Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
44f12f7775 | ||
| 685bed63d0 |
@ -1 +0,0 @@
|
|||||||
1
|
|
||||||
7
.gitignore
vendored
7
.gitignore
vendored
@ -1,4 +1,3 @@
|
|||||||
/icu4c-*-data-bin-?.zip
|
icu4c-78.2-data-bin-b.zip
|
||||||
/node-*-stripped.tar.gz
|
icu4c-78.2-data-bin-l.zip
|
||||||
/SHASUM*
|
node-v22.22.2-stripped.tar.gz
|
||||||
/node*src.rpm
|
|
||||||
|
|||||||
7712
0001-deps-update-nghttp2-to-1.68.1.patch
Normal file
7712
0001-deps-update-nghttp2-to-1.68.1.patch
Normal file
File diff suppressed because it is too large
Load Diff
@ -1,166 +0,0 @@
|
|||||||
From d98f88cfa68abef0e57ec2b48df0049032e50c85 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Beau Gunderson <beau@beaugunderson.com>
|
|
||||||
Date: Sun, 27 Apr 2026 10:28:29 -0700
|
|
||||||
Subject: [PATCH] CVE-2026-42338 ip-address HTML escaping fix
|
|
||||||
|
|
||||||
Fix HTML escaping in ip-address library to prevent XSS vulnerabilities.
|
|
||||||
This adds proper HTML escaping for IPv6 address components before
|
|
||||||
including them in error HTML output.
|
|
||||||
|
|
||||||
Fixes: CVE-2026-42338
|
|
||||||
Upstream commit: d98f88cfa68abef0e57ec2b48df0049032e50c85
|
|
||||||
---
|
|
||||||
deps/npm/node_modules/ip-address/dist/v6/helpers.js | 9 +++++++++
|
|
||||||
deps/npm/node_modules/ip-address/dist/ipv6.js | 32 ++++++++++++++----------
|
|
||||||
deps/npm/node_modules/ip-address/package.json | 2 +-
|
|
||||||
3 files changed, 30 insertions(+), 13 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/deps/npm/node_modules/ip-address/dist/v6/helpers.js b/deps/npm/node_modules/ip-address/dist/v6/helpers.js
|
|
||||||
index 1234567..abcdefg 100644
|
|
||||||
--- a/deps/npm/node_modules/ip-address/dist/v6/helpers.js
|
|
||||||
+++ b/deps/npm/node_modules/ip-address/dist/v6/helpers.js
|
|
||||||
@@ -1,14 +1,23 @@
|
|
||||||
"use strict";
|
|
||||||
Object.defineProperty(exports, "__esModule", { value: true });
|
|
||||||
+exports.escapeHtml = escapeHtml;
|
|
||||||
exports.spanAllZeroes = spanAllZeroes;
|
|
||||||
exports.spanAll = spanAll;
|
|
||||||
exports.spanLeadingZeroes = spanLeadingZeroes;
|
|
||||||
exports.simpleGroup = simpleGroup;
|
|
||||||
+function escapeHtml(s) {
|
|
||||||
+ return s
|
|
||||||
+ .replace(/&/g, '&')
|
|
||||||
+ .replace(/</g, '<')
|
|
||||||
+ .replace(/>/g, '>')
|
|
||||||
+ .replace(/"/g, '"')
|
|
||||||
+ .replace(/'/g, ''');
|
|
||||||
+}
|
|
||||||
/**
|
|
||||||
* @returns {String} the string with all zeroes contained in a <span>
|
|
||||||
*/
|
|
||||||
function spanAllZeroes(s) {
|
|
||||||
- return s.replace(/(0+)/g, '<span class="zero">$1</span>');
|
|
||||||
+ return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
|
|
||||||
}
|
|
||||||
/**
|
|
||||||
* @returns {String} the string with each character contained in a <span>
|
|
||||||
@@ -16,11 +25,11 @@
|
|
||||||
function spanAll(s, offset = 0) {
|
|
||||||
const letters = s.split('');
|
|
||||||
return letters
|
|
||||||
- .map((n, i) => `<span class="digit value-${n} position-${i + offset}">${spanAllZeroes(n)}</span>`)
|
|
||||||
+ .map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`)
|
|
||||||
.join('');
|
|
||||||
}
|
|
||||||
function spanLeadingZeroesSimple(group) {
|
|
||||||
- return group.replace(/^(0+)/, '<span class="zero">$1</span>');
|
|
||||||
+ return escapeHtml(group).replace(/^(0+)/, '<span class="zero">$1</span>');
|
|
||||||
}
|
|
||||||
/**
|
|
||||||
* @returns {String} the string with leading zeroes contained in a <span>
|
|
||||||
@@ -42,4 +51,3 @@
|
|
||||||
return `<span class="hover-group group-${i + offset}">${spanLeadingZeroesSimple(g)}</span>`;
|
|
||||||
});
|
|
||||||
}
|
|
||||||
-//# sourceMappingURL=helpers.js.map
|
|
||||||
\ No newline at end of file
|
|
||||||
diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
|
|
||||||
index 1234567..abcdefg 100644
|
|
||||||
--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
|
|
||||||
+++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
|
|
||||||
@@ -17,13 +17,23 @@
|
|
||||||
}) : function(o, v) {
|
|
||||||
o["default"] = v;
|
|
||||||
});
|
|
||||||
-var __importStar = (this && this.__importStar) || function (mod) {
|
|
||||||
- if (mod && mod.__esModule) return mod;
|
|
||||||
- var result = {};
|
|
||||||
- if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
||||||
- __setModuleDefault(result, mod);
|
|
||||||
- return result;
|
|
||||||
-};
|
|
||||||
+var __importStar = (this && this.__importStar) || (function () {
|
|
||||||
+ var ownKeys = function(o) {
|
|
||||||
+ ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
||||||
+ var ar = [];
|
|
||||||
+ for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
||||||
+ return ar;
|
|
||||||
+ };
|
|
||||||
+ return ownKeys(o);
|
|
||||||
+ };
|
|
||||||
+ return function (mod) {
|
|
||||||
+ if (mod && mod.__esModule) return mod;
|
|
||||||
+ var result = {};
|
|
||||||
+ if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
||||||
+ __setModuleDefault(result, mod);
|
|
||||||
+ return result;
|
|
||||||
+ };
|
|
||||||
+})();
|
|
||||||
Object.defineProperty(exports, "__esModule", { value: true });
|
|
||||||
exports.Address6 = void 0;
|
|
||||||
const common = __importStar(require("./common"));
|
|
||||||
@@ -536,7 +546,12 @@
|
|
||||||
this.address4 = new ipv4_1.Address4(this.parsedAddress4);
|
|
||||||
for (let i = 0; i < this.address4.groups; i++) {
|
|
||||||
if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
|
|
||||||
- throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", address.replace(constants4.RE_ADDRESS, this.address4.parsedAddress.map(spanLeadingZeroes4).join('.')));
|
|
||||||
+ // The prefix groups haven't been through the bad-character check
|
|
||||||
+ // yet, so escape them before including in the error HTML.
|
|
||||||
+ const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
|
|
||||||
+ const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
|
|
||||||
+ const separator = groups.length > 1 ? ':' : '';
|
|
||||||
+ throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
this.v4 = true;
|
|
||||||
@@ -896,10 +911,13 @@
|
|
||||||
formFunction = this.to4in6;
|
|
||||||
}
|
|
||||||
const form = formFunction.call(this);
|
|
||||||
+ const safeHref = helpers.escapeHtml(`${options.prefix}${form}`);
|
|
||||||
+ const safeForm = helpers.escapeHtml(form);
|
|
||||||
if (options.className) {
|
|
||||||
- return `<a href="${options.prefix}${form}" class="${options.className}">${form}</a>`;
|
|
||||||
+ const safeClass = helpers.escapeHtml(options.className);
|
|
||||||
+ return `<a href="${safeHref}" class="${safeClass}">${safeForm}</a>`;
|
|
||||||
}
|
|
||||||
- return `<a href="${options.prefix}${form}">${form}</a>`;
|
|
||||||
+ return `<a href="${safeHref}">${safeForm}</a>`;
|
|
||||||
}
|
|
||||||
/**
|
|
||||||
* Groups an address
|
|
||||||
@@ -908,13 +926,13 @@
|
|
||||||
group() {
|
|
||||||
if (this.elidedGroups === 0) {
|
|
||||||
// The simple case
|
|
||||||
- return helpers.simpleGroup(this.address).join(':');
|
|
||||||
+ return helpers.simpleGroup(this.addressMinusSuffix).join(':');
|
|
||||||
}
|
|
||||||
assert(typeof this.elidedGroups === 'number');
|
|
||||||
assert(typeof this.elisionBegin === 'number');
|
|
||||||
// The elided case
|
|
||||||
const output = [];
|
|
||||||
- const [left, right] = this.address.split('::');
|
|
||||||
+ const [left, right] = this.addressMinusSuffix.split('::');
|
|
||||||
if (left.length) {
|
|
||||||
output.push(...helpers.simpleGroup(left));
|
|
||||||
}
|
|
||||||
@@ -1000,4 +1018,3 @@
|
|
||||||
}
|
|
||||||
}
|
|
||||||
exports.Address6 = Address6;
|
|
||||||
-//# sourceMappingURL=ipv6.js.map
|
|
||||||
\ No newline at end of file
|
|
||||||
diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
|
|
||||||
index 1234567..abcdefg 100644
|
|
||||||
--- a/deps/npm/node_modules/ip-address/package.json
|
|
||||||
+++ b/deps/npm/node_modules/ip-address/package.json
|
|
||||||
@@ -7,7 +7,7 @@
|
|
||||||
"browser",
|
|
||||||
"validation"
|
|
||||||
],
|
|
||||||
- "version": "10.1.0",
|
|
||||||
+ "version": "10.1.1",
|
|
||||||
"author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
|
|
||||||
"license": "MIT",
|
|
||||||
"main": "dist/ip-address.js",
|
|
||||||
File diff suppressed because one or more lines are too long
@ -1,100 +0,0 @@
|
|||||||
From 213dc171de329a09f34c7a3222cad723ee65d693 Mon Sep 17 00:00:00 2001
|
|
||||||
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
|
||||||
Date: Tue, 14 Jul 2026 08:27:05 +0000
|
|
||||||
Subject: [PATCH] CVE-2026-13149: Fix unbound recursion in brace-expansion
|
|
||||||
|
|
||||||
A run of non-expanding {} groups expanded post once per group before the
|
|
||||||
early returns that never use it, doubling the work on every group. expand()
|
|
||||||
ran in O(2^n) and blocked for minutes on a ~90 byte input.
|
|
||||||
|
|
||||||
Defer expanding post until a brace set is known to expand, and turn the
|
|
||||||
{a},b} restart into a loop so a long run of {} groups can't exhaust the
|
|
||||||
call stack.
|
|
||||||
|
|
||||||
Adapted from upstream TypeScript fix to the JavaScript version (2.0.2)
|
|
||||||
vendored in Node.js.
|
|
||||||
|
|
||||||
Upstream: https://github.com/juliangruber/brace-expansion/commit/c7e33ec
|
|
||||||
---
|
|
||||||
.../npm/node_modules/brace-expansion/index.js | 49 ++++++++++++-------
|
|
||||||
1 file changed, 32 insertions(+), 17 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/deps/npm/node_modules/brace-expansion/index.js b/deps/npm/node_modules/brace-expansion/index.js
|
|
||||||
index d084bac4..5d5f61ff 100644
|
|
||||||
--- a/deps/npm/node_modules/brace-expansion/index.js
|
|
||||||
+++ b/deps/npm/node_modules/brace-expansion/index.js
|
|
||||||
@@ -99,21 +99,27 @@ function gte(i, y) {
|
|
||||||
function expand(str, max, isTop) {
|
|
||||||
var expansions = [];
|
|
||||||
|
|
||||||
- var m = balanced('{', '}', str);
|
|
||||||
- if (!m) return [str];
|
|
||||||
-
|
|
||||||
- // no need to expand pre, since it is guaranteed to be free of brace-sets
|
|
||||||
- var pre = m.pre;
|
|
||||||
- var post = m.post.length
|
|
||||||
- ? expand(m.post, max, false)
|
|
||||||
- : [''];
|
|
||||||
-
|
|
||||||
- if (/\$$/.test(m.pre)) {
|
|
||||||
- for (var k = 0; k < post.length && k < max; k++) {
|
|
||||||
- var expansion = pre+ '{' + m.body + '}' + post[k];
|
|
||||||
- expansions.push(expansion);
|
|
||||||
+ // The {a},b} rewrite below restarts expansion on a rewritten string with
|
|
||||||
+ // the same max and isTop = true. Loop instead of recursing so a long run
|
|
||||||
+ // of non-expanding {} groups can't exhaust the call stack.
|
|
||||||
+ for (;;) {
|
|
||||||
+ var m = balanced('{', '}', str);
|
|
||||||
+ if (!m) return [str];
|
|
||||||
+
|
|
||||||
+ // no need to expand pre, since it is guaranteed to be free of brace-sets
|
|
||||||
+ var pre = m.pre;
|
|
||||||
+
|
|
||||||
+ if (/\$$/.test(m.pre)) {
|
|
||||||
+ var post = m.post.length
|
|
||||||
+ ? expand(m.post, max, false)
|
|
||||||
+ : [''];
|
|
||||||
+ for (var k = 0; k < post.length && k < max; k++) {
|
|
||||||
+ var expansion = pre+ '{' + m.body + '}' + post[k];
|
|
||||||
+ expansions.push(expansion);
|
|
||||||
+ }
|
|
||||||
+ return expansions;
|
|
||||||
}
|
|
||||||
- } else {
|
|
||||||
+
|
|
||||||
var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
|
|
||||||
var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
|
|
||||||
var isSequence = isNumericSequence || isAlphaSequence;
|
|
||||||
@@ -122,11 +128,20 @@ function expand(str, max, isTop) {
|
|
||||||
// {a},b}
|
|
||||||
if (m.post.match(/,(?!,).*\}/)) {
|
|
||||||
str = m.pre + '{' + m.body + escClose + m.post;
|
|
||||||
- return expand(str, max, true);
|
|
||||||
+ isTop = true;
|
|
||||||
+ continue;
|
|
||||||
}
|
|
||||||
return [str];
|
|
||||||
}
|
|
||||||
|
|
||||||
+ // Only expand post once we know this brace set actually expands. Computing
|
|
||||||
+ // it before the early returns above expanded post a second time on every
|
|
||||||
+ // non-expanding {}, which is what made inputs like a{},{},{}... blow up
|
|
||||||
+ // exponentially.
|
|
||||||
+ var post = m.post.length
|
|
||||||
+ ? expand(m.post, max, false)
|
|
||||||
+ : [''];
|
|
||||||
+
|
|
||||||
var n;
|
|
||||||
if (isSequence) {
|
|
||||||
n = m.body.split(/\.\./);
|
|
||||||
@@ -200,8 +215,8 @@ function expand(str, max, isTop) {
|
|
||||||
expansions.push(expansion);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
- }
|
|
||||||
|
|
||||||
- return expansions;
|
|
||||||
+ return expansions;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,6 +0,0 @@
|
|||||||
--- !Policy
|
|
||||||
product_versions:
|
|
||||||
- rhel-10
|
|
||||||
decision_context: osci_compose_gate
|
|
||||||
rules:
|
|
||||||
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
|
||||||
154
nodejs22.spec
154
nodejs22.spec
@ -1,3 +1,13 @@
|
|||||||
|
## START: Set by rpmautospec
|
||||||
|
## (rpmautospec version 0.6.5)
|
||||||
|
## RPMAUTOSPEC: autorelease, autochangelog
|
||||||
|
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
|
||||||
|
release_number = 1;
|
||||||
|
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
|
||||||
|
print(release_number + base_release_number - 1);
|
||||||
|
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
|
||||||
|
## END: Set by rpmautospec
|
||||||
|
|
||||||
# Determine if this should be the default version for this Fedora release
|
# Determine if this should be the default version for this Fedora release
|
||||||
# The default version will own /usr/bin/node and friends
|
# The default version will own /usr/bin/node and friends
|
||||||
%global nodejs_pkg_major 22
|
%global nodejs_pkg_major 22
|
||||||
@ -28,12 +38,6 @@
|
|||||||
%bcond_with bundled_zlib
|
%bcond_with bundled_zlib
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
# 2026-05-05: Currently libuv up to date, but if it no longer the case - switch to 1
|
|
||||||
%bcond bundled_libuv 0
|
|
||||||
|
|
||||||
# 2026-05-05: Currently c-ares up to date, but if it no longer the case - switch to 1
|
|
||||||
%bcond bundled_cares 0
|
|
||||||
|
|
||||||
%bcond bundled_sqlite %{with bootstrap}
|
%bcond bundled_sqlite %{with bootstrap}
|
||||||
|
|
||||||
# LTO is currently broken on Node.js builds
|
# LTO is currently broken on Node.js builds
|
||||||
@ -58,8 +62,8 @@
|
|||||||
# than a Fedora release lifecycle.
|
# than a Fedora release lifecycle.
|
||||||
%global nodejs_epoch 1
|
%global nodejs_epoch 1
|
||||||
%global nodejs_major 22
|
%global nodejs_major 22
|
||||||
%global nodejs_minor 23
|
%global nodejs_minor 22
|
||||||
%global nodejs_patch 1
|
%global nodejs_patch 2
|
||||||
# nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
|
# nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
|
||||||
%global nodejs_soversion 127
|
%global nodejs_soversion 127
|
||||||
%global nodejs_abi %{nodejs_soversion}
|
%global nodejs_abi %{nodejs_soversion}
|
||||||
@ -82,20 +86,20 @@
|
|||||||
%global v8_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release}
|
%global v8_release %{nodejs_epoch}.%{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}.%{nodejs_release}
|
||||||
|
|
||||||
# zlib - from deps/zlib/zlib.h
|
# zlib - from deps/zlib/zlib.h
|
||||||
%global zlib_version 1.3.1
|
%global zlib_version 1.3.0.1-motley
|
||||||
|
|
||||||
# c-ares - from deps/cares/include/ares_version.h
|
# c-ares - from deps/cares/include/ares_version.h
|
||||||
# https://github.com/nodejs/node/pull/9332
|
# https://github.com/nodejs/node/pull/9332
|
||||||
%global c_ares_version 1.34.6
|
%global c_ares_version 1.34.6
|
||||||
|
|
||||||
# llhttp - from deps/llhttp/include/llhttp.h
|
# llhttp - from deps/llhttp/include/llhttp.h
|
||||||
%global llhttp_version 9.4.2
|
%global llhttp_version 9.3.0
|
||||||
|
|
||||||
# libuv - from deps/uv/include/uv/version.h
|
# libuv - from deps/uv/include/uv/version.h
|
||||||
%global libuv_version 1.51.0
|
%global libuv_version 1.51.0
|
||||||
|
|
||||||
# nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
|
# nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
|
||||||
%global nghttp2_version 1.69.0
|
%global nghttp2_version 1.68.1
|
||||||
|
|
||||||
# nghttp3 - from deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h
|
# nghttp3 - from deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h
|
||||||
%global nghttp3_version 1.6.0
|
%global nghttp3_version 1.6.0
|
||||||
@ -126,7 +130,7 @@
|
|||||||
|
|
||||||
# npm - from deps/npm/package.json
|
# npm - from deps/npm/package.json
|
||||||
%global npm_epoch 1
|
%global npm_epoch 1
|
||||||
%global npm_version 10.9.8
|
%global npm_version 10.9.7
|
||||||
|
|
||||||
# In order to avoid needing to keep incrementing the release version for the
|
# In order to avoid needing to keep incrementing the release version for the
|
||||||
# main package forever, we will just construct one for npm that is guaranteed
|
# main package forever, we will just construct one for npm that is guaranteed
|
||||||
@ -143,7 +147,7 @@
|
|||||||
%global histogram_version 0.11.9
|
%global histogram_version 0.11.9
|
||||||
|
|
||||||
# sqlite – from deps/sqlite/sqlite3.h
|
# sqlite – from deps/sqlite/sqlite3.h
|
||||||
%global sqlite_version 3.51.3
|
%global sqlite_version 3.51.2
|
||||||
|
|
||||||
|
|
||||||
Name: nodejs%{nodejs_pkg_major}
|
Name: nodejs%{nodejs_pkg_major}
|
||||||
@ -178,11 +182,8 @@ Source301: test-should-pass.txt
|
|||||||
|
|
||||||
Patch: 0001-Remove-unused-OpenSSL-config.patch
|
Patch: 0001-Remove-unused-OpenSSL-config.patch
|
||||||
Patch: 0001-fips-disable-options.patch
|
Patch: 0001-fips-disable-options.patch
|
||||||
|
Patch: 0001-deps-update-nghttp2-to-1.68.1.patch
|
||||||
Patch: 0001-CVE-2026-25547-braces-expansion.patch
|
Patch: 0001-CVE-2026-25547-braces-expansion.patch
|
||||||
# npm deps patches
|
|
||||||
Patch: 0002-CVE-2026-42338-npm-ip-address-security-fix.patch
|
|
||||||
Patch: 0003-CVE-2026-59873-CVE-2026-59874-upgrade-bundled-tar-to-7.5.19.patch
|
|
||||||
Patch: 0004-CVE-2026-13149-brace-expansion-unbound-recursion.patch
|
|
||||||
|
|
||||||
%if 0%{?nodejs_default}
|
%if 0%{?nodejs_default}
|
||||||
%global pkgname nodejs
|
%global pkgname nodejs
|
||||||
@ -221,11 +222,6 @@ BuildRequires: jq
|
|||||||
# https://pagure.io/nodejs-packaging/pull-request/10
|
# https://pagure.io/nodejs-packaging/pull-request/10
|
||||||
BuildRequires: nodejs-packaging
|
BuildRequires: nodejs-packaging
|
||||||
|
|
||||||
%if %{with bundled_cares}
|
|
||||||
Provides: bundled(c-ares) = %{c_ares_version}
|
|
||||||
%else
|
|
||||||
BuildRequires: c-ares-devel >= %{c_ares_version}
|
|
||||||
%endif
|
|
||||||
BuildRequires: chrpath
|
BuildRequires: chrpath
|
||||||
BuildRequires: libatomic
|
BuildRequires: libatomic
|
||||||
BuildRequires: ninja-build
|
BuildRequires: ninja-build
|
||||||
@ -255,7 +251,7 @@ Provides: nodejs%{nodejs_pkg_major}%{?1:-%{1}} = %{nodejs_envr}\
|
|||||||
%define unversioned_obsoletes_of_nodejsXX_if_default() %{nil}
|
%define unversioned_obsoletes_of_nodejsXX_if_default() %{nil}
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%if %{with bundled_libuv}
|
%if %{with bundled}
|
||||||
Provides: bundled(libuv) = %{libuv_version}
|
Provides: bundled(libuv) = %{libuv_version}
|
||||||
%else
|
%else
|
||||||
BuildRequires: libuv-devel >= 1:%{libuv_version}
|
BuildRequires: libuv-devel >= 1:%{libuv_version}
|
||||||
@ -334,6 +330,11 @@ Conflicts: node <= 0.3.2-12
|
|||||||
Provides: nodejs-punycode = %{punycode_version}
|
Provides: nodejs-punycode = %{punycode_version}
|
||||||
Provides: npm(punycode) = %{punycode_version}
|
Provides: npm(punycode) = %{punycode_version}
|
||||||
|
|
||||||
|
# Node.js has forked c-ares from upstream in an incompatible way, so we need
|
||||||
|
# to carry the bundled version internally.
|
||||||
|
# See https://github.com/nodejs/node/commit/766d063e0578c0f7758c3a965c971763f43fec85
|
||||||
|
Provides: bundled(c-ares) = %{c_ares_version}
|
||||||
|
|
||||||
# Node.js is closely tied to the version of v8 that is used with it. It makes
|
# Node.js is closely tied to the version of v8 that is used with it. It makes
|
||||||
# sense to use the bundled version because upstream consistently breaks ABI
|
# sense to use the bundled version because upstream consistently breaks ABI
|
||||||
# even in point releases. Node.js upstream has now removed the ability to build
|
# even in point releases. Node.js upstream has now removed the ability to build
|
||||||
@ -366,7 +367,7 @@ Requires: nodejs-cjs-module-lexer
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%if %{with bundled_undici}
|
%if %{with bundled_undici}
|
||||||
Provides: bundled(nodejs-undici) = 6.27.0
|
Provides: bundled(nodejs-undici) = 6.24.1
|
||||||
%else
|
%else
|
||||||
BuildRequires: nodejs-undici
|
BuildRequires: nodejs-undici
|
||||||
Requires: nodejs-undici
|
Requires: nodejs-undici
|
||||||
@ -406,7 +407,7 @@ Requires: zlib-devel%{?_isa}
|
|||||||
Requires: brotli-devel%{?_isa}
|
Requires: brotli-devel%{?_isa}
|
||||||
Requires: nodejs-packaging
|
Requires: nodejs-packaging
|
||||||
|
|
||||||
%if %{without bundled_libuv}
|
%if %{without bundled}
|
||||||
Requires: libuv-devel%{?_isa}
|
Requires: libuv-devel%{?_isa}
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
@ -535,14 +536,6 @@ The API documentation for the Node.js JavaScript runtime.
|
|||||||
%autosetup -p1 -n node-v%{nodejs_version}
|
%autosetup -p1 -n node-v%{nodejs_version}
|
||||||
|
|
||||||
# remove bundled dependencies that we aren't building
|
# remove bundled dependencies that we aren't building
|
||||||
%if %{without bundled_libuv}
|
|
||||||
rm -rf deps/uv
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if %{without bundled_cares}
|
|
||||||
rm -rf deps/cares
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if !%{with bundled_zlib}
|
%if !%{with bundled_zlib}
|
||||||
rm -rf deps/zlib
|
rm -rf deps/zlib
|
||||||
%endif
|
%endif
|
||||||
@ -627,8 +620,7 @@ export PATH="${cwd}/.bin:$PATH"
|
|||||||
%{!?with_bundled_undici:--shared-builtin-undici/undici-path %{nodejs_private_sitelib}/undici/loader.js} \
|
%{!?with_bundled_undici:--shared-builtin-undici/undici-path %{nodejs_private_sitelib}/undici/loader.js} \
|
||||||
%{!?with_bundled_sqlite:--shared-sqlite} \
|
%{!?with_bundled_sqlite:--shared-sqlite} \
|
||||||
--shared-brotli \
|
--shared-brotli \
|
||||||
%{!?with_bundled_cares:--shared-cares} \
|
--shared-libuv \
|
||||||
%{!?with_bundled_libuv:--shared-libuv} \
|
|
||||||
--with-intl=small-icu \
|
--with-intl=small-icu \
|
||||||
--with-icu-default-data-dir=%{icudatadir} \
|
--with-icu-default-data-dir=%{icudatadir} \
|
||||||
--without-corepack \
|
--without-corepack \
|
||||||
@ -981,4 +973,94 @@ end
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
%autochangelog
|
## START: Generated by rpmautospec
|
||||||
|
* Mon Mar 30 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.22.2-1
|
||||||
|
- Update to version 22.22.2
|
||||||
|
- introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
|
||||||
|
- disabled failing tests in nghttp2 due to newer version
|
||||||
|
- patch for npm/braces CVE-2026-25547
|
||||||
|
|
||||||
|
* Wed Mar 25 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.22.0-4
|
||||||
|
- sources: changed ICU version syntax
|
||||||
|
|
||||||
|
* Tue Jan 20 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.22.0-3
|
||||||
|
- Bump release to get correct RHEL build
|
||||||
|
|
||||||
|
* Fri Jan 16 2026 tjuhasz <tjuhasz@redhat.com> - 1:22.22.0-2
|
||||||
|
- Filter for nodejs22.fmf in gating plan
|
||||||
|
|
||||||
|
* Wed Jan 14 2026 tjuhasz <tjuhasz@redhat.com> - 1:22.22.0-1
|
||||||
|
- Update to 22.22.0
|
||||||
|
|
||||||
|
* Thu Dec 04 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.19.0-3
|
||||||
|
- Unit-tests adjustment - disable internet/test-dgram-membership
|
||||||
|
|
||||||
|
* Wed Sep 03 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.19.0-2
|
||||||
|
- Add patch to prevent fips usage segfault
|
||||||
|
|
||||||
|
* Fri Aug 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.19.0-1
|
||||||
|
- Update to version 22.19.0
|
||||||
|
|
||||||
|
* Fri Aug 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-6
|
||||||
|
- configure.py: use local headers for building native addons when available
|
||||||
|
|
||||||
|
* Fri Aug 29 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-5
|
||||||
|
- spec: fix node binary calls to use versioned binary
|
||||||
|
|
||||||
|
* Wed Aug 20 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-4
|
||||||
|
- Test plan adjustments
|
||||||
|
|
||||||
|
* Thu Jul 31 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-3
|
||||||
|
- spec: devel packages explicitly conflicts
|
||||||
|
|
||||||
|
* Fri Jun 20 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.16.0-2
|
||||||
|
- Add rpminspect config to repo
|
||||||
|
|
||||||
|
* Tue May 27 2025 Andrei Radchenko <aradchen@redhat.com> - 1:22.16.0-1
|
||||||
|
- Update to version 22.16.0
|
||||||
|
|
||||||
|
* Tue May 20 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.15.0-3
|
||||||
|
- Make grep Source stricter in nodejs-tarball
|
||||||
|
|
||||||
|
* Tue May 20 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.15.0-2
|
||||||
|
- Add unit-test during build for nodejs22
|
||||||
|
|
||||||
|
* Thu Apr 24 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.15.0-1
|
||||||
|
- Update to version 22.15.0
|
||||||
|
|
||||||
|
* Tue Apr 22 2025 tjuhasz <tjuhasz@redhat.com> - 1:22.13.1-6
|
||||||
|
- Update c-ares with fix for CVE-2025-31498
|
||||||
|
|
||||||
|
* Thu Mar 06 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-5
|
||||||
|
- Revert "Generate only versioned rpms"
|
||||||
|
|
||||||
|
* Tue Feb 25 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-4
|
||||||
|
- Use stream-specific ABI dependency generator
|
||||||
|
|
||||||
|
* Tue Feb 18 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-3
|
||||||
|
- Generate only versioned rpms
|
||||||
|
|
||||||
|
* Thu Feb 13 2025 Jan Staněk <jstanek@redhat.com> - 1:22.13.1-2
|
||||||
|
- Add upper bound to unversioned obsoletes
|
||||||
|
|
||||||
|
* Mon Jan 27 2025 Tomas Juhasz <tjuhasz@redhat.com> - 1:22.13.1-1
|
||||||
|
- Updated to version 22.13.1
|
||||||
|
|
||||||
|
* Mon Jan 27 2025 Jan Staněk <jstanek@redhat.com> - 1:22.11.0-2
|
||||||
|
- Fix npm hashbang replacement
|
||||||
|
|
||||||
|
* Tue Nov 19 2024 Jan Staněk <jstanek@redhat.com> - 1:22.11.0-1
|
||||||
|
- Update to version 22.11.0 (LTS)
|
||||||
|
|
||||||
|
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1:22.4.1-4
|
||||||
|
- Bump release for October 2024 mass rebuild:
|
||||||
|
|
||||||
|
* Wed Aug 14 2024 Jan Staněk <jstanek@redhat.com> - 1:22.4.1-3
|
||||||
|
- make this stream the default for RHEL 10
|
||||||
|
|
||||||
|
* Wed Aug 07 2024 Jakub Heger <jheger@redhat.com> - 1:22.4.1-2
|
||||||
|
- enable gating
|
||||||
|
|
||||||
|
* Tue Aug 06 2024 Jan Staněk <jstanek@redhat.com> - 1:22.4.1-1
|
||||||
|
- Import SRPM from Fedora
|
||||||
|
## END: Generated by rpmautospec
|
||||||
|
|||||||
@ -1,23 +0,0 @@
|
|||||||
---
|
|
||||||
summary: Package test suite
|
|
||||||
discover:
|
|
||||||
how: fmf
|
|
||||||
url: https://gitlab.com/redhat/centos-stream/tests/nodejs
|
|
||||||
filter: "component:nodejs22"
|
|
||||||
environment:
|
|
||||||
NODEJS_MAIN_PACKAGE: nodejs22
|
|
||||||
NODEJS_DEVEL_PACKAGE: nodejs22-devel
|
|
||||||
NODEJS_BIN_PACKAGE: nodejs22-bin
|
|
||||||
NPM_BIN_PACKAGE: nodejs22-npm-bin
|
|
||||||
NODE_BIN: /usr/bin/node-22
|
|
||||||
NPM_BIN: /usr/bin/npm-22
|
|
||||||
NODE_INCLUDE_PATH: /usr/include/node
|
|
||||||
prepare:
|
|
||||||
- name: install tested packages
|
|
||||||
how: install
|
|
||||||
package:
|
|
||||||
- ${NODEJS_MAIN_PACKAGE}
|
|
||||||
- ${NODEJS_DEVEL_PACKAGE}
|
|
||||||
execute:
|
|
||||||
how: tmt
|
|
||||||
...
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
summary: Internal Tier1 tests plan
|
|
||||||
discover:
|
|
||||||
how: fmf
|
|
||||||
filter: 'tier: 1 & component: nodejs:22'
|
|
||||||
url: https://pkgs.devel.redhat.com/git/tests/nodejs
|
|
||||||
execute:
|
|
||||||
how: tmt
|
|
||||||
adjust:
|
|
||||||
enabled: false
|
|
||||||
when: distro == centos-stream or distro == fedora
|
|
||||||
@ -1,28 +0,0 @@
|
|||||||
# This check is disabled because rpminspect has issues with
|
|
||||||
# macro nesting and autorelease macro
|
|
||||||
# which led to continuous need to waive or ignore the failure of the test
|
|
||||||
# e.g:https://artifacts.dev.testing-farm.io/07049d23-04ed-451c-99f6-eed73e369d28/
|
|
||||||
inspections:
|
|
||||||
disttag: off
|
|
||||||
|
|
||||||
# Multiple annochecks are disabled because they are creating Verify type failures
|
|
||||||
annocheck:
|
|
||||||
extra_opts:
|
|
||||||
# Issue: https://github.com/nodejs/node/issues/40368
|
|
||||||
# skip test for link time optimalization
|
|
||||||
# test fails because nodejs is compiled without LTO.
|
|
||||||
# This is on purpose as it creates issues.
|
|
||||||
hardened: --skip-lto
|
|
||||||
# Temporarily disabled
|
|
||||||
# skip test for GNU Property notes formatting
|
|
||||||
# test fails because it's missing CET notes
|
|
||||||
# feature is unsopported by upstream
|
|
||||||
# See RHEL-85793 for details
|
|
||||||
hardened: --skip-property-note
|
|
||||||
hardened: --skip-cf-protection
|
|
||||||
# Temporarily disabled
|
|
||||||
# skip test for dynamic tags
|
|
||||||
# BTI_PLT protection feature is missing from dynamic tags
|
|
||||||
# libnode.so.127 lacks this feature
|
|
||||||
# See RHEL-85837 for details
|
|
||||||
hardened: --skip-dynamic-tags
|
|
||||||
2
sources
2
sources
@ -1,3 +1,3 @@
|
|||||||
SHA512 (node-v22.23.1-stripped.tar.gz) = dee26039e7a6f5d740c9f022ff702699748901c72d77ec41b91f4d9cc295d79596435d3e74446074bee1b34bd18b34f09144cd63266bf68858c975bb9e6339a3
|
|
||||||
SHA512 (icu4c-78.2-data-bin-b.zip) = 032a1e519bf92dfa7936ef85ebed697550dbcb4e32c6ecd28ffecb158a403eeff6c0a3545b2551eba73f288e31693be6880e202a38cd86c129dffa395e8ab625
|
SHA512 (icu4c-78.2-data-bin-b.zip) = 032a1e519bf92dfa7936ef85ebed697550dbcb4e32c6ecd28ffecb158a403eeff6c0a3545b2551eba73f288e31693be6880e202a38cd86c129dffa395e8ab625
|
||||||
SHA512 (icu4c-78.2-data-bin-l.zip) = c0b46de115332940d3276763904caa6257eb516edce4382632f4b96a5b010fee4cb06a5e10ef5eee2f881515c1ee8277d9ae59015f6de6fe1d175b9d00dbb1ca
|
SHA512 (icu4c-78.2-data-bin-l.zip) = c0b46de115332940d3276763904caa6257eb516edce4382632f4b96a5b010fee4cb06a5e10ef5eee2f881515c1ee8277d9ae59015f6de6fe1d175b9d00dbb1ca
|
||||||
|
SHA512 (node-v22.22.2-stripped.tar.gz) = 82c3357cce10a3fe89373ec4e3460af5992d853f28a7339358a3f910959e7b17987c8eb1748d9c3033d4c642701d321e2265cc0ac004a218860da4eda2971226
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user