devel/electron38: Update to 38.7.2
While here:
- switch to use USE_ELECTRON features of electron.mk for specifying
node package manager, pre-fetching necessary node modules, and
extracting the node modules into appropriate directories
- use USES=display for starting/stopping display server on testing
- specify TEST_ENV instead of listing env vars in test target
Changelog: https://github.com/electron/electron/releases/tag/v38.7.2
security/dropbear: update to 2025.89
Changelog:
- Security: Avoid privilege escalation via unix stream forwarding in Dropbear
server. Other programs on a system may authenticate unix sockets via
SO_PEERCRED, which would be root user for Dropbear forwarded connections,
allowing root privilege escalation.
Reported by Turistu, and thanks for advice on the fix.
This is tracked as CVE-2025-14282, and affects 2024.84 to 2025.88.
It is fixed by dropping privileges of the dropbear process after
authentication. Unix stream sockets are now disallowed when a
forced command is used, either with authorized_key restrictions or
"dropbear -c command".
In previous affected releases running with "dropbear -j" (will also disable
TCP fowarding) or building with localoptions.h/distrooptions.h
"#define DROPBEAR_SVR_LOCALSTREAMFWD 0" is a mitigation.
[38 lines not shown]
