linux/meta-openembedded.git/meta-oe/recipes-devtools/nodejs, branch whinlatter

nodejs: mark CVE-2026-21710 patched

2026-05-08T01:52:44+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-21710 The CVE is fixed in the current recipe version[1], but NVD tracks it without verison info. Mark it as patched in the recipe. [1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit b483760dba76bb66bad820ea0246a38692c28c45) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nodejs: ignore fixed CVEs

2026-04-24T15:43:20+00:00

All these CVEs are fixed in v22.22.2[1], except for CVE-2026-21712, which does not affect v22 series, because it was introduced in a later version[2]. All these CVEs are tracked without version info by NVD at the time of creating this patch. [1]: https://github.com/nodejs/node/blob/v22.x/doc/changelogs/CHANGELOG_V22.md [2]: https://nodejs.org/en/blog/vulnerability/march-2026-security-releases Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nodejs: upgrade 22.22.1 -> 22.22.2

2026-04-24T15:43:20+00:00

This is the March 2026 security release. 2 high severity issues. 5 medium severity issues. 2 low severity issues. High priority fixes: CVE-2026-21637 CVE-2026-21710 Medium priority fixes: CVE-2026-21711 (affects only nodejs v25) CVE-2026-21712 (affects only nodejs v24 & v25) CVE-2026-21713 CVE-2026-21714 CVE-2026-21717 Low priority fixes: CVE-2026-21715 CVE-2026-21716 https://nodejs.org/en/blog/vulnerability/march-2026-security-releases Changelog: https://github.com/nodejs/node/releases/tag/v22.22.2 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj (cherry picked from commit d32cd27eaaa13b296c268df234d2fb2cefa62946) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nodejs: upgrade 22.22.0 -> 22.22.1

2026-04-24T15:43:20+00:00

License Update: Add sorttable.js under the MIT license - https://github.com/nodejs/node/pull/61348/files Update minimatch to the Blue Oak Model License - https://github.com/nodejs/node/commit/e72da8c7544727f90b857ba86b8c7755e631fe96 Changelog: https://github.com/nodejs/node/releases/tag/v22.22.1 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj (cherry picked from commit db05f827bb680d6e12e27ed55adf6b32688f7466) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nodejs: upgrade 22.21.1 -> 22.22.0

2026-02-03T02:37:27+00:00

This is the December 2025 security release that the nodejs team released January 13, 2026. 3 high severity issues. 4 medium severity issues. 1 low severity issue. High priority fixes: CVE-2025-55131 CVE-2025-55130 CVE-2025-59465 Medium priority fixes: CVE-2025-59466 CVE-2025-59464 CVE-2026-21636 * CVE-2026-21637 Low priority fixes: CVE-2025-55132 * note that this medium priority CVE only effects Nodejs v25. https://nodejs.org/en/blog/vulnerability/december-2025-security-releases Changelog: https://github.com/nodejs/node/releases/tag/v22.22.0 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj (cherry picked from commit 0bb156371e433cf3e9fdc4291da2319d63a83575) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nodejs: remove extra CVE_PRODUCT

2026-01-20T04:45:16+00:00

CVE_PRODUCT is specified twice - the second instance only duplicates one value from the first instance. Remove this extra CVE_PRODUCT. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 6ff92524842233efb68eb92d4bf7637ef378900d) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nodejs: fix gcc compile failed for 32 bit arm target

2025-10-30T16:37:15+00:00

Use gcc to compile failed for 32 bit arm target $ echo 'MACHINE = "qemuarm"' >> conf/local.conf $ bitbake nodejs ... 2645 | ); | ^ ../deps/llhttp/src/llhttp.c:2643:11: error: incompatible type for argument 1 of 'vandq_u16' 2643 | vcgeq_u8(input, vdupq_n_u8(' ')), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | uint8x16_t ... Use '-flax-vector-conversions' to permit conversions between vectors with differing element types or numbers of subparts Signed-off-by: Hongxu Jia Signed-off-by: Khem Raj

nodejs: upgrade 22.21.0 -> 22.21.1

2025-10-29T17:14:13+00:00

Changelog: https://github.com/nodejs/node/releases/tag/v22.21.1 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj

nodejs: upgrade 22.20.0 -> 22.21.0

2025-10-21T02:46:58+00:00

Changelog: https://github.com/nodejs/node/releases/tag/v22.21.0 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj

nodejs: upgrade 22.19.0 -> 22.20.0

2025-09-24T21:17:45+00:00

Chagelog: https://github.com/nodejs/node/releases/tag/v22.20.0 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj