaky on riscv64.
Closes: #1010509
-- Jérémy Lal <kapouer@melix.org> Tue, 03 May 2022 08:29:29 +0200
nodejs (16.14.2+dfsg-4) unstable; urgency=medium
* Upload to unstable
-- Jérémy Lal <kapouer@melix.org> Mon, 02 May 2022 10:49:50 +0200
nodejs (16.14.2+dfsg-3) experimental; urgency=medium
* rules: add missing symlink for doc generation
-- Jérémy Lal <kapouer@melix.org> Tue, 29 Mar 2022 15:39:42 +0200
nodejs (16.14.2+dfsg-2) experimental; urgency=medium
* Update nobuiltin to pkg.nodejs.nobuiltin
* nodejs breaks: (Closes: #1007248)
+ libnode72 < 12.22.10~dfsg
+ libnode83 < 16.13.2+really14.19.1~dfsg
* README.source: improve explanations
* rules: two-stage builds w.r.t. node-acorn
* watch: remove node-acorn component
-- Jérémy Lal <kapouer@melix.org> Tue, 29 Mar 2022 14:33:32 +0200
nodejs (16.14.2+dfsg-1) experimental; urgency=medium
* New upstream version 16.14.2+dfsg
* Change ~dfsg to +dfsg
* copyright:
+ dfsg-exclude corepack - missing source
+ remove tools/lint-md.mjs
* rules: do not install corepack
* B-D libuv >= 1.43
-- Jérémy Lal <kapouer@melix.org> Wed, 23 Mar 2022 15:34:41 +0100
nodejs (16.13.2+really14.19.1~dfsg-5) unstable; urgency=medium
[ Yadd ]
* Fix @types/node install (Closes: #1008110)
-- Jérémy Lal <kapouer@melix.org> Tue, 22 Mar 2022 19:59:55 +0100
nodejs (16.13.2+really14.19.1~dfsg-4) unstable; urgency=medium
* Allow test-debugger-preserve-breaks to fail
-- Jérémy Lal <kapouer@melix.org> Tue, 22 Mar 2022 10:15:06 +0100
nodejs (16.13.2+really14.19.1~dfsg-3) unstable; urgency=medium
* Test timeouts: try to stay under the radar
-- Jérémy Lal <kapouer@melix.org> Tue, 22 Mar 2022 02:21:12 +0100
nodejs (16.13.2+really14.19.1~dfsg-2) unstable; urgency=medium
* Upload to unstable
-- Jérémy Lal <kapouer@melix.org> Tue, 22 Mar 2022 00:22:05 +0100
nodejs (16.13.2+really14.19.1~dfsg-1) experimental; urgency=medium
* New upstream version 16.13.2+really14.19.1~dfsg
* control: Break only libnode72 << 12.22.10~, since it can be
co-installed with libnode83. Only Replace it.
Likewise, if version Break: libnode64 << 10.24.1~.
* README.source: no need to rebuild arch-independent packages
* Drop dh_nodejs, totally useless now
* salsa-ci:
+ use debian.yml script
+ disable i386 build
+ disable build checks - autopkgtest runs the same ones
+ disable dbgsym generation to reduce artifacts size
* Let tests using unprivileged port fail. Closes: #994613.
* watch: uversionmangle with really version
* Skip parallel/test-child-process-stdio-overlapped
It depends on a binary that is not part of the build targets
* Namespace custom profile pkg.nodejs.nobuiltin
* copyright:
+ add license for node-acorn component
+ update c-ares paths
+ removed paths in deps/v8/benchmarks/
* Install @types/node only *.d.ts
* Lintian overrides:
+ update expressions
+ v8 uses a heavily modified zlib, allow embedding.
-- Jérémy Lal <kapouer@melix.org> Mon, 21 Mar 2022 13:43:29 +0100
nodejs (16.13.2+really14.19.0~dfsg-2) experimental; urgency=medium
[ Yadd ]
* Update standards version to 4.6.0, no changes needed.
* Make node_modules links (Closes: #1005089)
-- Jérémy Lal <kapouer@melix.org> Tue, 01 Mar 2022 09:50:07 +0100
nodejs (16.13.2+really14.19.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.19.0~dfsg
Workaround the version currently in experimental
* Depends icu >= 67, c-ares >= 1.18.1, libuv1 >= 1.42.0
* Patches:
+ stop using private cares header
+ drop ppc64 patch, hopefully fixed now
+ replace tools/doc patch by copy in debian/doc-generator
+ mark test-debugger-heap-profiler as flaky
+ regroup and rename patches files
+ test helper not skipping for 32-bit mipsel
+ upstream fix test-datetime-change-notify
+ drop fix_daylight_dublin, applied upstream
+ skip corepack tests
* doc-generator:
+ rebase changes on latest upstream doc/tools
+ update, port to js-yaml 4 and marked 4
+ tighten dependency on js-yaml for esm support
* source overrides: update expressions
* Update README.source with info on two-stage build
* Bootstrap nodejs: (wip)
+ add nobuiltin profile, installs files in
/usr/share/nodejs/node when selected,
otherwise just install empty files
+ node-acorn=8.5.0 component for stage 1 builds,
update gbp.conf
+ control: more nocheck, nobuiltin flags
+ instructions in README.source
+ node-highlight.js is Build-Depends-Indep
+ doc-generator depends on external acorn
+ flag !nocheck and !nodoc build-deps
* rules:
+ fix check target for auto_test
+ acorn is needed both for arch and indep targets
+ fix nodejs.install dest dirs
+ configure with verbose
+ do not install corepack
* Drop nodepath, it assumes modules to be installed
* copyright:
+ fix lint-md path
+ highlight.pack.js no longer in tarball
+ update deps/cares paths
+ dfsg-exclude corepack - missing source
+ various paths fixes
[ Bastien Roucariès ]
* Bug fix: "nodejs FTCBFS: uses build architecture build tools such as
gcc or pkg-config", thanks to Helmut Grohne (Closes: #996195).
* Document gyp target/host in debian/rules
[ Helmut Grohne ]
* Add native build dependencies for cross compiling. (Closes: #996416)
-- Jérémy Lal <kapouer@plummer.debian.org> Sat, 05 Feb 2022 18:41:31 +0000
nodejs (14.17.4~dfsg-1) experimental; urgency=medium
[ Helmut Grohne ]
* Add native build dependencies for cross compiling. (Closes: #996416)
[ Jérémy Lal ]
* New upstream version 14.17.4~dfsg
* Enable powerpc arch. Closes: #991638
[ Bastien Roucariès ]
* Team upload
* MA: allowed. Thanks Helmut.
* B-D sse2-support. Closes: #994720
* BD: python3:native
* Fix FTCBFS by using crosscompile option
* Document gyp target/host in debian/rules
-- Bastien Roucariès <rouca@debian.org> Thu, 23 Sep 2021 15:25:09 +0000
nodejs (14.17.0~dfsg-2) experimental; urgency=medium
* Install missing headers. Closes: #990282
-- Jérémy Lal <kapouer@melix.org> Thu, 24 Jun 2021 16:10:27 +0200
nodejs (14.17.0~dfsg-1) experimental; urgency=medium
* Switch to branches -14.x
* New upstream version 14.17.0~dfsg
-- Jérémy Lal <kapouer@melix.org> Mon, 17 May 2021 23:48:33 +0200
nodejs (14.16.1~dfsg-1) experimental; urgency=medium
[ James Addison ]
* THP ELF assembly: Add .note.GNU-stack section (Closes: #980272)
[ Jérémy Lal ]
* New upstream version 14.16.1~dfsg
* Add Breaks: node-babel-runtime (<< 7). Closes:#987301
-- Jérémy Lal <kapouer@melix.org> Thu, 06 May 2021 17:02:20 +0200
nodejs (14.16.0~dfsg-1) experimental; urgency=medium
[ Jérémy Lal ]
* New upstream version 14.16.0~dfsg
Fixed vulnerabilities:
+ CVE-2021-22883: HTTP2 'unknownProtocol' cause DoS
by resource exhaustion
+ CVE-2021-22884: localhost6 DNS rebinding in --inspect
* Refresh make-doc patch
* Patch to always use pure javascript cjs lexer
* copyright: cjs-module-lexer is expat
* copyright: exclude cjs-module-lexer unbuildable files
* copyright: fix some copyright years
* copyright: shjs is no longer used
* lintian-overrides: false positive for a unicode regexp
[ Xavier Guimard ]
* Embed @types/node 14
* Provides node-types-node (Closes: #979698)
* Use secure copyright file specification URI.
* Set upstream metadata fields: Security-Contact.
* Bump debhelper compatibility level to 13
* Declare compliance with policy 4.5.1
* Use secure URI in Homepage field.
* Add "Rules-Requires-Root: no"
* Modernize debian/watch
* Add ctype=nodejs to component(s)
* Update d/copyright urls
-- Jérémy Lal <kapouer@melix.org> Thu, 04 Mar 2021 00:29:51 +0100
nodejs (14.13.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.13.0~dfsg
-- Jérémy Lal <kapouer@melix.org> Tue, 06 Oct 2020 18:57:02 +0200
nodejs (14.12.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.12.0~dfsg
-- Jérémy Lal <kapouer@melix.org> Wed, 23 Sep 2020 18:54:27 +0200
nodejs (14.11.0~dfsg-2) experimental; urgency=medium
* Rewrite changelog with the CVE
-- Jérémy Lal <kapouer@melix.org> Thu, 17 Sep 2020 18:11:35 +0200
nodejs (14.11.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.11.0~dfsg
Vulnerabilities fixed
+ CVE-2020-8251
Denial of Service by resource exhaustion CWE-400 due to
unfinished HTTP/1.1 requests (Critical)
+ CVE-2020-8252
fs.realpath.native on may cause buffer overflow (Medium)
* Refresh patches
-- Jérémy Lal <kapouer@melix.org> Thu, 17 Sep 2020 01:21:19 +0200
nodejs (14.9.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.9.0~dfsg
* Drop python3 patch, applied upstream
* Update make-doc patch to ignore false type-match errors
-- Jérémy Lal <kapouer@melix.org> Sat, 29 Aug 2020 14:23:27 +0200
nodejs (14.8.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.8.0~dfsg
-- Jérémy Lal <kapouer@melix.org> Tue, 11 Aug 2020 22:46:00 +0200
nodejs (14.7.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.7.0~dfsg (Closes: #968139).
* Two tests won't pass on IPv6-only hosts
* There was no such thing as libnode64-dev, remove it
* libnode83 breaks libnode64, libnode72 Closes: #966008
* nodejs-doc: depends node-highlight.js instead of libjs
* python3 support (Closes: #967032):
+ tests/control: depends python3, python3-distutils
+ python3 patch: use env.PYTHON in two tests
+ export PYTHON = python3 for Makefile
* tests/control: drop cdbs, now useless
* Update make-doc.patch to deal with new syntax in esm.md
* Refresh patches:
+ drop mips-fix
+ drop revert-extra-ca
-- Jérémy Lal <kapouer@melix.org> Mon, 10 Aug 2020 00:43:34 +0200
nodejs (14.4.0~dfsg-2) experimental; urgency=medium
* Just completely disable ADDRCONFIG flag
* Multiarch hinter: remove Multi-Arch: same on libnode-dev
* Patch to fix ppc64 build
-- Jérémy Lal <kapouer@melix.org> Sun, 14 Jun 2020 16:59:47 +0200
nodejs (14.4.0~dfsg-1) experimental; urgency=medium
* New upstream version 14.4.0~dfsg
* Bump libnode ABI to 83
* Build-Depends python3-distutils
* Fix make-doc.patch to allow no description
* Fix make-doc.patch for stricter example heading match
* copyright: add zlib copy
* rules: JOBS=1 on 32-bit architectures only
-- Jérémy Lal <kapouer@melix.org> Thu, 11 Jun 2020 23:11:59 +0200
nodejs (12.18.3~dfsg-4) unstable; urgency=medium
* python3 patch: use env.PYTHON in two tests
Closes: #967032 for good.
-- Jérémy Lal <kapouer@melix.org> Sat, 08 Aug 2020 14:09:43 +0200
nodejs (12.18.3~dfsg-3) unstable; urgency=medium
* export PYTHON = python3 for Makefile
-- Jérémy Lal <kapouer@melix.org> Fri, 07 Aug 2020 03:33:58 +0200
nodejs (12.18.3~dfsg-2) unstable; urgency=medium
* tests/control: depends python3, python3-distutils, drop cdbs
Thanks Moritz Mühlenhoff for noticing that.
-- Jérémy Lal <kapouer@melix.org> Wed, 05 Aug 2020 10:40:31 +0200
nodejs (12.18.3~dfsg-1) unstable; urgency=medium
* New upstream version 12.18.3~dfsg
* B-D python3, python3-distutils
patch configure to use python3 (Closes: #967032)
* nodejs-doc: depends libjs-highlight.js
* copyright: dfsg-exclude highlight.pack.js,
replace sh_javascript.min.js
* source/lintian-overrides: drop sh_javascript.min.js override
* Drop patch that restores unminified sh_javascript.min.js
* Update make-doc.patch to deal with new syntax in esm.md
-- Jérémy Lal <kapouer@melix.org> Wed, 05 Aug 2020 00:11:08 +0200
nodejs (12.18.2~dfsg-1) unstable; urgency=medium
* New upstream version 12.18.2~dfsg
* Drop Breaks: libnode64-dev, package does not exist
* Drop libnode-dev Depends: nodejs, useless
* libnode72 breaks libnode64. Closes: #966008
-- Jérémy Lal <kapouer@melix.org> Wed, 22 Jul 2020 10:36:58 +0200
nodejs (12.18.1~dfsg-1) unstable; urgency=medium
* New upstream version 12.18.1~dfsg
* Update gbp.conf for *-12.x branches
* Just completely disable ADDRCONFIG flag,
but skip the two failing tests anyway
* Multiarch hinter: remove Multi-Arch: same on libnode-dev
* Patch to fix ppc64 build
* rules: JOBS=1 on 32-bit only
* libnode-dev depends nodejs: let addons test all right ?
-- Jérémy Lal <kapouer@melix.org> Tue, 30 Jun 2020 19:11:03 +0200
nodejs (12.18.0~dfsg-3) unstable; urgency=medium
* mipsel does not support a feature leading to test failures
* Two tests won't pass on IPv6-only hosts
-- Jérémy Lal <kapouer@melix.org> Thu, 11 Jun 2020 17:59:38 +0200
nodejs (12.18.0~dfsg-2) unstable; urgency=medium
* Do not use dns.ADDRCONFIG for localhost
-- Jérémy Lal <kapouer@melix.org> Thu, 11 Jun 2020 10:03:21 +0200
nodejs (12.18.0~dfsg-1) experimental; urgency=medium
* New upstream version 12.18.0~dfsg. Closes: #962145.
* Security fixes:
+ CVE-2020-11080
+ CVE-2020-8172
+ CVE-2020-8174
* Build-Depends nghttp2 >= 1.41.0
-- Jérémy Lal <kapouer@melix.org> Fri, 05 Jun 2020 09:07:20 +0200
nodejs (12.17.0~dfsg-4) experimental; urgency=medium
* Fix openssl.cnf path in libnode-dev.install
-- Jérémy Lal <kapouer@melix.org> Wed, 03 Jun 2020 09:59:43 +0200
nodejs (12.17.0~dfsg-3) experimental; urgency=medium
* nodejs-doc: remove placeholder in long desc,
libnode__ABI is libnode72
* install missing files:
+ libnode: node.stp systemtap config
+ nodejs: gdbinit, lldb_commands.py
* move files in better paths (backward-compatibly):
+ usr/include/openssl.cnf to usr/share/doc/nodejs
+ usr/include/v8 links to usr/include/node
* mips patches:
+ reduce reserved memory for mksnapshot to avoid oom
+ test-cli-node-options skips --jitless
-- Jérémy Lal <kapouer@melix.org> Wed, 03 Jun 2020 02:59:20 +0200
nodejs (12.17.0~dfsg-2) experimental; urgency=medium
* Build with -g1 on 32-bit, else -g
* Use dh --max-parallel=1 on 32-bit
* Backport v8 commit to fix mips snapshots
* Install devel files in /usr/include/node,
keep the old locations for backward compatibility.
* Use new alioth-lists email for maintainer
* nodejs-doc: add misc:Depends
* Standards-Version 4.5.0, no change required
-- Jérémy Lal <kapouer@melix.org> Mon, 01 Jun 2020 15:17:35 +0200
nodejs (12.17.0~dfsg-1) experimental; urgency=medium
* New upstream version 12.17.0~dfsg
* Ignore dh_dwz failures
* Depends sse2-support on i386. Closes: #961621
* copyright: deps/zlib/doc is no longer bundled
* Drop icu 67 patch
* On 32bit archs, save memory with -g1 and --max-parallel=1
-- Jérémy Lal <kapouer@melix.org> Fri, 29 May 2020 22:34:25 +0200
nodejs (12.16.3~dfsg-2) experimental; urgency=medium
* Revert upstream commit, fix test-tls-root-certificates failure
-- Jérémy Lal <kapouer@melix.org> Thu, 30 Apr 2020 17:47:19 +0200
nodejs (12.16.3~dfsg-1) experimental; urgency=medium
* New upstream version 12.16.3~dfsg
* dh_dwz: set a lower low-mem-die-limit
-- Jérémy Lal <kapouer@melix.org> Thu, 30 Apr 2020 00:19:39 +0200
nodejs (12.16.2~dfsg-2) experimental; urgency=medium
* Fix arch all build: skip tests, make install
-- Jérémy Lal <kapouer@melix.org> Sun, 26 Apr 2020 23:28:38 +0200
nodejs (12.16.2~dfsg-1) experimental; urgency=medium
[ Xavier Guimard ]
* Add upstream/metadata
* Disable test-release-npm test
* Switch to dh, Bump debhelper compatibility level to 12
* New upstream version 12.16.1~dfsg
* Refresh patches
[ Olivier Tilloy ]
* Fix building architecture-independent doc package
(Closes: #952629)
[ Jérémy Lal ]
* Revert "Override any source-is-missing - workaround pattern issues"
* Simplify and tighten lintian overrides
* make-doc: drop tools/doc/node_modules target
* Exclude brotli from deps, use system-installed one
* Remove brotli from copyright
* watch xz
* New upstream version 12.16.2~dfsg
-- Jérémy Lal <kapouer@melix.org> Sun, 26 Apr 2020 21:38:16 +0200
nodejs (12.13.1~dfsg-1) experimental; urgency=medium
* New upstream version 12.13.1~dfsg
* gsplit-dwarf for all mips variants
* Standards-Version 4.4.1
* Non-trivial refresh of make-doc patch
* Remove uv 1.30 compatibility patch
* Depends libuv1-dev >= 1.33
* Override source-is-missing to work around pattern matching issues
* Comment kfreebsd patch in series to keep lintian quiet
-- Jérémy Lal <kapouer@melix.org> Tue, 19 Nov 2019 15:34:06 +0100
nodejs (12.13.0~dfsg-1) experimental; urgency=medium
* New upstream version 12.13.0~dfsg
* Link to atomic using a patch, LDFLAGS is not enough
* Need libuv1-dev >= 1.32.0
* Do not run parallel jobs at all (consumes too much memory,
and may make some tests fail).
* Use shared libhttp-parser (>= 2.9.2) again
* copyright: update paths
* Standards-Version 4.4.1
* Ignore source-is-missing for long lines
-- Jérémy Lal <kapouer@melix.org> Fri, 01 Nov 2019 11:19:03 +0100
nodejs (12.10.0~dfsg-2) experimental; urgency=medium
* test: test-npm-version fails because npm not bundled
* ppc64 not supported: https://github.com/nodejs/node/issues/29534
-- Jérémy Lal <kapouer@melix.org> Mon, 16 Sep 2019 12:28:37 +0200
nodejs (12.10.0~dfsg-1) experimental; urgency=medium
* New upstream version 12.10.0~dfsg
* Tighten b-d pkg-js-tools (Closes: #934240)
* Use nodepath to setup links to acorn properly
* README: match current modules search paths (Closes:#939001)
* copyright:
+ add rimraf paragraph
+ couple new files in v8
* Revert upstream commit to stay compatible with uv 1.30
-- Jérémy Lal <kapouer@melix.org> Thu, 12 Sep 2019 01:15:23 +0200
nodejs (12.8.0~dfsg-2) experimental; urgency=medium
* Fix js-yaml install path using nodepath (Closes: #934228)
* Update make-doc.patch to avoid fetching remote changelog
-- Jérémy Lal <kapouer@melix.org> Thu, 08 Aug 2019 14:53:09 +0200
nodejs (12.8.0~dfsg-1) experimental; urgency=medium
* New upstream version 12.8.0~dfsg (Closes: #934207)
* Fix make-doc.patch (Closes: #933840)
-- Jérémy Lal <kapouer@melix.org> Thu, 08 Aug 2019 12:13:21 +0200
nodejs (12.7.0~dfsg-1) experimental; urgency=medium
* New upstream version 12.7.0~dfsg (Closes: #932991)
* Use shared libuv >= 1.30.1
* libnode-dev depends libuv1-dev (Closes: #905415)
* Build-Depends node-debbundle-acorn >= 6.1.0~
* Build-Depends libnghttp2-dev >= 1.39.1
* Tighten dependency on icu >= 64.0~
* rules: set nghttp2 lib name - upstream assumes lib prefix
* Upstream patch to fix linking against libnode
* Build with snapshot https://github.com/nodejs/node/issues/28675
-- Jérémy Lal <kapouer@melix.org> Sat, 03 Aug 2019 19:48:03 +0200
# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog nodejs`.
Generated by dwww version 1.15 on Thu May 23 22:31:56 CEST 2024.