Skip to content

Draft: [3.21] main/nodejs: security upgrade 22.13.1

Fabricio Silva requested to merge fabricionaweb/aports:3.21/nodejs into 3.21-stable

Attempt to bump main/nodejs to fixes and close #16868 (closed)

  • CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
  • CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
  • CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Removed patches:

  • unbundle-sqlite: merged in 22.12.0
    • [edbbd4a374] - build: conditionally compile bundled sqlite (Richard Lau) #55409
  • unbundle-ada-simdjson-simdutf: merged in 22.13.0
    • [8d70b99a5a] - build: compile bundled simdutf conditionally (Jakub Jirutka) #55886
    • [826fd35242] - build: compile bundled simdjson conditionally (Jakub Jirutka) #55886
    • [1015b22085] - build: compile bundled ada conditionally (Jakub Jirutka) #55886
  • disable-running-gyp-on-shared-deps: merged in 22.13.0
    • [77e2869ca6] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789

Merge request reports