alt-nodejs12-nodejs (12.22.12-31) stable; urgency=medium

  * ALTNJS-295: derive the alt-nodejs12-npm package version from the bundled
    npm version and debian/changelog in debian/rules, so every Debian revision
    bump also changes the npm package version. Up to now it came only from
    debian/alt-nodejs12-npm.changelog, and the Debian rebuild in build
    6a8cac054c34bf1292240b1a re-shipped the npm package under its previous
    version with different contents.

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 05 Oct 2026 18:37:13 +0400

alt-nodejs12-nodejs (12.22.12-30) stable; urgency=medium

  * SECURITY UPDATE: https.Agent socket-pool names built from a `pfx` array of
    { buf, passphrase } objects collapse to the literal `[object Object]`, so
    requests configured with different mTLS client certificates share one pool
    entry and can reuse each other's authenticated socket or TLS session
    (CVE-2026-56850)
    - debian/patches/CVE-2026-56850.patch: add getPfxAgentKey() to
      lib/https.js and route the `pfx` leg of Agent.prototype.getName()
      through it, so an array-valued `pfx` contributes each entry's raw
      certificate buffer and its effective passphrase to the pool name; a
      non-array `pfx` keeps the name it had. Also adds the upstream
      regression tests test/parallel/test-https-agent-getname.js (new
      assertions) and test/parallel/test-https-agent-pfx-object-array-reuse.js
    - CVE-2026-56850

  * SECURITY UPDATE: dns.resolveAny() aborts the process when a DNS reply
    carries more than 256 A records, which a hostile or merely large
    authoritative answer can trigger repeatedly for a denial of service
    (CVE-2026-58042)
    - debian/patches/CVE-2026-58042.patch: in src/cares_wrap.cc, replace the
      fixed ares_addrttl[256] / ares_addr6ttl[256] TTL buffers with
      std::vectors sized from the reply's ANCOUNT via the new
      GetAnswerCountForTTLBuffer() and MakeAddrTTLBuffer() helpers, so
      naddrttls can no longer come back clamped below the record count and
      trip CHECK_EQ(naddrttls, a_count); also adds the regression test
      test/parallel/test-dns-resolveany-ttl-overflow.js
    - CVE-2026-58042

  * SECURITY UPDATE: the synchronous node:zlib entry points abort the process
    when handed a TypedArray whose byteLength is spoofed with a getter, which
    can be repeated for a denial of service (CVE-2026-58045)
    - debian/patches/CVE-2026-58045.patch: in src/node_zlib.cc, turn the two
      CHECK(Buffer::IsWithinBounds(...)) assertions in
      CompressionStream::Write() into THROW_ERR_OUT_OF_RANGE() so an
      out-of-bounds input or output buffer raises a catchable RangeError with
      code ERR_OUT_OF_RANGE instead of aborting; also adds the upstream
      regression assertions to test/parallel/test-zlib-invalid-input.js
    - CVE-2026-58045

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 18 Sep 2026 12:00:00 +0000

alt-nodejs12-nodejs (12.22.12-29) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 header blocks retained by open streams escape the
    maxSessionMemory accounting
    - debian/patches/CVE-2026-56846.patch: keep a decoded HTTP/2 header block
      charged against maxSessionMemory while the JS objects built from it can
      still keep it alive. A new Http2Stream::retained_headers_length_
      accumulates what Http2Session::HandleHeadersFrame() used to un-charge
      the moment it handed the headers up to JS, and
      Http2Session::RemoveStream() drains both counters when the stream leaves
      the session. A peer that opens many streams with large header blocks and
      never lets them complete can therefore no longer hold unbounded header
      memory alive while the credit-based limit reads as near zero. Node 12's
      RemoveStream() takes the stream as a parameter rather than looking it up
      by id, and its now-redundant un-charge in Http2Stream::~Http2Stream() is
      removed so the counter is not decremented twice (backport of nodejs/node
      f14d78b9e0)
    - CVE-2026-56846
  * SECURITY UPDATE: HTTP/2 use-after-free via re-entrant RST_STREAM for a
    refused stream
    - debian/patches/CVE-2026-56848.patch: stop
      Http2Stream::SubmitRstStream() from force-purging the session's pending
      outbound data for a refused stream. Resetting a stream that nghttp2
      refused after a GOAWAY happens from inside a receive callback, where
      session_->SendPendingData() re-enters nghttp2_session_mem_send() while
      nghttp2_session_mem_recv() is still on the stack and can close and free
      streams the active receive operation is still using. Such a reset now
      goes out through FlushRstStream() alone, extending to
      NGHTTP2_REFUSED_STREAM the deferral that already covered
      NGHTTP2_CANCEL (backport of nodejs/node daa6d25e3d)
    - CVE-2026-56848

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 04 Sep 2026 00:00:00 +0000

alt-nodejs12-nodejs (12.22.12-28) stable; urgency=medium

  * SECURITY UPDATE: --inspect DNS rebinding via permissive IP validation
    - debian/patches/CVE-2022-43548.patch: rewrite the inspector's
      IsIPAddress() to parse IPv4 (dotted-decimal only) and bracketed IPv6
      hosts with uv_inet_pton(), rejecting octal, hexadecimal and leading-zero
      octet formats and treating 0.0.0.0/8 and ::/128 as non-routable, so a
      Host header IP that a browser resolves differently can no longer bypass
      the inspector host allow-list (backport of nodejs/node 2b433af094,
      with follow-up 73fa9ab7a5 folded in so the IPv6 string terminator
      is written inside the INET6_ADDRSTRLEN buffer)
    - CVE-2022-43548

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 31 Aug 2026 14:54:05 +0000

alt-nodejs12-nodejs (12.22.12-27) stable; urgency=medium

  * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header
    termination in the bundled HTTP parsers
    - debian/patches/CVE-2025-23167.patch: restore message-framing terminator
      validation in both HTTP/1 parsers Node 12 bundles. In the loose
      (non-strict) state machine of the bundled llhttp 2.1.6, which Node
      compiles by default (LLHTTP_STRICT_MODE is never set):
      headers_almost_done, chunk_size_almost_done and the
      chunk_data_almost_done / chunk_data_almost_done_skip pair now require the
      LF (resp. CR then LF) after a CR instead of consuming any byte, and
      res_line_almost_done requires the LF after the response status line's CR;
      each accept/reject edge was derived from the loose machine's own goto
      graph rather than by copying the strict machine's labels, which are not
      interchangeable between the two halves. Node 12 additionally still
      bundles the legacy deps/http_parser 2.9.4 -- node.gypi links it alongside
      llhttp and --http-parser=legacy (also settable through NODE_OPTIONS)
      selects it at runtime -- and it is built with HTTP_PARSER_STRICT=0, which
      compiles its terminator assertions away; the same five framing checks are
      made unconditional there via a new FRAMING_CHECK macro. A header block
      ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with
      HPE_STRICT instead of silently swallowing the byte and parsing the bytes
      that follow as a second, smuggled request (no upstream Node.js 12 fix
      exists -- 12.x went EOL long before disclosure, and upstream fixed this by
      replacing the parser wholesale with llhttp 9; approximated from llhttp
      6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2)
    - CVE-2025-23167

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Thu, 20 Aug 2026 12:00:00 +0000

alt-nodejs12-nodejs (12.22.12-26) stable; urgency=medium

  * ALTNJS-285: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Tue, 18 Aug 2026 11:33:06 +0400

alt-nodejs12-nodejs (12.22.12-25) stable; urgency=medium

  * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode
    dot separators
    - debian/patches/CVE-2026-48618.patch: normalize the peer hostname with
      domainToASCII() before splitting it into DNS labels in
      tls.checkServerIdentity(), so the verifier counts the same labels the
      resolver connected to; U+3002, U+FF0E and U+FF61 can no longer defeat
      the wildcard-depth rule in check() and make a certificate for
      *.example.com authenticate a host two levels below it. Includes the
      required IPv6 IP-Address-SAN follow-up so IPv6 literals keep matching
      their IP SANs (backport of nodejs/node 1efb4ff51a and 1d87a24050)
    - CVE-2026-48618
  * SECURITY UPDATE: uppercase SNI mTLS authorization bypass
    - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the RegExp
      built by tls.Server.prototype.addContext(), so an uppercase or
      mixed-case SNI hostname selects its per-hostname SecureContext as
      RFC 6066 Section 3 requires instead of silently falling back to the
      server's default context and bypassing per-tenant client-certificate
      authorization in multi-context mTLS deployments
      (backport of nodejs/node 39d1d09684)
    - CVE-2026-48928
  * SECURITY UPDATE: TLS session replay skips host identity verification
    - debian/patches/CVE-2026-48934.patch: bind a reusable TLS client
      session to the host it was authenticated for, so a session obtained
      from host A can no longer be replayed against host B to skip
      checkServerIdentity() through isSessionReused(); adds
      wrapSessionState()/getSessionForReuse() and an explicit
      TLSSocket.prototype.getSession(). The fix's optional chaining is
      rewritten to && form because Node 12's V8 7.8 has no ?.
      (backport of nodejs/node fd890ba01d)
    - CVE-2026-48934
  * SECURITY UPDATE: https.Agent reuses connections authenticated under a
    different identity check
    - debian/patches/CVE-2026-58040.patch: bind identity checks to session
      and socket reuse in the https.Agent, the vector CVE-2026-48934 left
      open. A request supplying its own checkServerIdentity is tagged with a
      unique per-request index, which Agent.prototype.getName() now appends,
      so it gets its own pool bucket; createConnection() neither reads nor
      writes the TLS session cache for it, and a new keepSocketAlive()
      override keeps its socket out of freeSockets. A later request using
      the default strict check can therefore no longer inherit a session or
      a keep-alive socket that was authenticated under permissive rules and
      be reported authorized against an unverified host
      (backport of nodejs/node 51123159fe)
    - CVE-2026-58040

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 13 Aug 2026 00:00:00 +0000

alt-nodejs12-nodejs (12.22.12-24) stable; urgency=medium

  * SECURITY UPDATE: HTTP client response-queue poisoning via unsolicited
    data on idle keep-alive sockets
    - debian/patches/CVE-2026-48931.patch: attach a 'data' guard to sockets
      parked in the http.Agent freeSockets pool and destroy the socket if
      anything arrives while it is idle, so bytes injected by a malicious or
      compromised server can no longer be buffered and then parsed as the
      response to the *next* request that reuses the socket
      (backport of nodejs/node 179ddaedfb)
    - CVE-2026-48931
  * SECURITY UPDATE: HTTP/2 session leak on internally-generated GOAWAY
    - debian/patches/CVE-2026-48937.patch: detect a GOAWAY that nghttp2
      queued on its own initiative (e.g. on a frame larger than
      SETTINGS_MAX_FRAME_SIZE) -- a path that reports success to its caller
      and therefore fires no error callback -- and invoke the session error
      callback with NGHTTP2_ERR_PROTO once the frame is flushed, so the
      Http2Session, its streams and its socket are released instead of being
      retained indefinitely by a peer that repeats the trigger cheaply
      (backport of nodejs/node 4a32c00fb8, adapted: Node 12 has no
      graceful-close state machine, so that guard is dropped)
    - CVE-2026-48937

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 11 Aug 2026 00:00:00 +0000

alt-nodejs12-nodejs (12.22.12-23) stable; urgency=medium

  * SECURITY UPDATE: HTTP/2 client unbounded ORIGIN-frame memory growth
    - debian/patches/CVE-2026-48619.patch: cap the HTTP/2 client originSet
      at 128 entries (new maxOriginSetSize connect option) so a malicious
      server can no longer drive unbounded memory growth by sending repeated
      ORIGIN frames; the session is destroyed with the new
      ERR_HTTP2_TOO_MANY_ORIGINS error once the cap is exceeded
      (backport of nodejs/node c79968e108)
    - CVE-2026-48619
  * SECURITY UPDATE: embedded-NUL hostname authority rebinding
    - debian/patches/CVE-2026-48930.patch: reject hostnames containing an
      embedded NUL byte in dns.lookup(), dnsPromises.lookup() and
      net.connect()/net.createConnection() by adding
      validateStringWithoutNullBytes, preventing silent authority rebinding
      caused by C-string truncation in the resolver bindings
      (backport of nodejs/node 7dafafa2)
    - CVE-2026-48930
  * SECURITY UPDATE: cipher output-length signed integer overflow
    - debian/patches/CVE-2026-48933.patch: guard the legacy
      CipherBase::Update() output-length computation against signed-int
      overflow (reject when len + block_size > INT_MAX), turning ~2 GiB
      one-shot crypto.createCipheriv().update() inputs into a clean failure
      instead of an out-of-bounds write; legacy-path analog of the WebCrypto
      fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto)
    - CVE-2026-48933

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 02 Jul 2026 00:00:00 +0000

alt-nodejs12-nodejs (12.22.12-22) stable; urgency=medium

  * SECURITY UPDATE: experimental policy bypass via mainModule.__proto__
    - debian/patches/CVE-2023-30581.patch: set the policy-wrapped require on
      Module.prototype and assign process.mainModule via setOwnProperty so
      process.mainModule.__proto__.require() can no longer load modules not
      declared in the policy manifest (backport of nodejs/node d0a8264ec9);
      includes the upstream regression test in test/parallel/test-policy-manifest.js
      adapted for node 12 (new policy-manifest fixtures)
    - CVE-2023-30581
  * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service
    - debian/patches/CVE-2023-44487.patch: backport the nghttp2 RST_STREAM
      rate-limit mitigation into bundled deps/nghttp2 (token-bucket limiter,
      default burst 1000 / rate 33, GOAWAY with INTERNAL_ERROR on exhaustion)
      so rapidly reset HTTP/2 streams no longer exhaust server resources
      (backport of nghttp2 72b4af6, shipped in nghttp2 1.57.0)
    - CVE-2023-44487

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 09 Jun 2026 00:00:00 +0000

alt-nodejs12-nodejs (12.22.12-21) stable; urgency=medium

  * SECURITY UPDATE: HashDoS via V8 array-index hash collisions
    - debian/patches/CVE-2026-21717.patch: scramble V8 array-index hash_field
      with a 3-round xorshift-multiply so consecutive numeric strings no
      longer hash to consecutive buckets, preventing O(n^2) HashDoS via
      JSON.parse
    - CVE-2026-21717

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Thu, 28 May 2026 12:00:00 +0000

alt-nodejs12-nodejs (12.22.12-20) stable; urgency=medium

  * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow
    - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in
      OnInvalidFrame so Http2Session is destroyed after invalid connection-level
      WINDOW_UPDATE instead of leaking
    - CVE-2026-21714

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 21 May 2026 12:00:00 +0200

alt-nodejs12-nodejs (12.22.12-19) stable; urgency=medium

  * ALTNJS-254: Initial build for arm platforms
  * Use alt-libicu73 instead of alt-libicu71 on Debian >= 13

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Wed, 25 Mar 2026 12:00:00 +0400

alt-nodejs12-nodejs (12.22.12-17) stable; urgency=high

  * SECURITY UPDATE: Stack overflow exception handling in async_hooks
    - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions
      in async_hooks instead of calling FatalException
    - CVE-2025-59466
  * SECURITY UPDATE: TLS callback exception handling vulnerability
    - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through
      error handlers to prevent remote attackers from crashing TLS servers
    - CVE-2026-21637

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Tue, 10 Feb 2026 14:00:00 +0100

alt-nodejs12-nodejs (12.22.12-16) stable; urgency=medium

  * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability
    - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation
      to remove zero-fill toggle mechanism that could expose uninitialized
      memory when using vm module with timeout options
    - CVE-2025-55131

 -- Wojciech Tatarski <wtatarski@cloudlinux.com>  Mon, 09 Feb 2026 17:30:00 +0000

alt-nodejs12-nodejs (12.22.12-15) stable; urgency=medium

  * SECURITY UPDATE: Remote crash vulnerability
    - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler
      to prevent unhandled rejection on abrupt socket close
    - CVE-2025-59465

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 05 Feb 2026 13:20:00 +0100

alt-nodejs12-nodejs (12.22.12-14) stable; urgency=medium

  * SECURITY UPDATE: Node.js zlib denial of service vulnerability
    - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer
      is full to prevent resource exhaustion during decompression
    - CVE-2024-22025

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 15 Dec 2025 11:00:00 +0000

alt-nodejs12-nodejs (12.22.12-13) stable; urgency=medium

  * SECURITY UPDATE: Marvin Attack vulnerability in Node.js
    – debian/patches/CVE-2023-46809.patch: fix a timing‑side‑channel
      flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style
      padding‑oracle attack that could allow recovery of sensitive data.
    – CVE-2023-46809

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Tue, 09 Dec 2025 14:10:00 +0000

alt-nodejs12-nodejs (12.22.12-12) stable; urgency=medium

  * SECURITY UPDATE: Node.js improper handling of OBS folded headers
    - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default
    - CVE-2024-27982

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 04 Dec 2025 15:54:00 +0000
 
alt-nodejs12-nodejs (12.22.12-11) stable; urgency=medium

  * SECURITY UPDATE: Node.js HTTP parsing vulnerabilities
    - debian/patches/CVE-2022-32213-32214-32215-35256.patch: fix llhttp parser to properly
      validate HTTP headers and prevent request smuggling attacks:
      * CVE-2022-32213: fix missing CR validation in header separators to prevent
        HTTP request smuggling via malformed headers
      * CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
        and repeated chunked encoding values
      * CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
        attacks via conflicting encoding declarations
      * CVE-2022-35256: fix header overflow calculation to properly detect and
        reject oversized HTTP headers
    - CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-35256

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 01 Dec 2025 08:43:00 +0000

alt-nodejs12-nodejs (12.22.12-10) stable; urgency=medium

  * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability
    - debian/patches/CVE-2024-22019.patch: fix improper exception handling
      in SignTraits::DeriveBits() that could lead to remote denial of service
      (process crash) when malformed input is processed
    - CVE-2024-22019

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Fri, 28 Nov 2025 16:50:00 +0000

alt-nodejs12-nodejs (12.22.12-9) stable; urgency=medium

  * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability
    - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check
      function to prevent tampering with Hash class internals in policy
      mechanism
    - CVE-2023-38552

 -- Ivan Kuliashov <ikuliashov@cloudlinux.com>  Wed, 26 Nov 2025 15:50:51 +0000

alt-nodejs12-nodejs (12.22.12-8) stable; urgency=medium

  * Build for Ubuntu 20.04 / 22.04 / 24.04.

    - debian/patches/fix-cstdint-ubuntu24.patch: add a missing include in v8 header

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Tue, 25 Nov 2025 23:49:00 +0400

alt-nodejs12-nodejs (12.22.12-7) stable; urgency=medium

  * Fix build for debian 11.

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Mon, 24 Nov 2025 10:54:00 +0000

alt-nodejs12-nodejs (12.22.12-6) stable; urgency=high

  * SECURITY UPDATE: Node.js OS Command Injection vulnerability
    - debian/patches/CVE-2022-32212.patch: fix IPv4 validation in inspector_socket to properly
      validate IP addresses and reject non-routable IPs (0.0.0.0/8), replace vulnerable
      dot-counting parser with proper octet validation, add tests
    - CVE-2022-32212

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 20 Nov 2025 12:28:51 +0000

alt-nodejs12-nodejs (12.22.12-5) stable; urgency=medium

  * update version, add patches and logs for debian
  * SECURITY UPDATE: Node.js vulnerabilities

    - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR
      in HTTP header fields, add lenient flag checks before allowing CR without LF,
      add test file to verify the fix prevents request smuggling attacks
    - CVE-2023-30589

    - debian/patches/CVE-2023-32559.patch: disable process.binding() when policy is enabled;
      update deprecations and errors docs and add new tests ensuring denial behavior
    - CVE-2023-32559

    - debian/patches/CVE-2023-30590.patch: update documentation and add tests
      clarifying DH generateKeys behavior
    - CVE-2023-30590

    - debian/patches/CVE-2023-23918.patch: prevent process.mainModule.require()
      policy bypass
    - CVE-2023-23918

    - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities
      in experimental policy mechanism:
      * CVE-2023-32002: prevent Module.constructor._load() bypass by adding
        constructor property protection
      * CVE-2023-32006: prevent require.main.constructor and require.extensions
        bypass by implementing secure module loading validation
    - CVE-2023-32002, CVE-2023-32006

    - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to prevent
      out-of-bounds read when parsing configuration files with embedded NULL characters
    - CVE-2024-25629

    - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep
      sub-folders to address unlimited sub-folders vulnerability
    - CVE-2024-28863

    - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket
      close or invalid header (ERR_PROTO)
    - CVE-2025-23085

    - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams during session
      destruction to prevent memory leak and DoS
    - CVE-2024-27983

 -- Krystyna Tomaszewa <ktomaszewa@cloudlinux.com>  Thu, 20 Nov 2025 08:51:00 +0000

alt-nodejs12-nodejs (12.22.12-4) stable; urgency=medium

  * ALTNJS-229: Build for debian 12.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 19 Nov 2025 14:20:00 +0200

alt-nodejs12-nodejs (12.22.12-2) stable; urgency=medium

  * ALTNJS-223: initial build for Debian.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 05 Nov 2025 14:20:00 +0200
