nodejs (4.2.6~dfsg-1ubuntu4.2) xenial-security; urgency=medium

  * SECURITY UPDATE: CRLF injection vulnerability
    - debian/patches/CVE-2016-5325-1.patch: Previously, the reason argument
      passed to ServerResponse#writeHead was not being properly validated. One
      could pass CRLFs which could lead to http response splitting. This
      commit changes the behavior to throw an error in the event any invalid
      characters are included in the reason.
      lib/_http_common.js
      lib/_http_server.js
      test/parallel/test-http-status-reason-invalid-chars.js
    - debian/patches/CVE-2016-5325-2.patch: The certificates in test fixtures
      were set to expire in 999 days since they were generated. That time has
      passed, and they have to be reissued. Bump expiration time to 99999 days
      for all of them to prevent this from happening again in near future.
    - CVE-2016-5325

 -- Mike Salvatore <mike.salvatore@canonical.com>  Wed, 08 Aug 2018 10:16:51 -0400

nodejs (4.2.6~dfsg-1ubuntu4.1) xenial; urgency=medium

  * Recompile to resolve miscompilation on s390x architecture. LP:
    #1572613

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 20 May 2016 04:30:23 +0100

nodejs (4.2.6~dfsg-1ubuntu4) xenial; urgency=medium

  * Cherrypick
    https://github.com/andrewlow/node/commit/1cc5c2dad018880c95c41f23570df350e99e4621
    to unbreak s390x with gcc 5.3.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 03 Feb 2016 22:49:58 +0000

nodejs (4.2.6~dfsg-1ubuntu1) xenial; urgency=medium

  * debian/patches/fix_sslv3_test.patch: properly handle how SSLv3 was
    disabled in openssl.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 22 Jan 2016 11:08:38 -0500

nodejs (4.2.6~dfsg-1) unstable; urgency=medium

  * Imported Upstream version 4.2.6~dfsg

 -- Jérémy Lal <kapouer@melix.org>  Fri, 22 Jan 2016 00:07:37 +0100

nodejs (4.2.5~dfsg-1) unstable; urgency=medium

  * Imported Upstream version 4.2.5~dfsg
  * Remove no_sslv3 patch, fixed upstream
  * Override lintian missing source sh_javascript.min.js, because
    it is already fixed by removal and patch.

 -- Jérémy Lal <kapouer@melix.org>  Thu, 21 Jan 2016 09:38:25 +0100

nodejs (4.2.4~dfsg-2) unstable; urgency=medium

  * tests need gcc to get DEB_HOST_ARCH,
    add build-essential as dependency. (Closes: #809845)
  * Fix install path of non-minified sh_javascript

 -- Jérémy Lal <kapouer@melix.org>  Thu, 14 Jan 2016 09:39:14 +0100

nodejs (4.2.4~dfsg-1) unstable; urgency=medium

  * Imported Upstream version 4.2.4~dfsg
  * Adapt v8 backport to s390 patch
  * Refresh patches

 -- Jérémy Lal <kapouer@melix.org>  Thu, 24 Dec 2015 00:59:49 +0100

nodejs (4.2.3~dfsg-2) unstable; urgency=medium

  * There is no gcc -mfpu vfpv2 flag - the right flag is vfp
  * Use repacksuffix in debian/watch
  * Run tests as autopkgtests as well:
    + add debian/rules check target to run tests using binary package
    + create/remove a HOME for test
    + disable test-process-config because it needs configured tree
    + test-fs-watch does not work in test bed
    + test-force-repl hangs in test bed
  * Set test timeout to 3 seconds
  * Flaky test-regress-GH-746 because it requires stdin

 -- Jérémy Lal <kapouer@melix.org>  Sun, 20 Dec 2015 03:03:50 +0100

nodejs (4.2.3~dfsg-1) unstable; urgency=high

  * Imported Upstream version 4.2.3~dfsg
  * CVE-2015-6764 V8 Out-of-bounds Access Vulnerability
    (Closes: #806385)
  * CVE-2015-8027 Denial of Service Vulnerability
    (Closes: #806385)
  * Patch: openssl -ssl3 fails immediately causing
    test-tls-no-sslv3 failure.

 -- Jérémy Lal <kapouer@melix.org>  Fri, 04 Dec 2015 09:02:50 +0100

# For older changelog entries, run 'apt-get changelog nodejs'
