Bug 263090 - www/node14: Update to 14.19.3 (includes security fixes)
Summary: www/node14: Update to 14.19.3 (includes security fixes)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Joseph Mingrone
URL: https://github.com/nodejs/node/blob/v...
Keywords: needs-qa
Depends on: 261789
Blocks:
  Show dependency treegraph
 
Reported: 2022-04-06 14:00 UTC by Dani I.
Modified: 2022-06-08 01:30 UTC (History)
6 users (show)

See Also:
bugzilla: maintainer-feedback? (bhughes)
koobs: merge-quarterly?


Attachments
Update to 14.19.1 (1.90 KB, patch)
2022-04-06 14:00 UTC, Dani I.
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dani I. 2022-04-06 14:00:27 UTC
Created attachment 232999 [details]
Update to 14.19.1

www/node14: Update to 14.19.1
- Update to 14.19.1
- Add COREPACK option
- Changelog: https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V14.md#14.19.1
Comment 1 Derek Schrock 2022-05-16 00:56:26 UTC
I thought I updated this bug on 5/12 however it appears I didn't.

Running with the attached patch updated:

 - Update to 14.9.2
 - pkg-plist
 - added test
 - python 3.10 (263133)
 - patch to fix openssl test

Review up at https://reviews.freebsd.org/D35192

Based off 263133, 263590, 263133  can we get a wellness check on the maintainer?
Comment 2 Alex Rosenberg 2022-05-19 04:31:31 UTC
(In reply to Derek Schrock from comment #1)
I've poked him on Twitter, where he was active yesterday.
Comment 3 Derek Schrock 2022-05-21 20:34:59 UTC
Review updated to 14.19.3
Comment 4 Kubilay Kocak freebsd_committer freebsd_triage 2022-05-26 00:17:09 UTC
^Triage: Assignee/maintainer timeout (>1 month), open to take. VuXML added via bug   261789

@Derek Given this will be merged to quarterly:

- Are there performance implications for the ssl patch to node.gyp?

- What is the nature of the COREPACK additional (by default), as it relates to and compares to existing functionality of the ports current version?

- Depending on the build system design, CONFIGURE_* options can be non deterministic, and there is no CONFIGURE_ON to match the CONFIGURE_OFF addition here.

Did you try COREPACK_CONFIGURE_WITH=corepack? 

This will set a value in both OPTIONS value cases explicitly, rather than rely on build system defaults.

# ${opt}_CONFIGURE_WITH         Will add to CONFIGURE_ARGS:
#                               Option enabled  --with-${content}
#                               Option disabled --without-${content}
Comment 5 Kubilay Kocak freebsd_committer freebsd_triage 2022-05-26 00:19:54 UTC
Comment on attachment 232999 [details]
Update to 14.19.1

patch obsoleted by 14.19.3 review
Comment 6 Derek Schrock 2022-05-26 00:48:00 UTC
(In reply to Kubilay Kocak from comment #4)

> - Are there performance implications for the ssl patch to node.gyp?

There shouldn't be.  This is a previous patch reworked for 14.19.x codebase.
https://cgit.freebsd.org/ports/tree/www/node14/files/patch-node.gypi?id=0464754ea1f56c60d43945f6da2d9127a6a80527

> - What is the nature of the COREPACK additional (by default), as it relates to and compares to existing functionality of the ports current version?

From my understanding corepack is taking third-party package managers and building them into by a proxy such that don't need to be installed else where.  I don't want to say it's the same thing but kinda of ensurepipish...? 

This is experimental feature and I wanted to disable to by default however given that www/node16 enabled it by default I figured we would follow suit here.

> - Depending on the build system design, CONFIGURE_* options can be non deterministic, and there is no CONFIGURE_ON to match the CONFIGURE_OFF addition here.
> Did you try COREPACK_CONFIGURE_WITH=corepack? 


There isn't a --with-corepack in node configure script so I believe that's why it's _OFF only and not a _WITH.

$ ./configure --with-corepack ; echo $?
Node.js configure: Found Python 3.8.13...
Usage: configure [options]

configure: error: no such option: --with-corepack
2

So unless if upstream changes the script I don't with a _WITH would work here.
Comment 7 Juraj Lutter freebsd_committer freebsd_triage 2022-05-27 16:13:17 UTC
corepack configure option is on by default, with --without-corepack that actually disables corepack.
Comment 8 Derek Schrock 2022-05-28 22:35:54 UTC
Also, how does this depend on 261789?  All the node ports are independent of each other.
Comment 9 Kubilay Kocak freebsd_committer freebsd_triage 2022-05-29 03:53:15 UTC
^Triage: Depends on bug 261789 for VuXML
Comment 10 commit-hook freebsd_committer freebsd_triage 2022-06-08 01:27:13 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=8850edb8172d8562c80ac510d0c4a96a6f26d120

commit 8850edb8172d8562c80ac510d0c4a96a6f26d120
Author:     Derek Schrock <dereks@lifeofadishwasher.com>
AuthorDate: 2022-06-07 17:06:06 +0000
Commit:     Joseph Mingrone <jrm@FreeBSD.org>
CommitDate: 2022-06-08 01:26:07 +0000

    www/node14: Upgrade to 14.19.3

    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V14.md#14.19.3

    This update is based on a patch from Dani I. <i.dani@outlook.com> that
    was originally attached to the PR.

    This update addresses CVE-2021-44531/44532/44533, CVE-2022-0778, and
    CVE-2022-21824.

    Notable port additions:

    - COREPACK option [1]
    - test target
    - python 3.10 build support
    - patch for failing test due to FreeBSD OpenSSL adding "-freebsd" to
      version string

    [1] Corepack is an experimental tool to help with managing versions of
    your package managers. It exposes binary proxies for each supported
    package manager that, when called, will identify whatever package
    manager is configured for the current project, transparently install it
    if needed, and finally run it without requiring explicit user
    interactions.

    PR:             263090
    Approved by:    bhughes (maintainer, timeout)
    Differential Revision:  https://reviews.freebsd.org/D35192

 www/node14/Makefile                                | 124 +++++++++++----------
 www/node14/distinfo                                |   6 +-
 www/node14/files/patch-node.gypi                   |  10 +-
 ...ch-test_parallel_test-process-versions.js (new) |  11 ++
 www/node14/pkg-plist                               |  57 ++++++++++
 5 files changed, 141 insertions(+), 67 deletions(-)
Comment 11 commit-hook freebsd_committer freebsd_triage 2022-06-08 01:30:15 UTC
A commit in branch 2022Q2 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=7d351f62b50fa17e6ec9061cabc7c53f34e0b1b2

commit 7d351f62b50fa17e6ec9061cabc7c53f34e0b1b2
Author:     Derek Schrock <dereks@lifeofadishwasher.com>
AuthorDate: 2022-06-07 17:06:06 +0000
Commit:     Joseph Mingrone <jrm@FreeBSD.org>
CommitDate: 2022-06-08 01:29:01 +0000

    www/node14: Upgrade to 14.19.3

    https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V14.md#14.19.3

    This update is based on a patch from Dani I. <i.dani@outlook.com> that
    was originally attached to the PR.

    This update addresses CVE-2021-44531/44532/44533, CVE-2022-0778, and
    CVE-2022-21824.

    Notable port additions:

    - COREPACK option [1]
    - test target
    - python 3.10 build support
    - patch for failing test due to FreeBSD OpenSSL adding "-freebsd" to
      version string

    [1] Corepack is an experimental tool to help with managing versions of
    your package managers. It exposes binary proxies for each supported
    package manager that, when called, will identify whatever package
    manager is configured for the current project, transparently install it
    if needed, and finally run it without requiring explicit user
    interactions.

    PR:             263090
    Approved by:    bhughes (maintainer, timeout)
    Differential Revision:  https://reviews.freebsd.org/D35192

    (cherry picked from commit 8850edb8172d8562c80ac510d0c4a96a6f26d120)

 www/node14/Makefile                                | 124 +++++++++++----------
 www/node14/distinfo                                |   6 +-
 www/node14/files/patch-node.gypi                   |  10 +-
 ...ch-test_parallel_test-process-versions.js (new) |  11 ++
 www/node14/pkg-plist                               |  57 ++++++++++
 5 files changed, 141 insertions(+), 67 deletions(-)