version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (0)
The CVE record lists the packaged version 24.21.0_3 as affected, and no VuXML entry names the CVE. What does this mean?
None.
VuXML only (1)
Listed in VuXML, the packaged version 24.21.0_3 is still in the affected range; pkg audit reports it. What does this mean?
www/node: Update to 6.9.1
Bump to the latest upstream 6.x release. Node.js v6 is now an LTS
release, see the v6.9.0 release announcement for details. The v6.9.0
release was also a security release, while v6.9.1 fixes a regression
introduced in v6.8.0.
Cleanup clang vs. gcc handling by using USES=compiler:c++-lib
https://nodejs.org/en/blog/release/v6.9.0/
https://nodejs.org/en/blog/release/v6.9.1/
https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/
PR: 213604
Security: CVE-2016-5180
- Update devel/icu to 57.1. - Clean up the Makefile. - Follow some upstream recommendations (--with-data-packaging=archive, --disable-renaming, -DICU_NO_USER_DATA_OVERRIDE). - Patch makefiles to install static libraries with INSTALL_DATA so they aren't stripped. - Patch config/mh-bsd-gcc to sync with config/mh-linux-gcc. - Fix endianness detection in ICU. The code wanted to use BYTE_ORDER d
PR: 205120
Exp-run by: antoine
Approved by: portmgr (antoine)
www/node: 6.2.2 -> 6.3.0
- buffer: Added buffer.swap64() to complement swap16() & swap32().
- build: New configure options have been added for building Node.js as
a shared library.
o The options are: --shared, --without-v8-platform & --without-bundled-v8.
- crypto: Root certificates have been updated.
- debugger: The server address is now configurable via
--debug=<address>:<port>.
- npm: Upgraded npm to v3.10.3
- readline: Added the prompt option to the readline constructor.
- repl / vm: sigint/ctrl+c will now break out of infinite loops without
stopping the Node.js instance.
- src:
o Added a node::FreeEnvironment public C++ API.
o Refactored require('constants'), constants are now available
directly from their respective modules. (James M Snell) #6534
- stream: Improved readable.read() performance by up to 70%.
- timers: setImmediate() is now up to 150% faster in some situations.
- util: Added a breakLength option to util.inspect() to control how
objects are formatted across lines.
- v8-inspector: Experimental support has been added for debugging
Node.js over the inspector protocol.
o Note: This feature is experimental, and it could be altered or removed.
o You can try this feature by running Node.js with the --inspect flag.
PR: 210893
Changes: https://nodejs.org/en/blog/release/v6.3.0/
Submitted by: Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
Bump PORTREVISION for the icu revert.
This time not bumping lang/php70, but devel/php70-intl which is the one
really depending on icu.
PR: 205120
With hat: portmgr
Sponsored by: Absolight
www/node: 6.2.1 -> 6.2.2
- http:
o req.read(0) could cause incoming connections to stall and time out
under certain conditions. (Fedor Indutny) #7211
o When freeing the socket to be reused in keep-alive Agent wait for both
prefinish and end events. Otherwise the next request may be written
before the previous one has finished sending the body, leading to
parser errors. (Fedor Indutny) #7149
- npm:
o upgrade npm to 3.9.5 (Kat Marchan) #7139 (not relevant)
PR: 210518
Changes: https://nodejs.org/en/blog/release/v6.2.2/
Submitted by: Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
www/node[45]: work around build breakages due to include path ordering
Add a post-configure step to strip out all occurrences of
-I${LOCALBASE}/include. Rely instead on USES+=localbase to tell the
compiler where to find includes from external dependencies.
After r416894, node.js builds will use external dependencies instead of
bundled ones. Fallout from this changes includes several build
breakages. All come from the fact that the node-gyp build process adds
-I${LOCALBASE}/include to CFLAGS before all others, including its own
bundled dependencies. This causes the build to incorrectly pick up
include files from any packages in ${LOCALBASE}, rather than the bundled
libraries as intended.
PR: 210618
Submitted by: Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
Revert part of r417063 that wasn't supposed to be committed. It removed a -I/usr/local/include, but it's present elsewhere in the CFLAGS so it doesn't change the final product.
PR: 210400
Submitted by: maintainer (Bradley T. Hughes)
Change python from a run to a build dep of www/node
Change python from a run to a build dep of www/node. The current version of
node doesn't install any Python files.
PR: 210309
Reviewed by: Bradley T. Hughes (Maintainer)
Approved by: pi (ports)
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D6699
Prefer external libraries to the ones bundled with node.
Do not statically link bundled libraries into node.js. It requires
openssl 1.0.2, so pull that in from ports when the base version is not
new enough. While all versions use c-ares, only www/node has a configure
knob to enable building against an unbundled version. All other
dependencies are specified in www/node/common.mk and used by all 3
ports.
node cannot build against LibreSSL, so if it's the chosen SSL provider,
the BUNDLED_SSL option must be enabled.
The www/node010 and www/node012 ports have not been done since both are
deprecated and have very old bundled dependencies that are not available
in ports.
PR: 209793
Submitted by: Bradley T. Hughes (maintainer)
www/node: 6.0.0 -> 6.1.0
Update to the latest upstream v6.x current release after the recent
openssl CVEs. This release also includes several semver minor changes.
Release announcment with changelog is here:
https://nodejs.org/en/blog/release/v6.1.0/
https://nodejs.org/en/blog/vulnerability/openssl-may-2016/
PR: 209342
Submitted by: Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
www/node: 5.11.0 -> 6.0.0 New port: www/node5, to ease migration from node-5.x to node-6.x
This new major version of Node.js delivers significant improvements
in performance, reliability, usability and security. Module loading
is nearly four times faster than in Node.js v4, tests and documentation
have seen significant improvements, usability of the Buffer and
File System APIs have been improved, and Node.js now supports 93%
of ES6 language features, thanks to V8 version 5.0.
The full release announcement can be read here:
https://nodejs.org/en/blog/release/v6.0.0/
The full changelog is available on Github:
https://github.com/nodejs/node/commit/ce3e3c5fe15479475c068482c48eb9cbf1ac9df5
For node5:
node.js v5.x will only be supported for a few months to give people
time to move to v6. This new port is marked as deprecated with an
expiration date of July 1, allowing all of May and June to transition.
See https://nodejs.org/en/blog/release/v6.0.0/#what-about-node-js-v5
PR: 209215, 209216
Submitted by: Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
During the exp-run in bug 208158, it was found that www/node gives errors with libc++ 3.8.0 [1]:
/usr/include/c++/v1/map:837:5: error: static_assert failed "Allocator::value_type must be same type as value_type"
static_assert((is_same<typename allocator_type::value_type, value_type>::value),
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../deps/v8/src/compiler/js-type-feedback.h:41:21: note: in instantiation of template class 'std::__1::map<unsigned int, v8::internal::TypeFeedbackId, std::__1::less<unsigned int>, v8::internal::zone_allocator<v8::internal::TypeFeedbackId> >' requested here
TypeFeedbackIdMap type_feedback_id_map_;
^
This is because libc++ 3.8.0 has added these sanity checks for custom
std::map allocators, which *must* be of the type std::pair<const Key,
Value>. I fixed the few std::map instances in the node source by adding
this to their allocator types.
Approved by: linpct@gmail.com (maintainer)
PR: 208270
MFH: 2016Q2
www/node: Fix build on FreeBSD 9.x
Patch log-utils.h in the in-tree v8 source code, allowing it to compile
using G++ 4.8 on FreeBSD 9.x. The code unfortunately relies on compiler
intrinsics instead of including the necessary standard headers for
handling C-style I/O and variadic arguments in its internal logging
functions.
This commit log and the code changes were provided by:
Brendan Molloy (fmtq via IRC) - Thank you!
PR: 205401
Reported by: JSG (via freenode IRC)
Approved by: blanket (portmgr)
Replace USE_GCC=4.8+ by USE_GCC=yes. Both are equivalent as of today, and generally we want to use the default version of GCC in cases like these.
Approved by: portmgr blanket