2016-09-27 Version 0.12.16 (Maintenance) Release

    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable changes:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
    * http:
      - CVE-2016-5325 - Properly validate for allowable characters in the
        `reason` argument in `ServerResponse#writeHead()`. Fixes a
        possible response splitting attack vector. This introduces a new
        case where `throw` may occur when configuring HTTP responses,
        users should already be adopting try/catch here. Originally
        reported independently by Evan Lucas and Romain Gaucher.
        (Evan Lucas)
      - Invalid status codes can no longer be sent. Limited to 3 digit
        numbers between 100 - 999. Lack of proper validation may also
        serve as a potential response splitting attack vector. Backported
        from v4.x. (Brian White)
    * openssl:
      - Upgrade to 1.0.1u, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-6303,
        CVE-2016-2178 and CVE-2016-6306.
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted
        into Node.js at runtime by masquerading as one of the dynamic
        engine modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis, Rod Vagg)
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in
      the wildcard string. Originally reported by Alexander Minozhenko
      and James Bunton (Atlassian). (Ben Noordhuis)

Signed-off-by: Ilkka Myller <[email protected]>

Author: imyller

README.md

@@ -9,7 +9,7 @@ OpenEmbedded layer for latest [Node.js](https://nodejs.org/ "Node.js") releases.
 
  * ![Current 6](https://img.shields.io/badge/Node.js%20Current-6.6.0-green.svg)
  * ![LTS 4](https://img.shields.io/badge/Node.js%20LTS-4.5.0-blue.svg)
- * ![Maintenance 0.12](https://img.shields.io/badge/Node.js%20Maintenance-0.12.15-lightgray.svg)
+ * ![Maintenance 0.12](https://img.shields.io/badge/Node.js%20Maintenance-0.12.16-lightgray.svg)
  * ![Maintenance 0.10](https://img.shields.io/badge/Node.js%20Maintenance-0.10.47-lightgray.svg)
  * ![Legacy 0.8](https://img.shields.io/badge/Node.js%20Legacy-0.8.28-lightgrey.svg)
 

recipes-devtools/nodejs/nodejs_0.12.15.bb

@@ -0,0 +1,8 @@
+require nodejs_0.inc
+
+INC_PR = "r1"
+
+LIC_FILES_CHKSUM = "file://LICENSE;md5=14115ff11211df04b031ec7d40b6d31b"
+
+SRC_URI[md5sum] = "36a612f2e7b759bec812cfbd47162a67"
+SRC_URI[sha256sum] = "312c0b74b0815f0514de9bf00667850d4f6ce184126f02f3d8dbf40fd48235eb"