Compare commits

..

2 Commits

Author SHA1 Message Date
AlmaLinux RelEng Bot
44f12f7775 import CS nodejs22-22.22.2-1.el10 2026-04-20 09:49:43 -04:00
685bed63d0 import CS nodejs22-22.13.1-4.el10 2025-03-27 13:11:54 +00:00
12 changed files with 7834 additions and 865 deletions

View File

@ -1 +0,0 @@
1

7
.gitignore vendored
View File

@ -1,4 +1,3 @@
/icu4c-*-data-bin-?.zip icu4c-78.2-data-bin-b.zip
/node-*-stripped.tar.gz icu4c-78.2-data-bin-l.zip
/SHASUM* node-v22.22.2-stripped.tar.gz
/node*src.rpm

File diff suppressed because it is too large Load Diff

View File

@ -1,166 +0,0 @@
From d98f88cfa68abef0e57ec2b48df0049032e50c85 Mon Sep 17 00:00:00 2001
From: Beau Gunderson <beau@beaugunderson.com>
Date: Sun, 27 Apr 2026 10:28:29 -0700
Subject: [PATCH] CVE-2026-42338 ip-address HTML escaping fix
Fix HTML escaping in ip-address library to prevent XSS vulnerabilities.
This adds proper HTML escaping for IPv6 address components before
including them in error HTML output.
Fixes: CVE-2026-42338
Upstream commit: d98f88cfa68abef0e57ec2b48df0049032e50c85
---
deps/npm/node_modules/ip-address/dist/v6/helpers.js | 9 +++++++++
deps/npm/node_modules/ip-address/dist/ipv6.js | 32 ++++++++++++++----------
deps/npm/node_modules/ip-address/package.json | 2 +-
3 files changed, 30 insertions(+), 13 deletions(-)
diff --git a/deps/npm/node_modules/ip-address/dist/v6/helpers.js b/deps/npm/node_modules/ip-address/dist/v6/helpers.js
index 1234567..abcdefg 100644
--- a/deps/npm/node_modules/ip-address/dist/v6/helpers.js
+++ b/deps/npm/node_modules/ip-address/dist/v6/helpers.js
@@ -1,14 +1,23 @@
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeHtml = escapeHtml;
exports.spanAllZeroes = spanAllZeroes;
exports.spanAll = spanAll;
exports.spanLeadingZeroes = spanLeadingZeroes;
exports.simpleGroup = simpleGroup;
+function escapeHtml(s) {
+ return s
+ .replace(/&/g, '&amp;')
+ .replace(/</g, '&lt;')
+ .replace(/>/g, '&gt;')
+ .replace(/"/g, '&quot;')
+ .replace(/'/g, '&#39;');
+}
/**
* @returns {String} the string with all zeroes contained in a <span>
*/
function spanAllZeroes(s) {
- return s.replace(/(0+)/g, '<span class="zero">$1</span>');
+ return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
}
/**
* @returns {String} the string with each character contained in a <span>
@@ -16,11 +25,11 @@
function spanAll(s, offset = 0) {
const letters = s.split('');
return letters
- .map((n, i) => `<span class="digit value-${n} position-${i + offset}">${spanAllZeroes(n)}</span>`)
+ .map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`)
.join('');
}
function spanLeadingZeroesSimple(group) {
- return group.replace(/^(0+)/, '<span class="zero">$1</span>');
+ return escapeHtml(group).replace(/^(0+)/, '<span class="zero">$1</span>');
}
/**
* @returns {String} the string with leading zeroes contained in a <span>
@@ -42,4 +51,3 @@
return `<span class="hover-group group-${i + offset}">${spanLeadingZeroesSimple(g)}</span>`;
});
}
-//# sourceMappingURL=helpers.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
index 1234567..abcdefg 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
@@ -17,13 +17,23 @@
}) : function(o, v) {
o["default"] = v;
});
-var __importStar = (this && this.__importStar) || function (mod) {
- if (mod && mod.__esModule) return mod;
- var result = {};
- if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
- __setModuleDefault(result, mod);
- return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+ var ownKeys = function(o) {
+ ownKeys = Object.getOwnPropertyNames || function (o) {
+ var ar = [];
+ for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+ return ar;
+ };
+ return ownKeys(o);
+ };
+ return function (mod) {
+ if (mod && mod.__esModule) return mod;
+ var result = {};
+ if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+ __setModuleDefault(result, mod);
+ return result;
+ };
+})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.Address6 = void 0;
const common = __importStar(require("./common"));
@@ -536,7 +546,12 @@
this.address4 = new ipv4_1.Address4(this.parsedAddress4);
for (let i = 0; i < this.address4.groups; i++) {
if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
- throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", address.replace(constants4.RE_ADDRESS, this.address4.parsedAddress.map(spanLeadingZeroes4).join('.')));
+ // The prefix groups haven't been through the bad-character check
+ // yet, so escape them before including in the error HTML.
+ const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
+ const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
+ const separator = groups.length > 1 ? ':' : '';
+ throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
}
}
this.v4 = true;
@@ -896,10 +911,13 @@
formFunction = this.to4in6;
}
const form = formFunction.call(this);
+ const safeHref = helpers.escapeHtml(`${options.prefix}${form}`);
+ const safeForm = helpers.escapeHtml(form);
if (options.className) {
- return `<a href="${options.prefix}${form}" class="${options.className}">${form}</a>`;
+ const safeClass = helpers.escapeHtml(options.className);
+ return `<a href="${safeHref}" class="${safeClass}">${safeForm}</a>`;
}
- return `<a href="${options.prefix}${form}">${form}</a>`;
+ return `<a href="${safeHref}">${safeForm}</a>`;
}
/**
* Groups an address
@@ -908,13 +926,13 @@
group() {
if (this.elidedGroups === 0) {
// The simple case
- return helpers.simpleGroup(this.address).join(':');
+ return helpers.simpleGroup(this.addressMinusSuffix).join(':');
}
assert(typeof this.elidedGroups === 'number');
assert(typeof this.elisionBegin === 'number');
// The elided case
const output = [];
- const [left, right] = this.address.split('::');
+ const [left, right] = this.addressMinusSuffix.split('::');
if (left.length) {
output.push(...helpers.simpleGroup(left));
}
@@ -1000,4 +1018,3 @@
}
}
exports.Address6 = Address6;
-//# sourceMappingURL=ipv6.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
index 1234567..abcdefg 100644
--- a/deps/npm/node_modules/ip-address/package.json
+++ b/deps/npm/node_modules/ip-address/package.json
@@ -7,7 +7,7 @@
"browser",
"validation"
],
- "version": "10.1.0",
+ "version": "10.1.1",
"author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
"license": "MIT",
"main": "dist/ip-address.js",

File diff suppressed because one or more lines are too long

View File

@ -1,100 +0,0 @@
From 213dc171de329a09f34c7a3222cad723ee65d693 Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Tue, 14 Jul 2026 08:27:05 +0000
Subject: [PATCH] CVE-2026-13149: Fix unbound recursion in brace-expansion
A run of non-expanding {} groups expanded post once per group before the
early returns that never use it, doubling the work on every group. expand()
ran in O(2^n) and blocked for minutes on a ~90 byte input.
Defer expanding post until a brace set is known to expand, and turn the
{a},b} restart into a loop so a long run of {} groups can't exhaust the
call stack.
Adapted from upstream TypeScript fix to the JavaScript version (2.0.2)
vendored in Node.js.
Upstream: https://github.com/juliangruber/brace-expansion/commit/c7e33ec
---
.../npm/node_modules/brace-expansion/index.js | 49 ++++++++++++-------
1 file changed, 32 insertions(+), 17 deletions(-)
diff --git a/deps/npm/node_modules/brace-expansion/index.js b/deps/npm/node_modules/brace-expansion/index.js
index d084bac4..5d5f61ff 100644
--- a/deps/npm/node_modules/brace-expansion/index.js
+++ b/deps/npm/node_modules/brace-expansion/index.js
@@ -99,21 +99,27 @@ function gte(i, y) {
function expand(str, max, isTop) {
var expansions = [];
- var m = balanced('{', '}', str);
- if (!m) return [str];
-
- // no need to expand pre, since it is guaranteed to be free of brace-sets
- var pre = m.pre;
- var post = m.post.length
- ? expand(m.post, max, false)
- : [''];
-
- if (/\$$/.test(m.pre)) {
- for (var k = 0; k < post.length && k < max; k++) {
- var expansion = pre+ '{' + m.body + '}' + post[k];
- expansions.push(expansion);
+ // The {a},b} rewrite below restarts expansion on a rewritten string with
+ // the same max and isTop = true. Loop instead of recursing so a long run
+ // of non-expanding {} groups can't exhaust the call stack.
+ for (;;) {
+ var m = balanced('{', '}', str);
+ if (!m) return [str];
+
+ // no need to expand pre, since it is guaranteed to be free of brace-sets
+ var pre = m.pre;
+
+ if (/\$$/.test(m.pre)) {
+ var post = m.post.length
+ ? expand(m.post, max, false)
+ : [''];
+ for (var k = 0; k < post.length && k < max; k++) {
+ var expansion = pre+ '{' + m.body + '}' + post[k];
+ expansions.push(expansion);
+ }
+ return expansions;
}
- } else {
+
var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
var isSequence = isNumericSequence || isAlphaSequence;
@@ -122,11 +128,20 @@ function expand(str, max, isTop) {
// {a},b}
if (m.post.match(/,(?!,).*\}/)) {
str = m.pre + '{' + m.body + escClose + m.post;
- return expand(str, max, true);
+ isTop = true;
+ continue;
}
return [str];
}
+ // Only expand post once we know this brace set actually expands. Computing
+ // it before the early returns above expanded post a second time on every
+ // non-expanding {}, which is what made inputs like a{},{},{}... blow up
+ // exponentially.
+ var post = m.post.length
+ ? expand(m.post, max, false)
+ : [''];
+
var n;
if (isSequence) {
n = m.body.split(/\.\./);
@@ -200,8 +215,8 @@ function expand(str, max, isTop) {
expansions.push(expansion);
}
}
- }
- return expansions;
+ return expansions;
+ }
}

View File

@ -1,6 +0,0 @@
--- !Policy
product_versions:
- rhel-10
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

View File

@ -1,3 +1,13 @@
## START: Set by rpmautospec
## (rpmautospec version 0.6.5)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 1;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
## END: Set by rpmautospec
# Determine if this should be the default version for this Fedora release # Determine if this should be the default version for this Fedora release
# The default version will own /usr/bin/node and friends # The default version will own /usr/bin/node and friends
%global nodejs_pkg_major 22 %global nodejs_pkg_major 22
@ -28,12 +38,6 @@
%bcond_with bundled_zlib %bcond_with bundled_zlib
%endif %endif
# 2026-05-05: Currently libuv up to date, but if it no longer the case - switch to 1
%bcond bundled_libuv 0
# 2026-05-05: Currently c-ares up to date, but if it no longer the case - switch to 1
%bcond bundled_cares 0
%bcond bundled_sqlite %{with bootstrap} %bcond bundled_sqlite %{with bootstrap}
# LTO is currently broken on Node.js builds # LTO is currently broken on Node.js builds
@ -58,8 +62,8 @@
# than a Fedora release lifecycle. # than a Fedora release lifecycle.
%global nodejs_epoch 1 %global nodejs_epoch 1
%global nodejs_major 22 %global nodejs_major 22
%global nodejs_minor 23 %global nodejs_minor 22
%global nodejs_patch 1 %global nodejs_patch 2
# nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
%global nodejs_soversion 127 %global nodejs_soversion 127
%global nodejs_abi %{nodejs_soversion} %global nodejs_abi %{nodejs_soversion}
@ -82,20 +86,20 @@
%global v8_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release} %global v8_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release}
# zlib - from deps/zlib/zlib.h # zlib - from deps/zlib/zlib.h
%global zlib_version 1.3.1 %global zlib_version 1.3.0.1-motley
# c-ares - from deps/cares/include/ares_version.h # c-ares - from deps/cares/include/ares_version.h
# https://github.com/nodejs/node/pull/9332 # https://github.com/nodejs/node/pull/9332
%global c_ares_version 1.34.6 %global c_ares_version 1.34.6
# llhttp - from deps/llhttp/include/llhttp.h # llhttp - from deps/llhttp/include/llhttp.h
%global llhttp_version 9.4.2 %global llhttp_version 9.3.0
# libuv - from deps/uv/include/uv/version.h # libuv - from deps/uv/include/uv/version.h
%global libuv_version 1.51.0 %global libuv_version 1.51.0
# nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h # nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
%global nghttp2_version 1.69.0 %global nghttp2_version 1.68.1
# nghttp3 - from deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h # nghttp3 - from deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h
%global nghttp3_version 1.6.0 %global nghttp3_version 1.6.0
@ -126,7 +130,7 @@
# npm - from deps/npm/package.json # npm - from deps/npm/package.json
%global npm_epoch 1 %global npm_epoch 1
%global npm_version 10.9.8 %global npm_version 10.9.7
# In order to avoid needing to keep incrementing the release version for the # In order to avoid needing to keep incrementing the release version for the
# main package forever, we will just construct one for npm that is guaranteed # main package forever, we will just construct one for npm that is guaranteed
@ -143,7 +147,7 @@
%global histogram_version 0.11.9 %global histogram_version 0.11.9
# sqlite from deps/sqlite/sqlite3.h # sqlite from deps/sqlite/sqlite3.h
%global sqlite_version 3.51.3 %global sqlite_version 3.51.2
Name: nodejs%{nodejs_pkg_major} Name: nodejs%{nodejs_pkg_major}
@ -178,11 +182,8 @@ Source301: test-should-pass.txt
Patch: 0001-Remove-unused-OpenSSL-config.patch Patch: 0001-Remove-unused-OpenSSL-config.patch
Patch: 0001-fips-disable-options.patch Patch: 0001-fips-disable-options.patch
Patch: 0001-deps-update-nghttp2-to-1.68.1.patch
Patch: 0001-CVE-2026-25547-braces-expansion.patch Patch: 0001-CVE-2026-25547-braces-expansion.patch
# npm deps patches
Patch: 0002-CVE-2026-42338-npm-ip-address-security-fix.patch
Patch: 0003-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch
Patch: 0004-CVE-2026-13149-brace-expansion-unbound-recursion.patch
%if 0%{?nodejs_default} %if 0%{?nodejs_default}
%global pkgname nodejs %global pkgname nodejs
@ -221,11 +222,6 @@ BuildRequires: jq
# https://pagure.io/nodejs-packaging/pull-request/10 # https://pagure.io/nodejs-packaging/pull-request/10
BuildRequires: nodejs-packaging BuildRequires: nodejs-packaging
%if %{with bundled_cares}
Provides: bundled(c-ares) = %{c_ares_version}
%else
BuildRequires: c-ares-devel >= %{c_ares_version}
%endif
BuildRequires: chrpath BuildRequires: chrpath
BuildRequires: libatomic BuildRequires: libatomic
BuildRequires: ninja-build BuildRequires: ninja-build
@ -255,7 +251,7 @@ Provides: nodejs%{nodejs_pkg_major}%{?1:-%{1}} = %{nodejs_envr}\
%define unversioned_obsoletes_of_nodejsXX_if_default() %{nil} %define unversioned_obsoletes_of_nodejsXX_if_default() %{nil}
%endif %endif
%if %{with bundled_libuv} %if %{with bundled}
Provides: bundled(libuv) = %{libuv_version} Provides: bundled(libuv) = %{libuv_version}
%else %else
BuildRequires: libuv-devel >= 1:%{libuv_version} BuildRequires: libuv-devel >= 1:%{libuv_version}
@ -334,6 +330,11 @@ Conflicts: node <= 0.3.2-12
Provides: nodejs-punycode = %{punycode_version} Provides: nodejs-punycode = %{punycode_version}
Provides: npm(punycode) = %{punycode_version} Provides: npm(punycode) = %{punycode_version}
# Node.js has forked c-ares from upstream in an incompatible way, so we need
# to carry the bundled version internally.
# See https://github.com/nodejs/node/commit/766d063e0578c0f7758c3a965c971763f43fec85
Provides: bundled(c-ares) = %{c_ares_version}
# Node.js is closely tied to the version of v8 that is used with it. It makes # Node.js is closely tied to the version of v8 that is used with it. It makes
# sense to use the bundled version because upstream consistently breaks ABI # sense to use the bundled version because upstream consistently breaks ABI
# even in point releases. Node.js upstream has now removed the ability to build # even in point releases. Node.js upstream has now removed the ability to build
@ -366,7 +367,7 @@ Requires: nodejs-cjs-module-lexer
%endif %endif
%if %{with bundled_undici} %if %{with bundled_undici}
Provides: bundled(nodejs-undici) = 6.27.0 Provides: bundled(nodejs-undici) = 6.24.1
%else %else
BuildRequires: nodejs-undici BuildRequires: nodejs-undici
Requires: nodejs-undici Requires: nodejs-undici
@ -406,7 +407,7 @@ Requires: zlib-devel%{?_isa}
Requires: brotli-devel%{?_isa} Requires: brotli-devel%{?_isa}
Requires: nodejs-packaging Requires: nodejs-packaging
%if %{without bundled_libuv} %if %{without bundled}
Requires: libuv-devel%{?_isa} Requires: libuv-devel%{?_isa}
%endif %endif
@ -535,14 +536,6 @@ The API documentation for the Node.js JavaScript runtime.
%autosetup -p1 -n node-v%{nodejs_version} %autosetup -p1 -n node-v%{nodejs_version}
# remove bundled dependencies that we aren't building # remove bundled dependencies that we aren't building
%if %{without bundled_libuv}
rm -rf deps/uv
%endif
%if %{without bundled_cares}
rm -rf deps/cares
%endif
%if !%{with bundled_zlib} %if !%{with bundled_zlib}
rm -rf deps/zlib rm -rf deps/zlib
%endif %endif
@ -627,8 +620,7 @@ export PATH="${cwd}/.bin:$PATH"
%{!?with_bundled_undici:--shared-builtin-undici/undici-path %{nodejs_private_sitelib}/undici/loader.js} \ %{!?with_bundled_undici:--shared-builtin-undici/undici-path %{nodejs_private_sitelib}/undici/loader.js} \
%{!?with_bundled_sqlite:--shared-sqlite} \ %{!?with_bundled_sqlite:--shared-sqlite} \
--shared-brotli \ --shared-brotli \
%{!?with_bundled_cares:--shared-cares} \ --shared-libuv \
%{!?with_bundled_libuv:--shared-libuv} \
--with-intl=small-icu \ --with-intl=small-icu \
--with-icu-default-data-dir=%{icudatadir} \ --with-icu-default-data-dir=%{icudatadir} \
--without-corepack \ --without-corepack \
@ -981,4 +973,94 @@ end
%changelog %changelog
%autochangelog ## START: Generated by rpmautospec
* Mon Mar 30 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.22.2-1
- Update to version 22.22.2
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
- disabled failing tests in nghttp2 due to newer version
- patch for npm/braces CVE-2026-25547
* Wed Mar 25 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.22.0-4
- sources: changed ICU version syntax
* Tue Jan 20 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.22.0-3
- Bump release to get correct RHEL build
* Fri Jan 16 2026 tjuhasz <tjuhasz@redhat.com> - 1:22.22.0-2
- Filter for nodejs22.fmf in gating plan
* Wed Jan 14 2026 tjuhasz <tjuhasz@redhat.com> - 1:22.22.0-1
- Update to 22.22.0
* Thu Dec 04 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.19.0-3
- Unit-tests adjustment - disable internet/test-dgram-membership
* Wed Sep 03 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.19.0-2
- Add patch to prevent fips usage segfault
* Fri Aug 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.19.0-1
- Update to version 22.19.0
* Fri Aug 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-6
- configure.py: use local headers for building native addons when available
* Fri Aug 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-5
- spec: fix node binary calls to use versioned binary
* Wed Aug 20 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-4
- Test plan adjustments
* Thu Jul 31 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-3
- spec: devel packages explicitly conflicts
* Fri Jun 20 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.16.0-2
- Add rpminspect config to repo
* Tue May 27 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-1
- Update to version 22.16.0
* Tue May 20 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.15.0-3
- Make grep Source stricter in nodejs-tarball
* Tue May 20 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.15.0-2
- Add unit-test during build for nodejs22
* Thu Apr 24 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.15.0-1
- Update to version 22.15.0
* Tue Apr 22 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.13.1-6
- Update c-ares with fix for CVE-2025-31498
* Thu Mar 06 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-5
- Revert "Generate only versioned rpms"
* Tue Feb 25 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-4
- Use stream-specific ABI dependency generator
* Tue Feb 18 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-3
- Generate only versioned rpms
* Thu Feb 13 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-2
- Add upper bound to unversioned obsoletes
* Mon Jan 27 2025 Tomas Juhasz <tjuhasz@redhat.com> - 1:22.13.1-1
- Updated to version 22.13.1
* Mon Jan 27 2025 Jan Staněk <jstanek@redhat.com> - 1:22.11.0-2
- Fix npm hashbang replacement
* Tue Nov 19 2024 Jan Staněk <jstanek@redhat.com> - 1:22.11.0-1
- Update to version 22.11.0 (LTS)
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1:22.4.1-4
- Bump release for October 2024 mass rebuild:
* Wed Aug 14 2024 Jan Staněk <jstanek@redhat.com> - 1:22.4.1-3
- make this stream the default for RHEL 10
* Wed Aug 07 2024 Jakub Heger <jheger@redhat.com> - 1:22.4.1-2
- enable gating
* Tue Aug 06 2024 Jan Staněk <jstanek@redhat.com> - 1:22.4.1-1
- Import SRPM from Fedora
## END: Generated by rpmautospec

View File

@ -1,23 +0,0 @@
---
summary: Package test suite
discover:
how: fmf
url: https://gitlab.com/redhat/centos-stream/tests/nodejs
filter: "component:nodejs22"
environment:
NODEJS_MAIN_PACKAGE: nodejs22
NODEJS_DEVEL_PACKAGE: nodejs22-devel
NODEJS_BIN_PACKAGE: nodejs22-bin
NPM_BIN_PACKAGE: nodejs22-npm-bin
NODE_BIN: /usr/bin/node-22
NPM_BIN: /usr/bin/npm-22
NODE_INCLUDE_PATH: /usr/include/node
prepare:
- name: install tested packages
how: install
package:
- ${NODEJS_MAIN_PACKAGE}
- ${NODEJS_DEVEL_PACKAGE}
execute:
how: tmt
...

View File

@ -1,10 +0,0 @@
summary: Internal Tier1 tests plan
discover:
how: fmf
filter: 'tier: 1 & component: nodejs:22'
url: https://pkgs.devel.redhat.com/git/tests/nodejs
execute:
how: tmt
adjust:
enabled: false
when: distro == centos-stream or distro == fedora

View File

@ -1,28 +0,0 @@
# This check is disabled because rpminspect has issues with
# macro nesting and autorelease macro
# which led to continuous need to waive or ignore the failure of the test
# e.g:https://artifacts.dev.testing-farm.io/07049d23-04ed-451c-99f6-eed73e369d28/
inspections:
disttag: off
# Multiple annochecks are disabled because they are creating Verify type failures
annocheck:
extra_opts:
# Issue: https://github.com/nodejs/node/issues/40368
# skip test for link time optimalization
# test fails because nodejs is compiled without LTO.
# This is on purpose as it creates issues.
hardened: --skip-lto
# Temporarily disabled
# skip test for GNU Property notes formatting
# test fails because it's missing CET notes
# feature is unsopported by upstream
# See RHEL-85793 for details
hardened: --skip-property-note
hardened: --skip-cf-protection
# Temporarily disabled
# skip test for dynamic tags
# BTI_PLT protection feature is missing from dynamic tags
# libnode.so.127 lacks this feature
# See RHEL-85837 for details
hardened: --skip-dynamic-tags

View File

@ -1,3 +1,3 @@
SHA512 (node-v22.23.1-stripped.tar.gz) = dee26039e7a6f5d740c9f022ff702699748901c72d77ec41b91f4d9cc295d79596435d3e74446074bee1b34bd18b34f09144cd63266bf68858c975bb9e6339a3
SHA512 (icu4c-78.2-data-bin-b.zip) = 032a1e519bf92dfa7936ef85ebed697550dbcb4e32c6ecd28ffecb158a403eeff6c0a3545b2551eba73f288e31693be6880e202a38cd86c129dffa395e8ab625 SHA512 (icu4c-78.2-data-bin-b.zip) = 032a1e519bf92dfa7936ef85ebed697550dbcb4e32c6ecd28ffecb158a403eeff6c0a3545b2551eba73f288e31693be6880e202a38cd86c129dffa395e8ab625
SHA512 (icu4c-78.2-data-bin-l.zip) = c0b46de115332940d3276763904caa6257eb516edce4382632f4b96a5b010fee4cb06a5e10ef5eee2f881515c1ee8277d9ae59015f6de6fe1d175b9d00dbb1ca SHA512 (icu4c-78.2-data-bin-l.zip) = c0b46de115332940d3276763904caa6257eb516edce4382632f4b96a5b010fee4cb06a5e10ef5eee2f881515c1ee8277d9ae59015f6de6fe1d175b9d00dbb1ca
SHA512 (node-v22.22.2-stripped.tar.gz) = 82c3357cce10a3fe89373ec4e3460af5992d853f28a7339358a3f910959e7b17987c8eb1748d9c3033d4c642701d321e2265cc0ac004a218860da4eda2971226