import CS nodejs-20.19.2-1.module_el9+1241+94a933ca

2025-09-15 09:36:21 +00:00 · 2025-09-15 09:36:21 +00:00 · 19097882fd
commit 19097882fd
parent fd0f4161ed
8 changed files with 3966 additions and 30 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,6 +1,6 @@
 SOURCES/cjs-module-lexer-1.4.1.tar.gz
-SOURCES/icu4c-75_1-src.tgz
-SOURCES/node-v20.18.1-stripped.tar.gz
-SOURCES/undici-6.20.0.tar.gz
+SOURCES/icu4c-76_1-src.tgz
+SOURCES/node-v20.19.2-stripped.tar.gz
+SOURCES/undici-6.21.2.tar.gz
 SOURCES/wasi-sdk-12.tar.gz
 SOURCES/wasi-sdk-20.tar.gz
--- a/.nodejs.metadata
+++ b/.nodejs.metadata
@ -1,6 +1,6 @@
-bea4d977983331b0e1a981762f83e17d1de824cd SOURCES/cjs-module-lexer-1.4.1.tar.gz
-da3614aa496c5f0fde12f7aa155f235b5e239f1b SOURCES/icu4c-75_1-src.tgz
-d2195b84a5cd236120899925c86f4eecfadb6e2e SOURCES/node-v20.18.1-stripped.tar.gz
-af43a8ef082653c9c0b5d965b48e1994804a9ec1 SOURCES/undici-6.20.0.tar.gz
+327c9c409bcda11ac331186b5eabb27bb78df43e SOURCES/cjs-module-lexer-1.4.1.tar.gz
+f7764341d196112573605881dbbf10e586d84841 SOURCES/icu4c-76_1-src.tgz
+6132b5ebb4d8b517894c0ed53fdc79d2a2b80b35 SOURCES/node-v20.19.2-stripped.tar.gz
+097218619f01200e237b6b93d0ddcb10f34883d7 SOURCES/undici-6.21.2.tar.gz
 5ea3a1deb65a52a36ceb41324da690f54b2a4805 SOURCES/wasi-sdk-12.tar.gz
 da40abcb73a6dddafced6174d24ed49e414cda3c SOURCES/wasi-sdk-20.tar.gz
--- a/SOURCES/0001-Disable-running-gyp-on-shared-deps.patch
+++ b/SOURCES/0001-Disable-running-gyp-on-shared-deps.patch
@ -1,4 +1,4 @@
-From 2da7f25d9311bdea702b4b435830c02ce78b3ab9 Mon Sep 17 00:00:00 2001
+From 6167666f43da361b2a1eda0a14d42c5b8cb9ae0d Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Tue, 30 May 2023 13:12:35 +0200
 Subject: [PATCH] Disable running gyp on shared deps
@ -10,10 +10,10 @@ Signed-off-by: rpm-build <rpm-build>
 2 files changed, 1 insertion(+), 18 deletions(-)

 diff --git a/Makefile b/Makefile
-index 7bd80d0..c43a50f 100644
+index 8e09820..fdd951b 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -169,7 +169,7 @@ with-code-cache test-code-cache:
+@@ -171,7 +171,7 @@ with-code-cache test-code-cache:
 	$(warning '$@' target is a noop)
 
 out/Makefile: config.gypi common.gypi node.gyp \
@ -23,10 +23,10 @@ index 7bd80d0..c43a50f 100644
 	tools/v8_gypfiles/toolchain.gypi tools/v8_gypfiles/features.gypi \
 	tools/v8_gypfiles/inspector.gypi tools/v8_gypfiles/v8.gyp
 diff --git a/node.gyp b/node.gyp
-index 4aac640..aa0ba88 100644
+index 33bc7d9..a216c41 100644
 --- a/node.gyp
 +++ b/node.gyp
-@@ -775,23 +775,6 @@
+@@ -797,23 +797,6 @@
               ],
             },
           ],
@ -51,5 +51,5 @@ index 4aac640..aa0ba88 100644
       ],
     }, # node_core_target_name
 -- 
-2.44.0
+2.49.0

--- a/SOURCES/0002-Disable-FIPS-options.patch
+++ b/SOURCES/0002-Disable-FIPS-options.patch
@ -1,4 +1,4 @@
-From 4caaf9c19d3c058f5b89ecd9fc721ee49370651a Mon Sep 17 00:00:00 2001
+From 9ce5049040b915f8274fef3e6a8d7b3833eda6b0 Mon Sep 17 00:00:00 2001
 From: Michael Dawson <midawson@redhat.com>
 Date: Fri, 23 Feb 2024 13:43:56 +0100
 Subject: [PATCH] Disable FIPS options
@ -50,8 +50,9 @@ index 1216f3a..fbfcb26 100644
     if (val) return;
     throw new ERR_CRYPTO_FIPS_FORCED();
 diff --git a/lib/internal/errors.js b/lib/internal/errors.js
--- a/lib/internal/errors.js.patch0002	2024-08-07 15:29:09.366357433 +0200
-+++ b/lib/internal/errors.js	2024-08-07 15:29:14.392366591 +0200
+index c03e285..77830fa 100644
+--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1112,6 +1112,12 @@ module.exports = {
 //
 // Note: Node.js specific errors must begin with the prefix ERR_
@ -66,7 +67,7 @@ diff --git a/lib/internal/errors.js b/lib/internal/errors.js
   function(msg, permission = '', resource = '') {
     this.permission = permission;
 diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
-index 5734d8f..ef9d1b1 100644
+index 990638e..51bd1d7 100644
 --- a/src/crypto/crypto_util.cc
 +++ b/src/crypto/crypto_util.cc
@@ -121,6 +121,8 @@ bool ProcessFipsOptions() {
@ -79,5 +80,5 @@ index 5734d8f..ef9d1b1 100644
     OSSL_PROVIDER* fips_provider = OSSL_PROVIDER_load(nullptr, "fips");
     if (fips_provider == nullptr)
 -- 
-2.44.0
+2.49.0

--- a/SOURCES/npmrc
+++ b/SOURCES/npmrc
@ -1,2 +1,4 @@
 prefix=/usr/local
 python=/usr/bin/python3
+update-notifier=false
+
--- a/SOURCES/test-runner.sh
+++ b/SOURCES/test-runner.sh
@ -0,0 +1,60 @@
+#!/bin/bash
+	
+NODE_BIN="$1"
+PARENT_TEST_FOLDER="$2"
+TEST_LIST_FILE="$3"
+
+# At most 10 min per test
+TIMEOUT_DURATION=600
+# Exit code
+FINAL_RESULT=0 	
+ARCH=$(uname -m)
+
+echo "Started test run:"
+# Run the list of test
+while IFS= read -r test_line; do
+  # ignore commented lines
+  if [[ "$test_line" =~ ^# ]]; then
+    continue
+  fi
+  # If test has specified ARCH which it should be skipped
+  # Extract it
+  TEST_PATH=$(echo "$test_line" | awk '{print $1}')
+  IGNORE_ARCHES=$(echo "$test_line" |\
+    awk '{for (i=2; i<=NF; i++) printf "%s ", $i; print ""}')
+  
+  # Skip test for specified ARCH
+  for ARCH_IGNORE in $IGNORE_ARCHES; do
+    if [[ "$ARCH_IGNORE" == "$ARCH" ]]; then
+      continue 2  
+    fi
+  done
+  
+  # Construct test path
+  TEST_SCRIPT="$PARENT_TEST_FOLDER/$TEST_PATH"
+
+  if [ ! -f "$TEST_SCRIPT" ]; then
+    echo "Test script not found: $TEST_SCRIPT"
+    continue
+  fi
+
+  TEST_OUTPUT=$(timeout "$TIMEOUT_DURATION" "$NODE_BIN" "$TEST_SCRIPT" 2>&1)
+  TEST_RESULT=$?
+
+  # Handle test result
+  if [ $TEST_RESULT -ne 0 ]; then
+    FINAL_RESULT=1
+    if [ $TEST_RESULT -eq 124 ]; then
+      echo "Test timed out: $TEST_SCRIPT"
+    else
+      echo "Test failed: $TEST_SCRIPT"
+    fi
+    echo "Test failure message:"
+    echo "$TEST_OUTPUT"
+  fi
+done < "$TEST_LIST_FILE"
+
+if [ $FINAL_RESULT -eq 0 ]; then
+    echo "All tests succesfully passed."
+fi
+exit $FINAL_RESULT
--- a/SOURCES/test-should-pass.txt
+++ b/SOURCES/test-should-pass.txt
--- a/SPECS/nodejs.spec
+++ b/SPECS/nodejs.spec
@ -43,8 +43,8 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 20
-%global nodejs_minor 18
-%global nodejs_patch 1
+%global nodejs_minor 19
+%global nodejs_patch 2
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
 %global nodejs_soversion 115
@ -68,10 +68,10 @@

 # c-ares - from deps/cares/include/ares_version.h
 # https://github.com/nodejs/node/pull/9332
-%global c_ares_version 1.33.1
+%global c_ares_version 1.34.5

 # llhttp - from deps/llhttp/include/llhttp.h
-%global llhttp_version 8.1.2
+%global llhttp_version 9.2.1

 # libuv - from deps/uv/include/uv/version.h
 %global libuv_version 1.46.0
@ -86,7 +86,7 @@
 %global ngtcp2_version 1.1.0

 # ICU - from tools/icu/current_ver.dep
-%global icu_major 75
+%global icu_major 76
 %global icu_minor 1
 %global icu_version %{icu_major}.%{icu_minor}

@ -105,10 +105,10 @@
 %endif

 # simduft from deps/simdutf/simdutf.h
-%global simduft_version 5.5.0
+%global simdutf_version 6.0.3

 # ada from deps/ada/ada.h
-%global ada_version 2.9.0
+%global ada_version 2.9.2

 # OpenSSL minimum version
 %global openssl_minimum 1:1.1.1
@ -131,7 +131,7 @@

 # Node.js 16.9.1 and later comes with an experimental package management tool
 # corepack - from deps/corepack/package.json
-%global corepack_version 0.28.1
+%global corepack_version 0.31.0

 # uvwasi - from deps/uvwasi/include/uvwasi.h
 %global uvwasi_version 0.0.21
@ -180,11 +180,13 @@ Source101: cjs-module-lexer-1.4.1.tar.gz
 Source111: https://github.com/WebAssembly/wasi-sdk/archive/refs/tags/wasi-sdk-12.tar.gz

 # Version: jq '.version' deps/undici/src/package.json
-# Original: https://github.com/nodejs/undici/archive/refs/tags/v6.20.0.tar.gz
-# Adjustments: rm -f undici-6.20.0/lib/llhttp/llhttp*.wasm
+# Original: https://github.com/nodejs/undici/archive/v6.21.2/undici-v6.21.2.tar.gz
+# Adjustments: rm -f undici-v6.21.2/lib/llhttp/llhttp*.wasm
 # wasi-sdk version can be found in lib/llhttp/wasm_build_env.txt
-Source102: undici-6.20.0.tar.gz
+Source102: undici-6.21.2.tar.gz
 Source112: https://github.com/WebAssembly/wasi-sdk/archive/refs/tags/wasi-sdk-20.tar.gz
+Source300: test-runner.sh
+Source301: test-should-pass.txt

 # Disable running gyp on bundled deps we don't use
 Patch1: 0001-Disable-running-gyp-on-shared-deps.patch
@ -289,7 +291,7 @@ Provides: bundled(histogram) = %{histogram_version}
 %if %{with corepack}
 Provides: bundled(corepack) = %{corepack_version}
 %endif
-Provides: bundled(simduft) = %{simduft_version}
+Provides: bundled(simdutf) = %{simdutf_version}
 Provides: bundled(ada) = %{ada_version}

 # Make sure we keep NPM up to date when we update Node.js
@ -553,6 +555,13 @@ install -Dpm0644 -t %{buildroot}%{icudatadir} deps/icu/source/converted/*


 %check
+#run unit test that should pass from list
+LD_LIBRARY_PATH=%{buildroot}%{_libdir} \
+  bash %{SOURCE300} \
+       %{buildroot}/%{_bindir}/node \
+       %{_builddir}/node-v%{nodejs_version}/test/ \
+       %{SOURCE301}
+
 # Fail the build if the versions don't match
 %{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.node, '%{nodejs_version}')"
 %{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.v8.replace(/-node\.\d+$/, ''), '%{v8_version}')"
@ -567,6 +576,11 @@ NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/nod
 # Make sure i18n support is working
 NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/node_modules/npm/node_modules LD_LIBRARY_PATH=%{buildroot}%{_libdir} %{buildroot}/%{_bindir}/node --icu-data-dir=%{buildroot}%{icudatadir} %{SOURCE2}

+# Ensure npm's update notifier has been disabled
+LD_LIBRARY_PATH=%{buildroot}%{_libdir} \
+%{buildroot}%{_bindir}/node \
+%{buildroot}%{_bindir}/npm \
+--globalconfig=%{buildroot}$(LD_LIBRARY_PATH=%{buildroot}%{_libdir} %{buildroot}%{_bindir}/node %{buildroot}%{_bindir}/npm config get globalconfig) config ls -l --json | jq -e '.["update-notifier"] == false'

 %files
 %{_bindir}/node
@ -634,6 +648,26 @@ NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/nod


 %changelog
+* Thu May 15 2025 Andrei Radchenko <aradchen@redhat.com> - 1:20.19.2-1
+- Update to version 20.19.2
+  Resolves: RHEL-92865 RHEL-88876 RHEL-91597
+
+* Thu Apr 24 2025 Andrei Radchenko <aradchen@redhat.com> - 1:20.19.1-1
+- Update to version 20.19.1
+  Resolves: RHEL-78764
+
+* Tue Apr 15 2025 Jan Staněk <jstanek@redhat.com> - 1:20.18.2-3
+- Update c-ares to 1.34.5 to address CVE-2025-31498
+
+* Wed Mar 05 2025 Andrei Radchenko <aradchen@redhat.com> - 1:20.18.2-2
+- Disable npm's update-notifier
+  Resolves: RHEL-81078
+
+* Wed Jan 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:20.18.2-1
+- Update to version 20.18.2
+  Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150
+  Resolves: RHEL-76363 RHEL-76554 RHEL-76540
+
 * Wed Dec 04 2024 Jan Staněk <jstanek@redhat.com> - 1:20.18.1-1
 - Update to version 20.18.1