eLe;@e7e-%e @e @e;d d@dd@d@d@dkY@dgddb d^*@d[@dS@d?adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de dimstar@opensuse.org adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de adam.majer@suse.de otto.hollmann@suse.com adam.majer@suse.de adam.majer@suse.de - Update to 20.18.2:
* src,loader,permission: throw on InternalWorker use when
permission model is enabled (bsc#1236251, CVE-2025-23083)
* src: fix HTTP2 mem leak on premature close and ERR_PROTO
(bsc#1236250, CVE-2025-23085)
* deps: Use of Insufficiently Random Values in undici fetch()
(bsc#1236258, CVE-2025-22150) - Update to 20.18.1
* Experimental Network Inspection Support in Node.js
* Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext
* New option for vm.createContext() to create a context with a
freezable globalThis
* buffer: optimize createFromString
- Changes in 20.17.0:
* module: support require()ing synchronous ESM graphs
* path: add matchesGlob method
* stream: expose DuplexPair API
- Changes in 20.16.0:
* process: add process.getBuiltinModule(id)
* inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth
* buffer: add .bytes() method to Blob
- CVE-2024-21538.patch: fixes regular expression denial of service
(bsc#1233856, CVE-2024-21538)
- linker_lto_jobs.patch: refreshed
- fix_ci_tests.patch: fix dns test vs. older c-ares
- nodejs.keyring: sync keys with upstream - Update to 20.15.1:
* Bypass incomplete fix of CVE-2024-27980 (bsc#1227560, CVE-2024-36138)
* Bypass network import restriction via data URL (bsc#1227554, CVE-2024-22020)
* fs.lstat bypasses permission model (bsc#1227562, CVE-2024-22018)
* fs.fchown/fchmod bypasses permission model (bsc#1227561, CVE-2024-36137)
* Permission model improperly processes UNC paths (bsc#1227563, CVE-2024-37372)
- Changes in 20.15.0:
* test_runner: support test plans
* inspector: introduce the --inspect-wait flag
* zlib: expose zlib.crc32()
* cli: allow running wasm in limited vmem with --disable-wasm-trap-handler
- Changes in 20.14.0
* src,permission: throw async errors on async APIs
* test_runner: support forced exit
- fix_ci_tests.patch, npm_search_paths.patch: refreshed
- skip_no_console.patch: dropped, upstreamed - Update to 20.13.1:
* buffer: improve base64 and base64url performance
* crypto: deprecate implicitly shortened GCM tags
* events,doc: mark CustomEvent as stable
* fs: add stacktrace to fs/promises
* report: add --report-exclude-network option
* src: add uv_get_available_memory to report and process
* stream: support typed arrays
* util: support array of formats in util.styleText
* v8: implement v8.queryObjects() for memory leak regression testing
* watch: mark as stable
- versioned.patch: refreshed
- cares_sle12_capabilities.patch: SLES12 compatibility - Update to 20.12.1:
* CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
leads to HTTP/2 server crash- (High) (bsc#1222244)
* CVE-2024-27982 - HTTP Request Smuggling via Content Length
Obfuscation- (Medium) (bsc#1222384)
* updated dependencies:
+ llhttp version 9.2.1
+ undici version 5.28.4 (bsc#1222530, bsc#1222603,
CVE-2024-30260, CVE-2024-30261)
- node-gyp-addon-gypi.patch: adapted for new unit test layouts
- fix_ci_tests.patch: add benchmark fix - Update to 20.12.0:
* crypto: implement crypto.hash()
* util: add loading and parsing environment variables
* new connection attempt events: connectionAttempt,
connectionAttemptFailed, connectionAttemptTimeout
* sea: support embedding assets
* support configurable snapshot through --build-snapshot-config flag
* util.styleText(format, text): This function returns a formatted
text considering the format passed.
* vm: support using the default loader to handle dynamic import()
- c-ares-fixes.patch: removed, upstreamed
- nodejs-libpath.patch, versioned.patch: refreshed - Update to 20.11.1: (security updates)
* (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High)
* (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
* (CVE-2024-21896, bsc#1219994) - Path traversal by monkey-patching Buffer internals- (High)
* (CVE-2024-22017, bsc#1219995) - setuid() does not drop all privileges due to io_uring - (High)
* (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
* (CVE-2024-21891, bsc#1219998) - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
* (CVE-2024-21890, bsc#1219999) - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
* (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
* undici version 5.28.3 (CVE-2024-24758, bsc#1220017)
* libuv version 1.48.0 (CVE-2024-24806, bsc#1220053) - update to 20.11.0:
* esm: add import.meta.dirname and import.meta.filename
* fs: add c++ fast path for writeFileSync utf8
* module: remove useCustomLoadersIfPresent flag
* module: bootstrap module loaders in shadow realm
* src: add --disable-warning option
* src: create per isolate proxy env template
* src: make process binding data weak
* stream: use Array for Readable buffer
* stream: optimize creation
* test_runner: adds built in lcov reporter
* test_runner: add Date to the supported mock APIs
* test_runner, cli: add --test-timeout flag
- c-ares-fixes.patch, fix_ci_tests.patch: refreshed - fix_ci_tests.patch: disable test_crypto_fips for openssl 3.x,
to be fixed soon (bsc#1219152) - c-ares-fixes.patch: add additional backports for unit test fixes - c-ares-fixes.patch: fixes unit tests for new c-ares - Update to 20.10.0:
* --experimental-default-type flag to flip module defaults
* The new flag --experimental-detect-module can be used to
automatically run ES modules when their syntax can be detected.
* Added flush option in file system functions for fs.writeFile functions
* Added experimental WebSocket client
* vm: fix V8 compilation cache support for vm.Script. This fixes
performance regression since v16.x when support for
importModuleDynamically was added to vm.Script
For details, see
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed - Update to 20.9.0:
* No changes, just LTS transition - fix_ci_tests.patch: adapt for openssl 3.1.4 - Add nodejs20-zlib-1.3.patch: Support zlib version with only
major.minor versions, like zlib 1.3. - Security fixes relase 20.8.1
* (CVE-2023-44487, bsc#1216190): nghttp2 Security Release
* (CVE-2023-45143, bsc#1216205): undici Security Release
* (CVE-2023-39332, bsc#1216271): Path traversal through path stored in Uint8Array
* (CVE-2023-39331, bsc#1216270): Permission model improperly protects against path traversal
* (CVE-2023-38552, bsc#1216272): Integrity checks according to policies can be circumvented
* (CVE-2023-39333, bsc#1216273): Code injection via WebAssembly export names
- fix_ci_tests.patch: refreshed - Update to 20.8.0:
* Stream performance improvements
* Rework of memory management in vm APIs with the importModuleDynamically
option
* test_runner:
+ accept testOnly in run
+ add junit reporter
- fix_ci_tests.patch: refreshed - Update to 20.7.0:
* src: support multiple --env-file declarations
* deps: upgrade npm to 10.1.0
* doc: move and rename loaders section
* lib: add api to detect whether source-maps are enabled
* src,permission: add multiple allow-fs-* flags
* test_runner: expose location of tests
- z13.patch: upstreamed - Update to 20.6.1:
* f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: removed, upstreamed - f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: fixes issues with
Angular and other software that tries to load ECM modules in
somewhat circular fashion ending up with multiple executions. - Update to 20.6.0:
* add support for .env files to configure envrionment variables
* import.meta.resolve unflagged
* deps: npm updated to 9.8.1
- nodejs.keyring: updated to include current upstream releasers - Temporarily bundle ICU for SLE15 SP6 (jsc#PED-4819) - Update to version 20.5.1:
* (CVE-2023-32002, bsc#1214150): Policies can be bypassed
via Module._load (High)
* (CVE-2023-32558, bsc#1214155): process.binding() can bypass
the permission model through path traversal (High)
* (CVE-2023-32004, bsc#1214152): Permission model can be bypassed
by specifying a path traversal sequence in a Buffer (High)
* (CVE-2023-32006, bsc#1214156): Policies can be bypassed
by module.constructor.createRequire (Medium)
* (CVE-2023-32559, bsc#1214154): Policies can be bypassed
via process.binding (Medium)
* (CVE-2023-32005, bsc#1214153): fs.statfs can bypass
the permission model (Low)
* (CVE-2023-32003, bsc#1214151): fs.mkdtemp() and fs.mkdtempSync()
can bypass the permission model (Low)
- Changes in 20.5.0:
* events: allow safely adding listener to abortSignal
* fs: add a fast-path for readFileSync utf-8
* test_runner: add shards support
- Changes in 20.4.0:
* tls: add ALPNCallback server option for dynamic ALPN negotiation
* adds support for ECMAScript Explicit Resource Management
* adds Mock Timer support to test module
For details see,
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.5.1
versioned.patch: refreshed - Update to version 20.3.1 (security fixes only). The following
CVEs are fixed in this release:
* (CVE-2023-30581, bsc#1212574): mainModule.__proto__ Bypass
Experimental Policy Mechanism (High)
* (CVE-2023-30584, bsc#1212575): Path Traversal Bypass in
Experimental Permission Model (High)
* (CVE-2023-30587, bsc#1212576): Bypass of Experimental
Permission Model via Node.js Inspector (High)
* (CVE-2023-30582, bsc#1212577): Inadequate Permission Model
Allows Unauthorized File Watching (Medium)
* (CVE-2023-30583, bsc#1212578): Bypass of Experimental
Permission Model via fs.openAsBlob() (Medium)
* (CVE-2023-30585, bsc#1212579): Privilege escalation via
Malicious Registry Key manipulation during Node.js
installer repair process (Medium)
* (CVE-2023-30586, bsc#1212580): Bypass of Experimental
Permission Model via Arbitrary OpenSSL Engines (Medium)
* (CVE-2023-30588, bsc#1212581): Process interuption due to invalid
Public Key information in x509 certificates (Medium)
* (CVE-2023-30589, bsc#1212582): HTTP Request Smuggling via
Empty headers separated by CR (Medium)
* (CVE-2023-30590, bsc#1212583): DiffieHellman does not
generate keys after setting a private key (Medium) - Update to version 20.3.0:
* deps: upgrade to libuv 1.45.0, including significant performance
improvements to file system operations on Linux
* module: change default resolver to not throw on unknown scheme
* stream: deprecate asIndexedPairs
- versioned.patch, fix_ci_tests.patch: refreshed
- openssl3_1-adapt_tests.patch: upstreamed and removed
For details see,
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.3.0 - Fix build on SLE12SP5 - Update to version 20.2.0:
* http: prevent writing to the body when not allowed by HTTP spec
* sea: add option to disable the experimental SEA warning
* test_runner: add skip, todo, and only shorthands to test
* url: add value argument to URLSearchParams has and delete methods
For details see,
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.2.0 - fix_ci_tests.patch: increase default timeout on unit tests
to 20min from 2min. This seems to have lead to build failures
on some platforms, like s390x in Factory. (bsc#1211407) - z13.patch: fixes illegal instruction error on z13 and older s390 - Adapt tests for OpenSSL 3.1 [bsc#1209430]
* Add openssl3_1-adapt_tests.patch - Update to version 20.1.0
assert: deprecate CallTracker
dns: expose getDefaultResultOrder
doc: add KhafraDev to collaborators
fs: add recursive option to readdir and opendir
fs: add support for mode flag to specify the copy behavior
of the cp methods
http: add highWaterMark option http.createServer
stream: preserve object mode in compose
test_runner: add testNamePatterns to run API
test_runner: execute before hook on test
test_runner: support combining coverage reports
wasi: make returnOnExit true by default - Package new version 20.0.0
For overview of changes and details since 19.x and earlier see
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.0.0
- imported the following patches from prior patches:
+ cares_public_headers.patch
+ fix_ci_tests.patch
+ flaky_test_rerun.patch
+ legacy_python.patch
+ linker_lto_jobs.patch
+ manual_configure.patch
+ node-gyp-addon-gypi.patch
+ node-gyp-config.patch
+ nodejs-libpath.patch
+ npm_search_paths.patch
+ openssl_binary_detection.patch
+ qemu_timeouts_arches.patch
+ skip_no_console.patch
+ sle12_python3_compat.patch
+ test-skip-y2038-on-32bit-time_t.patch
+ versioned.patch h01-ch4d 1737629249
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~ 20.18.2-150600.3.9.1 nodejs20-docs api addons.html addons.json addons.md all.html all.json assert.html assert.json assert.md assets api.js hljs.css js-flavor-cjs.svg js-flavor-esm.svg style.css async_context.html async_context.json async_context.md async_hooks.html async_hooks.json async_hooks.md buffer.html buffer.json buffer.md child_process.html child_process.json child_process.md cli.html cli.json cli.md cluster.html cluster.json cluster.md console.html console.json console.md corepack.html corepack.json corepack.md crypto.html crypto.json crypto.md debugger.html debugger.json debugger.md deprecations.html deprecations.json deprecations.md dgram.html dgram.json dgram.md diagnostics_channel.html diagnostics_channel.json diagnostics_channel.md dns.html dns.json dns.md documentation.html documentation.json documentation.md domain.html domain.json domain.md embedding.html embedding.json embedding.md errors.html errors.json errors.md esm.html esm.json esm.md events.html events.json events.md fs.html fs.json fs.md globals.html globals.json globals.md http.html http.json http.md http2.html http2.json http2.md https.html https.json https.md index.html index.json index.md inspector.html inspector.json inspector.md intl.html intl.json intl.md module.html module.json module.md modules.html modules.json modules.md n-api.html n-api.json n-api.md net.html net.json net.md os.html os.json os.md packages.html packages.json packages.md path.html path.json path.md perf_hooks.html perf_hooks.json perf_hooks.md permissions.html permissions.json permissions.md policy.html policy.json policy.md process.html process.json process.md punycode.html punycode.json punycode.md querystring.html querystring.json querystring.md readline.html readline.json readline.md repl.html repl.json repl.md report.html report.json report.md single-executable-applications.html single-executable-applications.json single-executable-applications.md stream.html stream.json stream.md string_decoder.html string_decoder.json string_decoder.md synopsis.html synopsis.json synopsis.md test.html test.json test.md timers.html timers.json timers.md tls.html tls.json tls.md tracing.html tracing.json tracing.md tty.html tty.json tty.md url.html url.json url.md util.html util.json util.md v8.html v8.json v8.md vm.html vm.json vm.md wasi.html wasi.json wasi.md webcrypto.html webcrypto.json webcrypto.md webstreams.html webstreams.json webstreams.md worker_threads.html worker_threads.json worker_threads.md zlib.html zlib.json zlib.md /usr/share/doc/packages/ /usr/share/doc/packages/nodejs20-docs/ /usr/share/doc/packages/nodejs20-docs/api/ /usr/share/doc/packages/nodejs20-docs/api/assets/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:37163/SUSE_SLE-15-SP6_Update/1518963054bbffc12800ec7022ce8cb8-nodejs20.SUSE_SLE-15-SP6_Update drpm xz 5 x86_64-suse-linux
directory HTML document, UTF-8 Unicode text, with very long lines C++ source, UTF-8 Unicode text HTML document, ASCII text, with very long lines Java source, ASCII text ASCII text exported SGML document, ASCII text, with very long lines UTF-8 Unicode text C++ source, ASCII text Java source, UTF-8 Unicode text exported SGML document, UTF-8 Unicode text exported SGML document, ASCII text C source, UTF-8 Unicode text ASCII text, with very long lines Java source, ASCII text, with very long lines UTF-8 Unicode text, with very long lines HTML document, ASCII text C source, ASCII text Algol 68 source, UTF-8 Unicode text z|' .f8 utf-8 616a058a3c4cc913d36969d89438656c1899e46fb0ef2401f0b7f94f4f37b197 ? P 7zXZ
! t/] "k%bka^Q0G[2PCS )s7EY-6jqb̘, ֒sǶIf]*^nslH~{*gu,JUw\}Re9ցUcGՍ1C D*'2^? gB"3ʋ ,"DYYm"Syxr(ؒ{?vD '[ nB5KΙk E"/&p"Bzə)x+ i͍4'߰_5EQ
u?o dVũ( Q .Z ^.B]7Y/6yk8VD:mQh 8JbI&? "3Ť+6(9
BaiċʌeF)}6nK@:'-巽Lٖ^)? 4LFึ
A$J]OAӣ[F81Ѵt0CVo%DThRO =+_٠9&PLWl/p`ҿQBIJ݂@hC6L Qi(گF]1$NDW$68ퟧr *9n=w_>IXt g*5?!V"{uz,R_o _)J Y~LBqه(R9nYΎLw^7Ndc8Ʊ)[.p*yDՈ Ы>i4 aS -9X| `j`je[e{ n [S=f se bc?R'*`YI8] ݈^W)ߞh R.T!Vw~WrĪ3&p:{LSѿ`M< j>N7aPY
z11$I]-1'/Ь܀j@,k{^f&q'$82gڵck2/U{9`QH_k٫, {3Ӑ
CGq`k(!fw^yj g )~j]U Y?+-K6u_b@dla`k撀'q)EL!ɔ;m*r[NYMRcUh3YǿlڷCԔks*. [kn_cBW4v)D熩zjIeoT lBFkKߜ TP2
~<٭}T2xۗJca14)J3*?GkX'V1X,i2K kuޜQJ\TgzCcs' ^)J: nxQzۏ. 3'aW#Ks1NtQأ&feޒ0Q_
FDV
xM, .,]-IS9d䰏Tu]rV le"|+fwnJ.>Abkb( A0 wdGIp1Z,Mr OKxc u@qdj%|%,p<#ȓ_
M8NU$.{L;I A
3+ՒR?K=pLSU#J\ +?r
yjUoLsIAHRn< },Rh#A)"{ sՌ *+b|"t+ƛ#R}xe'\@,lv6wkYXE^apnʠbD/!V[yqG8+G.p^ݲl9n#0e'Pdy2XE#`dQa { !sfϾlqσL kz%]f<_^DpRL$rSrsO&b =pLIIcx6F:.nUդaL $ҀLSm
;2t.}i-'}xݮov Twm+N Mo{ F"J1L :-0ԎqhCJK-nYG2dSX/%)vl[]spe!asbJwJ
#%ƗD]BHgze=>iE j}g X V8: Ǎ+m]I} !
U>vs7HM{1Ui
%+Gw`riq@KtBbb硣;
y 2=Ų) 82:i J"z:;8ycݬ N:/]&: 6.}&`"h"{>{QΤDrHJ$C% RgMtb_ӠNs5aVP;uV1JK
&Q!Ǖ\{H[
?r|&Э0`,4
Ԅe4G{!1_f8~BQwZ~c~DcCt0MZ}J7ǯ[( b!ܫ32IX@(_QАf3HI l b["Vo:H[F$ {Gi 4iԳX͐=.ɤAv)c MMӪ[9,Dއg]j#,>{1GËטvk o3ƒ_)=)
Mb|V۸@LGE8wշQȵyzߴ8 nJHjfjvÞxb ǁƖ;s?W5Npi*%<~jwjN\[XA'c⬘> TQ~LAFa.ВlL}
:c6/a((Zzl4n5S? )X&JgjL i#-0y,gUyL_SǬQGC+T^W@S
7Oҷsz\]51{>M/q;eNx; PWD$眓Ļ~SOU5D +4Qlw2~v& ǾMUǷK6Xk Lk (