diff --git a/CVE-2024-21538.patch b/CVE-2024-21538.patch new file mode 100644 index 0000000..979818a --- /dev/null +++ b/CVE-2024-21538.patch @@ -0,0 +1,46 @@ +Applied following patches, + +From 5ff3a07d9add449021d806e45c4168203aa833ff Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andr=C3=A9=20Cruz?= +Date: Wed, 6 Nov 2024 22:02:49 +0000 +Subject: [PATCH] fix: disable regexp backtracking (#160) + +--- + lib/util/escape.js | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + + +From 640d391fde65388548601d95abedccc12943374f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andr=C3=A9=20Cruz?= +Date: Thu, 7 Nov 2024 12:50:38 +0000 +Subject: [PATCH] fix: fix escaping bug introduced by backtracking + +--- + lib/util/escape.js | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + + +Index: node-v18.20.5/deps/npm/node_modules/cross-spawn/lib/util/escape.js +=================================================================== +--- node-v18.20.5.orig/deps/npm/node_modules/cross-spawn/lib/util/escape.js ++++ node-v18.20.5/deps/npm/node_modules/cross-spawn/lib/util/escape.js +@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscap + arg = `${arg}`; + + // Algorithm below is based on https://qntm.org/cmd ++ // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input ++ // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information + + // Sequence of backslashes followed by a double quote: + // double up all the backslashes and escape the double quote +- arg = arg.replace(/(\\*)"/g, '$1$1\\"'); ++ arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"'); + + // Sequence of backslashes followed by the end of the string + // (which will become a double quote later): + // double up all the backslashes +- arg = arg.replace(/(\\*)$/, '$1$1'); ++ arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1'); + + // All other backslashes occur literally + diff --git a/SHASUMS256.txt b/SHASUMS256.txt index 59fcf8b..081f5ae 100644 --- a/SHASUMS256.txt +++ b/SHASUMS256.txt @@ -1,41 +1,41 @@ -dd24c8b6fdaf46361e130c894fd7282266f944b54196636e6df583fdec1e836f node-v20.15.1-aix-ppc64.tar.gz -9cbfc9d496427893505f8cb81aa4c1554fe449881cb4a6c5410e494c5fc36674 node-v20.15.1-arm64.msi -4743bc042f90ba5d9edf09403207290a9cdd2f6061bdccf7caaa0bbfd49f343e node-v20.15.1-darwin-arm64.tar.gz -106ad5288f1da94bf25cf9fba4a070b442e3213e25ce8af3ad35bf6e266213f6 node-v20.15.1-darwin-arm64.tar.xz -f5379772ffae1404cfd1fcc8cf0c6c5971306b8fb2090d348019047306de39dc node-v20.15.1-darwin-x64.tar.gz -34ad01b42025f72d486f9775a2f170913ad6b9fe2d4ceb67746a08de0e475b88 node-v20.15.1-darwin-x64.tar.xz -8c2305c6df5d14525e0711f0da38295600987df4c2710c738c01400862a176b4 node-v20.15.1-headers.tar.gz -d6e4f101f8734f96be558ad4b84a35a81f33decc050a7d2d8e5b39573b79bdf8 node-v20.15.1-headers.tar.xz -8554c91ccd32782351035d3a9b168ad01c6922480800a21870fc5d6d86c2bb70 node-v20.15.1-linux-arm64.tar.gz -10d47a46ef208b3e4b226e4d595a82659123b22397ed77b7975d989114ec317e node-v20.15.1-linux-arm64.tar.xz -2c16717da7d2d7b00f6af146cdf436a0297cbcee52c85b754e4c9ed7cee34b51 node-v20.15.1-linux-armv7l.tar.gz -7bc120efdd8018f6915471b963d9b80adf4ed406d6dc9edb4ae944b85f505c4c node-v20.15.1-linux-armv7l.tar.xz -b91df4971b428f9cb2fbe427c919ad382c4cd206a85e5c918c60c15f1e3d2e32 node-v20.15.1-linux-ppc64le.tar.gz -b33e684802251397ad62ad3f8a1836267ee8b7723f87f669470018ad0035287b node-v20.15.1-linux-ppc64le.tar.xz -393f511b5623c8a872e58203914a54bc7e086b8ca870d34833766d4f9c4e2448 node-v20.15.1-linux-s390x.tar.gz -e2c36cdccc8a7c1000a349dd6fea8b0ce39884eae7b3dd1950d0105120f20848 node-v20.15.1-linux-s390x.tar.xz -a9db028c0a1c63e3aa0d97de24b0966bc507d8239b3aedc4e752eea6b0580665 node-v20.15.1-linux-x64.tar.gz -26700f8d3e78112ad4a2618a9c8e2816e38a49ecf0213ece80e54c38cb02563f node-v20.15.1-linux-x64.tar.xz -4f437463e708c4c7faaa436bed46c3ea814ec3796cfe1e02515ab21d2038b4b1 node-v20.15.1-win-arm64.7z -6cc4f9ca826f5b3e0c555d156bc6adcc371bd96c2874ee748d0f97e2938d3c2b node-v20.15.1-win-arm64.zip -5dbaf27053a0566395f81ebe9e4660141de1bc7b0fe80583447bb36804643f75 node-v20.15.1-win-x64.7z -ba6c3711e2c3d0638c5f7cea3c234553808a73c52a5962a6cdb47b5210b70b04 node-v20.15.1-win-x64.zip -2281b04df475efa64ef483529fc9cad1715d42d5766e68541b64970297247692 node-v20.15.1-win-x86.7z -9a08021e4bcc4694bc72d00ce1ce0686e6de6a9a855678239625f96b09c70b07 node-v20.15.1-win-x86.zip -b139ba1b82807918af40fbed49a5b529f67ba198e87bcabdac907b734ff83ab5 node-v20.15.1-x64.msi -6079df4ab0d457180b4b730fab76d0b60b14342d797cc10a4f2d7c8b61fba584 node-v20.15.1-x86.msi -93b9549a65d459cc2e035c0d583101f827607f43376b5f23a3a2a900f5467321 node-v20.15.1.pkg -da228a0c27922f02001d9a781793696432096ab2da658eb77d7fc21693f4c5cb node-v20.15.1.tar.gz -fdd53a5729d936691a2a1151046fb4897721cb8b0fca2af957823a9b40fe0c34 node-v20.15.1.tar.xz -8e3f84e8ec7e41f98a048eb0c1365cfe54426a556ead98c4803df45d29e0335d win-arm64/node.exe -a4f01329c1c211082ac3ed387ff6651530040bbf7250ec419ce8f95b10d7804a win-arm64/node.lib -493292505fd7a156b1e7b46c7f05001a0684fba6f734f83abfcf7fed88625453 win-arm64/node_pdb.7z -88d4af538deadf8fa2638df84a76bd7dd26f0aeac8dc584f213da736f322377c win-arm64/node_pdb.zip -229fb64aeb10d3cc18eaaa2f5a4c3f1c81792dd3647c5c4350e142db528d0f89 win-x64/node.exe -87056190b7cd06f40058f8e059efd328cdcc7600b825afa102c0aa5039865af5 win-x64/node.lib -bb2198b381bb5d7bc08e2cdda3db911996e310b944b05cb8c7c271a5a7ab0901 win-x64/node_pdb.7z -316ee3fbbe976981e8ee0b81204aece9d3c2337c83f1644d90bb552c3068ca44 win-x64/node_pdb.zip -6e7f3cbb46569a58babe99de2df8a69e98ad613674d4fed71b1dca866e1a72e8 win-x86/node.exe -fa02ae7feca7eb6c4a0f1b929126df400719f5d18a2ec4b7d12c52fbe0b13814 win-x86/node.lib -e8f6da56c9bc73add71a41c4d5ed92fc6cf9e7c5067d7a0d3f7b9fd6391f07c4 win-x86/node_pdb.7z -1b4e9dbc5a8b0a5121d32351f9654c1ab451e88680982d487a4a6c40d50bd730 win-x86/node_pdb.zip +efcddeb91b189b02706d1a75a67b4a111253ec8f64cc30cc3dc4649744abd52b node-v20.18.2-aix-ppc64.tar.gz +40c5a72564b8667342bec84aab50d2af1503af2b274f1a7a09d2d929461988b6 node-v20.18.2-arm64.msi +fa76d5b5340f14070ebaa88ef8faa28c1e9271502725e830cb52f0cf5b6493de node-v20.18.2-darwin-arm64.tar.gz +32dc17147054df9cdf96d03103f4661b4cb0bb9b4ca4b70e34fe632f1bab189c node-v20.18.2-darwin-arm64.tar.xz +00a16bb0a82a2ad5d00d66b466ae1afa678482283747c27e9bce96668f334744 node-v20.18.2-darwin-x64.tar.gz +184c9b8e246a3fd139caf2456510dc99ec548ad2e5203fbc5fc56ba48104e8eb node-v20.18.2-darwin-x64.tar.xz +d74c718976adc308991fb8784f0b3f82845436bf8f04d2c982ab5cab5115289f node-v20.18.2-headers.tar.gz +05819d72dcc0aa788baab1066e18ede5f1ab6730a1925cd6b15c131b55fd4272 node-v20.18.2-headers.tar.xz +319789e8a055ff80793a05e633c8c5c9226050144a09da3747225b4ec56a2a99 node-v20.18.2-linux-arm64.tar.gz +5c1437aa16e7e6a2e0687a42c4d3f0a8f8a2039cda8880cb3be8cd983aeefb44 node-v20.18.2-linux-arm64.tar.xz +65397a4a63960bda94718099698d2961623e9ef400f60f4c3a71add2268bccfb node-v20.18.2-linux-armv7l.tar.gz +63d4df56fb2e34a5077345f78941094204d2223ce03b8ebc9c1500e6e2aae68d node-v20.18.2-linux-armv7l.tar.xz +9b2f0fd3b02d8b59bde3e2a251e4df501e755c99cfc4886b0bdf85fa4d0bc538 node-v20.18.2-linux-ppc64le.tar.gz +828a2635261ca225cd4a8a4b1a914003cdc7b30656c2e9092ac7aab02ac361db node-v20.18.2-linux-ppc64le.tar.xz +7e52e03823feaa2483a7cbcf85767790776f87a2c7112d87600c3d9d3b1ae6e9 node-v20.18.2-linux-s390x.tar.gz +bcf3680e111f1d24e403db3d5600315266ae1f8d9d1f69f39c61dbf8d8c9036e node-v20.18.2-linux-s390x.tar.xz +eb5b031bdd728871c3b9a82655dbfa533bc262c0b6da1d09a86842430cef07d4 node-v20.18.2-linux-x64.tar.gz +4e50f727ae09bdafecf2322c72faf7cd82bf3b8851a16b8bb63974e0d8d6eceb node-v20.18.2-linux-x64.tar.xz +87d10db681bca2a39fcadcc908d5e5b2c7effa16370c4ca555373b85e25275b1 node-v20.18.2.pkg +cf3ef49fafbfee3cdcd936a0d6031341b73bfa6b26a484ea0a4936c26d24b829 node-v20.18.2.tar.gz +69bf81b70f3a95ae0763459f02860c282d7e3a47567c8afaf126cc778176a882 node-v20.18.2.tar.xz +d28d21e000ebed8b6131201b727d1998d4dbc4dbdb6e5ad07679552e4c75fa4d node-v20.18.2-win-arm64.7z +b89d196a2d9dc3dac87c268aac9a983fa2fd1881c14884bc848312783ccf7d2f node-v20.18.2-win-arm64.zip +06e72c0f78cc1bf1819eb0a0a37001d2917f19ad46a149c2f923c901f599ba52 node-v20.18.2-win-x64.7z +ed790b94570518a7dce67b62485e16bc4bffecee4ec3b6df35ed220ae91117a5 node-v20.18.2-win-x64.zip +fa561ebff3f52667228f9fcd9e67ce22a86e5c28c8e3782e01a95c90b6ed114d node-v20.18.2-win-x86.7z +25f00a77843accc098561a35ce3ed923357f0127b8e5db594cb62188e3290b88 node-v20.18.2-win-x86.zip +f3ad2d799e1645281d22d71b447f3899e569da87fea78bef9571b0c2b53288d6 node-v20.18.2-x64.msi +783c4041ceb69226184a1b26177b5d9dc85e502d0f124c64d2b2c6f8ab12e5d5 node-v20.18.2-x86.msi +83e7ad1b8c4d4d9c5e06849c3e8f3a5948a5eb6aa34c5bd973ba700e0386f42c win-arm64/node.exe +58795bcd44e8023ff443dedabf7f9af928732a51befc5324082aafe56e0f5eb0 win-arm64/node.lib +83fdda5fb5869c18f5d5d3dc4d0479f6bdad16f0888c95b8008f03654593afdd win-arm64/node_pdb.7z +4049c1e7c2fc82c4d43c9d8567e7d20f20c0d360c281fcb924ce9cd4b9ce8dc3 win-arm64/node_pdb.zip +8487a277e92282904dfe0f860dbd5d229543e97a858a223fbe9c9b8670bbe170 win-x64/node.exe +5a16801c62c34c8056744ac339950c970b2b76f39b2d02afef4112ff51b74f1a win-x64/node.lib +6ff19d51a762405717f7dff33811ba6371334de95946efbccf6f8dd786ec93e8 win-x64/node_pdb.7z +07ef9641b5a339de2f43f698dc3b1aeb321e851645b199cbeb0f378674263bf1 win-x64/node_pdb.zip +ab4b6beaaa170cfed83a2c9c71d8d5032ac514a5ebd7a5aa0553731267964f5e win-x86/node.exe +fcc6ab34ebd4ad3a44de12376c3822c2ebc41febaa1ed4c4221ddc239f79f61c win-x86/node.lib +ab74677f28b517eee9f745930541d02a870ae2d3f29a5ac91fe630813a1cd987 win-x86/node_pdb.7z +6080ab7b513194510c8938c276b7fd4379eb0ed69cfa09dbb21da8a4eeddd75f win-x86/node_pdb.zip diff --git a/SHASUMS256.txt.sig b/SHASUMS256.txt.sig index cbe4e01..71b5b5e 100644 Binary files a/SHASUMS256.txt.sig and b/SHASUMS256.txt.sig differ diff --git a/fix_ci_tests.patch b/fix_ci_tests.patch index 166fbec..73e4992 100644 --- a/fix_ci_tests.patch +++ b/fix_ci_tests.patch @@ -2,10 +2,10 @@ Author: Adam Majer Date: Dec 20 09:18:49 UTC 2017 Summary: Fix CI unit tests framework for OBS building -Index: node-v20.15.1/test/parallel/test-module-loading-globalpaths.js +Index: node-v20.18.1/test/parallel/test-module-loading-globalpaths.js =================================================================== ---- node-v20.15.1.orig/test/parallel/test-module-loading-globalpaths.js -+++ node-v20.15.1/test/parallel/test-module-loading-globalpaths.js +--- node-v20.18.1.orig/test/parallel/test-module-loading-globalpaths.js ++++ node-v20.18.1/test/parallel/test-module-loading-globalpaths.js @@ -11,6 +11,9 @@ const { addLibraryPath } = require('../c addLibraryPath(process.env); @@ -16,10 +16,10 @@ Index: node-v20.15.1/test/parallel/test-module-loading-globalpaths.js if (process.argv[2] === 'child') { console.log(require(pkgName).string); } else { -Index: node-v20.15.1/test/parallel/test-tls-passphrase.js +Index: node-v20.18.1/test/parallel/test-tls-passphrase.js =================================================================== ---- node-v20.15.1.orig/test/parallel/test-tls-passphrase.js -+++ node-v20.15.1/test/parallel/test-tls-passphrase.js +--- node-v20.18.1.orig/test/parallel/test-tls-passphrase.js ++++ node-v20.18.1/test/parallel/test-tls-passphrase.js @@ -223,7 +223,7 @@ server.listen(0, common.mustCall(functio }, onSecureConnect()); })).unref(); @@ -29,10 +29,10 @@ Index: node-v20.15.1/test/parallel/test-tls-passphrase.js // Missing passphrase assert.throws(function() { -Index: node-v20.15.1/test/parallel/test-repl-envvars.js +Index: node-v20.18.1/test/parallel/test-repl-envvars.js =================================================================== ---- node-v20.15.1.orig/test/parallel/test-repl-envvars.js -+++ node-v20.15.1/test/parallel/test-repl-envvars.js +--- node-v20.18.1.orig/test/parallel/test-repl-envvars.js ++++ node-v20.18.1/test/parallel/test-repl-envvars.js @@ -2,7 +2,9 @@ // Flags: --expose-internals @@ -44,11 +44,11 @@ Index: node-v20.15.1/test/parallel/test-repl-envvars.js const stream = require('stream'); const { describe, test } = require('node:test'); const REPL = require('internal/repl'); -Index: node-v20.15.1/Makefile +Index: node-v20.18.1/Makefile =================================================================== ---- node-v20.15.1.orig/Makefile -+++ node-v20.15.1/Makefile -@@ -392,7 +392,6 @@ ADDONS_HEADERS_PREREQS := tools/install. +--- node-v20.18.1.orig/Makefile ++++ node-v20.18.1/Makefile +@@ -396,7 +396,6 @@ ADDONS_HEADERS_PREREQS := tools/install. $(wildcard deps/uv/include/*/*.h) \ $(wildcard deps/v8/include/*.h) \ $(wildcard deps/v8/include/*/*.h) \ @@ -56,7 +56,7 @@ Index: node-v20.15.1/Makefile src/node.h src/node_api.h src/js_native_api.h src/js_native_api_types.h \ src/node_api_types.h src/node_buffer.h src/node_object_wrap.h \ src/node_version.h -@@ -563,7 +562,8 @@ test-ci-js: | clear-stalled +@@ -568,7 +567,8 @@ test-ci-js: | clear-stalled .PHONY: test-ci # Related CI jobs: most CI tests, excluding node-test-commit-arm-fanned test-ci: LOGLEVEL := info @@ -66,7 +66,7 @@ Index: node-v20.15.1/Makefile out/Release/cctest --gtest_output=xml:out/junit/cctest.xml $(PYTHON) tools/test.py $(PARALLEL_ARGS) -p tap --logfile test.tap \ --mode=$(BUILDTYPE_LOWER) --flaky-tests=$(FLAKY_TESTS) \ -@@ -745,7 +745,8 @@ apidocs_json = $(addprefix out/,$(apidoc +@@ -750,7 +750,8 @@ apidocs_json = $(addprefix out/,$(apidoc apiassets = $(subst api_assets,api/assets,$(addprefix out/,$(wildcard doc/api_assets/*))) tools/doc/node_modules: tools/doc/package.json @@ -76,10 +76,10 @@ Index: node-v20.15.1/Makefile echo "Skipping tools/doc/node_modules (no crypto)"; \ else \ cd tools/doc && $(call available-node,$(run-npm-ci)) \ -Index: node-v20.15.1/tools/test.py +Index: node-v20.18.1/tools/test.py =================================================================== ---- node-v20.15.1.orig/tools/test.py -+++ node-v20.15.1/tools/test.py +--- node-v20.18.1.orig/tools/test.py ++++ node-v20.18.1/tools/test.py @@ -1386,7 +1386,7 @@ def BuildOptions(): result.add_option("-s", "--suite", help="A test suite", default=[], action="append") @@ -89,12 +89,12 @@ Index: node-v20.15.1/tools/test.py result.add_option("--arch", help='The architecture to run tests for', default='none') result.add_option("--snapshot", help="Run the tests with snapshot turned on", -Index: node-v20.15.1/test/parallel/test-crypto-dh.js +Index: node-v20.18.1/test/parallel/test-crypto-dh.js =================================================================== ---- node-v20.15.1.orig/test/parallel/test-crypto-dh.js -+++ node-v20.15.1/test/parallel/test-crypto-dh.js -@@ -90,9 +90,7 @@ const crypto = require('crypto'); - const hasOpenSSL3WithNewErrorMessage = (v >= 0x300000c0 && v <= 0x30100000) || (v >= 0x30100040 && v <= 0x30200000); +--- node-v20.18.1.orig/test/parallel/test-crypto-dh.js ++++ node-v20.18.1/test/parallel/test-crypto-dh.js +@@ -91,9 +91,7 @@ const crypto = require('crypto'); + (common.hasOpenSSL(3, 1, 4)); assert.throws(() => { dh3.computeSecret(''); - }, { message: common.hasOpenSSL3 && !hasOpenSSL3WithNewErrorMessage ? @@ -104,11 +104,11 @@ Index: node-v20.15.1/test/parallel/test-crypto-dh.js } } -Index: node-v20.15.1/test/parallel/test-node-output-errors.mjs +Index: node-v20.18.1/test/parallel/test-node-output-errors.mjs =================================================================== ---- node-v20.15.1.orig/test/parallel/test-node-output-errors.mjs -+++ node-v20.15.1/test/parallel/test-node-output-errors.mjs -@@ -28,6 +28,7 @@ describe('errors output', { concurrency: +--- node-v20.18.1.orig/test/parallel/test-node-output-errors.mjs ++++ node-v20.18.1/test/parallel/test-node-output-errors.mjs +@@ -26,6 +26,7 @@ describe('errors output', { concurrency: .replaceAll(/\/(\w)/g, '*$1') .replaceAll('*test*', '*') .replaceAll('*fixtures*errors*', '*') @@ -116,10 +116,10 @@ Index: node-v20.15.1/test/parallel/test-node-output-errors.mjs .replaceAll('file:**', 'file:*/'); } -Index: node-v20.15.1/test/parallel/test-crypto-fips.js +Index: node-v20.18.1/test/parallel/test-crypto-fips.js =================================================================== ---- node-v20.15.1.orig/test/parallel/test-crypto-fips.js -+++ node-v20.15.1/test/parallel/test-crypto-fips.js +--- node-v20.18.1.orig/test/parallel/test-crypto-fips.js ++++ node-v20.18.1/test/parallel/test-crypto-fips.js @@ -3,6 +3,8 @@ const common = require('../common'); if (!common.hasCrypto) @@ -129,10 +129,10 @@ Index: node-v20.15.1/test/parallel/test-crypto-fips.js const assert = require('assert'); const spawnSync = require('child_process').spawnSync; -Index: node-v20.15.1/test/parallel/test-node-output-v8-warning.mjs +Index: node-v20.18.1/test/parallel/test-node-output-v8-warning.mjs =================================================================== ---- node-v20.15.1.orig/test/parallel/test-node-output-v8-warning.mjs -+++ node-v20.15.1/test/parallel/test-node-output-v8-warning.mjs +--- node-v20.18.1.orig/test/parallel/test-node-output-v8-warning.mjs ++++ node-v20.18.1/test/parallel/test-node-output-v8-warning.mjs @@ -15,7 +15,7 @@ describe('v8 output', { concurrency: tru .replaceAll('*test*', '*') .replaceAll(/.*?\*fixtures\*v8\*/g, '(node:*) V8: *') // Replace entire path before fixtures/v8 @@ -142,3 +142,16 @@ Index: node-v20.15.1/test/parallel/test-node-output-v8-warning.mjs } const common = snapshot .transform(snapshot.replaceWindowsLineEndings, snapshot.replaceWindowsPaths, replaceNodeVersion); +Index: node-v22.12.0/test/parallel/test-dns.js +=================================================================== +--- node-v22.12.0.orig/test/parallel/test-dns.js ++++ node-v22.12.0/test/parallel/test-dns.js +@@ -403,7 +403,7 @@ assert.throws(() => { + + const server = dgram.createSocket('udp4'); + +- server.on('message', common.mustCall((msg, { address, port }) => { ++ server.on('message', common.mustCallAtLeast((msg, { address, port }) => { + const parsed = dnstools.parseDNSPacket(msg); + const domain = parsed.questions[0].domain; + assert.strictEqual(domain, 'example.org'); diff --git a/linker_lto_jobs.patch b/linker_lto_jobs.patch index 1d856f9..62519ca 100644 --- a/linker_lto_jobs.patch +++ b/linker_lto_jobs.patch @@ -3,11 +3,11 @@ is run serially over these binaries instead of in parallel. OBS workers run out of memory as each executable seems to require upward of 5G RAM -Index: node-v19.7.0/node.gyp +Index: node-v20.18.1/node.gyp =================================================================== ---- node-v19.7.0.orig/node.gyp -+++ node-v19.7.0/node.gyp -@@ -951,6 +951,7 @@ +--- node-v20.18.1.orig/node.gyp ++++ node-v20.18.1/node.gyp +@@ -1155,6 +1155,7 @@ 'deps/uvwasi/uvwasi.gyp:uvwasi', 'deps/simdutf/simdutf.gyp:simdutf', 'deps/ada/ada.gyp:ada', @@ -15,9 +15,9 @@ Index: node-v19.7.0/node.gyp ], 'includes': [ -@@ -1047,6 +1048,7 @@ +@@ -1229,6 +1230,7 @@ + '<(node_lib_target_name)', 'deps/histogram/histogram.gyp:histogram', - 'deps/uvwasi/uvwasi.gyp:uvwasi', 'deps/ada/ada.gyp:ada', + 'cctest' ], diff --git a/node-v20.15.1.tar.xz b/node-v20.15.1.tar.xz deleted file mode 100644 index f5dd34d..0000000 --- a/node-v20.15.1.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:fdd53a5729d936691a2a1151046fb4897721cb8b0fca2af957823a9b40fe0c34 -size 41880412 diff --git a/node-v20.18.2.tar.xz b/node-v20.18.2.tar.xz new file mode 100644 index 0000000..71461f2 --- /dev/null +++ b/node-v20.18.2.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:69bf81b70f3a95ae0763459f02860c282d7e3a47567c8afaf126cc778176a882 +size 41933624 diff --git a/nodejs.keyring b/nodejs.keyring index aa22d75..19a6404 100644 Binary files a/nodejs.keyring and b/nodejs.keyring differ diff --git a/nodejs20.changes b/nodejs20.changes index 9e387dd..eb68597 100644 --- a/nodejs20.changes +++ b/nodejs20.changes @@ -1,3 +1,38 @@ +------------------------------------------------------------------- +Wed Jan 22 11:23:00 UTC 2025 - Adam Majer + +- Update to 20.18.2: + * src,loader,permission: throw on InternalWorker use when + permission model is enabled (bsc#1236251, CVE-2025-23083) + * src: fix HTTP2 mem leak on premature close and ERR_PROTO + (bsc#1236250, CVE-2025-23085) + * deps: Use of Insufficiently Random Values in undici fetch() + (bsc#1236258, CVE-2025-22150) + +------------------------------------------------------------------- +Wed Dec 4 16:32:55 UTC 2024 - Adam Majer + +- Update to 20.18.1 + * Experimental Network Inspection Support in Node.js + * Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext + * New option for vm.createContext() to create a context with a + freezable globalThis + * buffer: optimize createFromString +- Changes in 20.17.0: + * module: support require()ing synchronous ESM graphs + * path: add matchesGlob method + * stream: expose DuplexPair API +- Changes in 20.16.0: + * process: add process.getBuiltinModule(id) + * inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth + * buffer: add .bytes() method to Blob + +- CVE-2024-21538.patch: fixes regular expression denial of service + (bsc#1233856, CVE-2024-21538) +- linker_lto_jobs.patch: refreshed +- fix_ci_tests.patch: fix dns test vs. older c-ares +- nodejs.keyring: sync keys with upstream + ------------------------------------------------------------------- Fri Jul 12 13:21:02 UTC 2024 - Adam Majer diff --git a/nodejs20.spec b/nodejs20.spec index 24d885e..f09e53a 100644 --- a/nodejs20.spec +++ b/nodejs20.spec @@ -31,7 +31,7 @@ %endif Name: nodejs20 -Version: 20.15.1 +Version: 20.18.2 Release: 0 # Double DWZ memory limits @@ -152,6 +152,7 @@ Patch7: manual_configure.patch Patch13: openssl_binary_detection.patch +Patch82: CVE-2024-21538.patch ## Patches specific to SUSE and openSUSE Patch100: linker_lto_jobs.patch @@ -199,10 +200,10 @@ BuildRequires: config(netcfg) %if 0%{?suse_version} == 1110 # GCC 5 is only available in the SUSE:SLE-11:SP4:Update repository (SDK). %if %node_version_number >= 8 -BuildRequires: gcc5-c++ +BuildRequires: gcc5-c++ %define forced_gcc_version 5 %else -BuildRequires: gcc48-c++ +BuildRequires: gcc48-c++ %define forced_gcc_version 4.8 %endif %endif @@ -212,15 +213,15 @@ BuildRequires: gcc48-c++ # for SLE-12:Update targets %if 0%{?suse_version} == 1315 %if %node_version_number >= 17 -BuildRequires: gcc12-c++ +BuildRequires: gcc12-c++ %define forced_gcc_version 12 %else %if %node_version_number >= 14 -BuildRequires: gcc9-c++ +BuildRequires: gcc9-c++ %define forced_gcc_version 9 %else %if %node_version_number >= 8 -BuildRequires: gcc7-c++ +BuildRequires: gcc7-c++ %define forced_gcc_version 7 %endif %endif @@ -229,7 +230,7 @@ BuildRequires: gcc7-c++ %if 0%{?suse_version} == 1500 %if %node_version_number >= 17 -BuildRequires: gcc12-c++ +BuildRequires: gcc12-c++ %define forced_gcc_version 12 %endif %endif @@ -244,11 +245,19 @@ BuildRequires: gcc-c++ # Python dependencies %if %node_version_number >= 14 -%if 0%{?suse_version} && 0%{?suse_version} < 1500 +%if 0%{?suse_version} +%if 0%{?suse_version} < 1500 BuildRequires: python36 %define forced_python_version 3.6m -%else +%endif +%if %{?suse_version} == 1500 +BuildRequires: python311 +%define forced_python_version 3.11 +%endif +%if %{?suse_version} > 1500 BuildRequires: python3 +BuildRequires: python3-setuptools +%endif %endif %else @@ -297,7 +306,7 @@ BuildRequires: openssl >= %{openssl_req_ver} %else # bundled openssl %if %node_version_number <= 12 && 0%{?suse_version} == 1315 && 0%{?sle_version} < 120400 -Provides: bundled(openssl) = 3.0.13 +Provides: bundled(openssl) = 3.0.15 %else BuildRequires: bundled_openssl_should_not_be_required %endif @@ -308,7 +317,11 @@ BuildRequires: bundled_openssl_should_not_be_required %if ! 0%{with intree_cares} BuildRequires: pkgconfig(libcares) >= 1.17.0 %else -Provides: bundled(libcares2) = 1.28.1 +Provides: bundled(libcares2) = 1.33.1 +%endif + +%if %node_version_number >= 22 && 0%{?suse_version} > 1500 +BuildRequires: sqlite3-devel %endif %if ! 0%{with intree_icu} @@ -382,17 +395,17 @@ BuildRequires: pkgconfig(libbrotlidec) Provides: bundled(llhttp) = 8.1.2 Provides: bundled(ngtcp2) = 1.1.0 Provides: bundled(base64) = 0.5.2 -Provides: bundled(simdutf) = 5.2.8 +Provides: bundled(simdutf) = 5.5.0 # bundled url-ada parser, not ada -Provides: bundled(ada) = 2.7.8 +Provides: bundled(ada) = 2.9.0 -Provides: bundled(node-acorn) = 8.11.3 -Provides: bundled(node-acorn-walk) = 8.3.2 -Provides: bundled(node-cjs-module-lexer) = 1.2.2 -Provides: bundled(node-corepack) = 0.28.1 -Provides: bundled(node-minimatch) = 9.0.4 -Provides: bundled(node-undici) = 6.13.0 +Provides: bundled(node-acorn) = 8.12.1 +Provides: bundled(node-acorn-walk) = 8.3.4 +Provides: bundled(node-cjs-module-lexer) = 1.4.1 +Provides: bundled(node-corepack) = 0.29.4 +Provides: bundled(node-minimatch) = 10.0.1 +Provides: bundled(node-undici) = 6.21.1 %description Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. Node.js @@ -421,7 +434,7 @@ Requires: nodejs-common Requires: nodejs20 = %{version} Provides: nodejs-npm = %{version} Obsoletes: nodejs-npm < 4.0.0 -Provides: npm(npm) = 10.7.0 +Provides: npm(npm) = 10.8.2 Provides: npm = %{version} %if 0%{?suse_version} >= 1500 %if %{node_version_number} >= 10 @@ -439,24 +452,23 @@ Provides: bundled(node-ansi-styles) = 6.2.1 Provides: bundled(node-aproba) = 2.0.0 Provides: bundled(node-archy) = 1.0.0 Provides: bundled(node-balanced-match) = 1.0.2 -Provides: bundled(node-bin-links) = 4.0.3 +Provides: bundled(node-bin-links) = 4.0.4 Provides: bundled(node-binary-extensions) = 2.3.0 Provides: bundled(node-brace-expansion) = 2.0.1 -Provides: bundled(node-builtins) = 5.1.0 -Provides: bundled(node-cacache) = 18.0.2 +Provides: bundled(node-cacache) = 18.0.3 Provides: bundled(node-chalk) = 5.3.0 Provides: bundled(node-chownr) = 2.0.0 Provides: bundled(node-ci-info) = 4.0.0 -Provides: bundled(node-cidr-regex) = 4.0.5 +Provides: bundled(node-cidr-regex) = 4.1.1 Provides: bundled(node-clean-stack) = 2.2.0 Provides: bundled(node-cli-columns) = 4.0.0 -Provides: bundled(node-cmd-shim) = 6.0.2 +Provides: bundled(node-cmd-shim) = 6.0.3 Provides: bundled(node-color-convert) = 2.0.1 Provides: bundled(node-color-name) = 1.1.4 Provides: bundled(node-common-ancestor-path) = 1.0.1 Provides: bundled(node-cross-spawn) = 7.0.3 Provides: bundled(node-cssesc) = 3.0.0 -Provides: bundled(node-debug) = 4.3.4 +Provides: bundled(node-debug) = 4.3.5 Provides: bundled(node-diff) = 5.2.0 Provides: bundled(node-eastasianwidth) = 0.2.0 Provides: bundled(node-emoji-regex) = 8.0.0 @@ -466,60 +478,55 @@ Provides: bundled(node-env-paths) = 2.2.1 Provides: bundled(node-err-code) = 2.0.3 Provides: bundled(node-exponential-backoff) = 3.1.1 Provides: bundled(node-fastest-levenshtein) = 1.0.16 -Provides: bundled(node-foreground-child) = 3.1.1 +Provides: bundled(node-foreground-child) = 3.2.1 Provides: bundled(node-fs-minipass) = 2.1.0 Provides: bundled(node-fs-minipass) = 3.0.3 -Provides: bundled(node-function-bind) = 1.1.2 -Provides: bundled(node-glob) = 10.3.12 +Provides: bundled(node-glob) = 10.4.2 Provides: bundled(node-graceful-fs) = 4.2.11 -Provides: bundled(node-hasown) = 2.0.2 -Provides: bundled(node-hosted-git-info) = 7.0.1 +Provides: bundled(node-hosted-git-info) = 7.0.2 Provides: bundled(node-http-cache-semantics) = 4.1.1 Provides: bundled(node-http-proxy-agent) = 7.0.2 -Provides: bundled(node-https-proxy-agent) = 7.0.4 +Provides: bundled(node-https-proxy-agent) = 7.0.5 Provides: bundled(node-iconv-lite) = 0.6.3 -Provides: bundled(node-ignore-walk) = 6.0.4 +Provides: bundled(node-ignore-walk) = 6.0.5 Provides: bundled(node-imurmurhash) = 0.1.4 Provides: bundled(node-indent-string) = 4.0.0 -Provides: bundled(node-ini) = 4.1.2 -Provides: bundled(node-init-package-json) = 6.0.2 +Provides: bundled(node-ini) = 4.1.3 +Provides: bundled(node-init-package-json) = 6.0.3 Provides: bundled(node-ip-address) = 9.0.5 Provides: bundled(node-ip-regex) = 5.0.0 -Provides: bundled(node-is-cidr) = 5.0.5 -Provides: bundled(node-is-core-module) = 2.13.1 +Provides: bundled(node-is-cidr) = 5.1.0 Provides: bundled(node-is-fullwidth-code-point) = 3.0.0 Provides: bundled(node-is-lambda) = 1.0.1 Provides: bundled(node-isexe) = 2.0.0 Provides: bundled(node-isexe) = 3.1.1 -Provides: bundled(node-jackspeak) = 2.3.6 +Provides: bundled(node-jackspeak) = 3.4.0 Provides: bundled(node-jsbn) = 1.1.0 -Provides: bundled(node-json-parse-even-better-errors) = 3.0.1 +Provides: bundled(node-json-parse-even-better-errors) = 3.0.2 Provides: bundled(node-json-stringify-nice) = 1.1.4 Provides: bundled(node-jsonparse) = 1.3.1 Provides: bundled(node-just-diff) = 6.0.2 Provides: bundled(node-just-diff-apply) = 5.5.0 -Provides: bundled(node-libnpmaccess) = 8.0.5 -Provides: bundled(node-libnpmdiff) = 6.1.1 -Provides: bundled(node-libnpmexec) = 8.1.0 -Provides: bundled(node-libnpmfund) = 5.0.9 -Provides: bundled(node-libnpmhook) = 10.0.4 -Provides: bundled(node-libnpmorg) = 6.0.5 -Provides: bundled(node-libnpmpack) = 7.0.1 -Provides: bundled(node-libnpmpublish) = 9.0.7 -Provides: bundled(node-libnpmsearch) = 7.0.4 -Provides: bundled(node-libnpmteam) = 6.0.4 -Provides: bundled(node-libnpmversion) = 6.0.1 +Provides: bundled(node-libnpmaccess) = 8.0.6 +Provides: bundled(node-libnpmdiff) = 6.1.4 +Provides: bundled(node-libnpmexec) = 8.1.3 +Provides: bundled(node-libnpmfund) = 5.0.12 +Provides: bundled(node-libnpmhook) = 10.0.5 +Provides: bundled(node-libnpmorg) = 6.0.6 +Provides: bundled(node-libnpmpack) = 7.0.4 +Provides: bundled(node-libnpmpublish) = 9.0.9 +Provides: bundled(node-libnpmsearch) = 7.0.6 +Provides: bundled(node-libnpmteam) = 6.0.5 +Provides: bundled(node-libnpmversion) = 6.0.3 Provides: bundled(node-lru-cache) = 10.2.2 -Provides: bundled(node-lru-cache) = 6.0.0 Provides: bundled(node-make-fetch-happen) = 13.0.1 -Provides: bundled(node-minimatch) = 9.0.4 +Provides: bundled(node-minimatch) = 9.0.5 Provides: bundled(node-minipass) = 3.3.6 Provides: bundled(node-minipass) = 5.0.0 -Provides: bundled(node-minipass) = 7.0.4 +Provides: bundled(node-minipass) = 7.1.2 Provides: bundled(node-minipass-collect) = 2.0.1 -Provides: bundled(node-minipass-fetch) = 3.0.4 +Provides: bundled(node-minipass-fetch) = 3.0.5 Provides: bundled(node-minipass-flush) = 1.0.5 -Provides: bundled(node-minipass-json-stream) = 1.0.1 Provides: bundled(node-minipass-pipeline) = 1.2.4 Provides: bundled(node-minipass-sized) = 1.0.3 Provides: bundled(node-minizlib) = 2.1.2 @@ -529,24 +536,25 @@ Provides: bundled(node-ms) = 2.1.3 Provides: bundled(node-mute-stream) = 1.0.0 Provides: bundled(node-negotiator) = 0.6.3 Provides: bundled(node-node-gyp) = 10.1.0 -Provides: bundled(node-nopt) = 7.2.0 -Provides: bundled(node-normalize-package-data) = 6.0.0 +Provides: bundled(node-nopt) = 7.2.1 +Provides: bundled(node-normalize-package-data) = 6.0.2 Provides: bundled(node-npm-audit-report) = 5.0.0 -Provides: bundled(node-npm-bundled) = 3.0.0 +Provides: bundled(node-npm-bundled) = 3.0.1 Provides: bundled(node-npm-install-checks) = 6.3.0 Provides: bundled(node-npm-normalize-package-bin) = 3.0.1 Provides: bundled(node-npm-package-arg) = 11.0.2 Provides: bundled(node-npm-packlist) = 8.0.2 -Provides: bundled(node-npm-pick-manifest) = 9.0.0 -Provides: bundled(node-npm-profile) = 9.0.2 -Provides: bundled(node-npm-registry-fetch) = 17.0.0 -Provides: bundled(node-npm-user-validate) = 2.0.0 +Provides: bundled(node-npm-pick-manifest) = 9.1.0 +Provides: bundled(node-npm-profile) = 10.0.0 +Provides: bundled(node-npm-registry-fetch) = 17.1.0 +Provides: bundled(node-npm-user-validate) = 2.0.1 Provides: bundled(node-p-map) = 4.0.0 -Provides: bundled(node-pacote) = 18.0.3 +Provides: bundled(node-package-json-from-dist) = 1.0.0 +Provides: bundled(node-pacote) = 18.0.6 Provides: bundled(node-parse-conflict-json) = 3.0.1 Provides: bundled(node-path-key) = 3.1.1 -Provides: bundled(node-path-scurry) = 1.10.2 -Provides: bundled(node-postcss-selector-parser) = 6.0.16 +Provides: bundled(node-path-scurry) = 1.11.1 +Provides: bundled(node-postcss-selector-parser) = 6.1.0 Provides: bundled(node-proc-log) = 3.0.0 Provides: bundled(node-proc-log) = 4.2.0 Provides: bundled(node-proggy) = 2.0.0 @@ -554,28 +562,28 @@ Provides: bundled(node-promise-all-reject-late) = 1.0.1 Provides: bundled(node-promise-call-limit) = 3.0.1 Provides: bundled(node-promise-inflight) = 1.0.1 Provides: bundled(node-promise-retry) = 2.0.1 -Provides: bundled(node-promzard) = 1.0.1 +Provides: bundled(node-promzard) = 1.0.2 Provides: bundled(node-qrcode-terminal) = 0.12.0 Provides: bundled(node-read) = 3.0.1 Provides: bundled(node-read-cmd-shim) = 4.0.0 Provides: bundled(node-read-package-json-fast) = 3.0.2 Provides: bundled(node-retry) = 0.12.0 Provides: bundled(node-safer-buffer) = 2.1.2 -Provides: bundled(node-semver) = 7.6.0 +Provides: bundled(node-semver) = 7.6.2 Provides: bundled(node-shebang-command) = 2.0.0 Provides: bundled(node-shebang-regex) = 3.0.0 Provides: bundled(node-signal-exit) = 4.1.0 -Provides: bundled(node-sigstore) = 2.3.0 +Provides: bundled(node-sigstore) = 2.3.1 Provides: bundled(node-smart-buffer) = 4.2.0 Provides: bundled(node-socks) = 2.8.3 -Provides: bundled(node-socks-proxy-agent) = 8.0.3 +Provides: bundled(node-socks-proxy-agent) = 8.0.4 Provides: bundled(node-spdx-correct) = 3.2.0 Provides: bundled(node-spdx-exceptions) = 2.5.0 Provides: bundled(node-spdx-expression-parse) = 3.0.1 Provides: bundled(node-spdx-expression-parse) = 4.0.0 -Provides: bundled(node-spdx-license-ids) = 3.0.17 +Provides: bundled(node-spdx-license-ids) = 3.0.18 Provides: bundled(node-sprintf-js) = 1.1.3 -Provides: bundled(node-ssri) = 10.0.5 +Provides: bundled(node-ssri) = 10.0.6 Provides: bundled(node-string-width) = 4.2.3 Provides: bundled(node-string-width) = 5.1.2 Provides: bundled(node-strip-ansi) = 6.0.1 @@ -585,12 +593,12 @@ Provides: bundled(node-tar) = 6.2.1 Provides: bundled(node-text-table) = 0.2.0 Provides: bundled(node-tiny-relative-date) = 1.3.0 Provides: bundled(node-treeverse) = 3.0.0 -Provides: bundled(node-tuf-js) = 2.2.0 +Provides: bundled(node-tuf-js) = 2.2.1 Provides: bundled(node-unique-filename) = 3.0.0 Provides: bundled(node-unique-slug) = 4.0.0 Provides: bundled(node-util-deprecate) = 1.0.2 Provides: bundled(node-validate-npm-package-license) = 3.0.4 -Provides: bundled(node-validate-npm-package-name) = 5.0.0 +Provides: bundled(node-validate-npm-package-name) = 5.0.1 Provides: bundled(node-walk-up-path) = 3.0.1 Provides: bundled(node-which) = 2.0.2 Provides: bundled(node-which) = 4.0.0 @@ -673,6 +681,7 @@ popd %if 0%{with valgrind_tests} %endif %patch -P 13 -p1 +%patch -P 82 -p1 %patch -P 100 -p1 %patch -P 101 -p1 %if 0%{?suse_version} >= 1500 || 0%{?suse_version} == 0 @@ -789,6 +798,9 @@ EOF %if %{node_version_number} < 19 --without-dtrace \ %endif +%if %{node_version_number} >= 22 && 0%{?suse_version} > 1500 + --shared-sqlite \ +%endif %if %{node_version_number} >= 16 && (0%{?suse_version} > 1550 || 0%{?sle_version} >= 150400) --openssl-default-cipher-list=PROFILE=SYSTEM \ %endif @@ -929,6 +941,7 @@ rm test/parallel/test-strace-openat-openssl.js %if 0%{?forced_python_version:1} sed -i -e "s,'python3','python%{forced_python_version}'," test/parallel/test-child-process-set-blocking.js test -e tools/pseudo-tty.py && sed -i -e "s,^#!/usr/bin/env python3$,#!/usr/bin/python%{forced_python_version}," tools/pseudo-tty.py ||: +export PYTHON="/usr/bin/python%{forced_python_version}" %endif ln addon-rpm.gypi deps/npm/node_modules/node-gyp/addon-rpm.gypi @@ -943,6 +956,8 @@ rm test/parallel/test-dns-cancel-reverse-lookup.js \ test/parallel/test-dns-resolveany.js # multicast test fail since no socket? rm test/parallel/test-dgram-membership.js +# ::1 not defined in OBS on TW - https://github.com/openSUSE/obs-build/issues/848 +rm test/report/test-report-exclude-network.js %if %{node_version_number} >= 18 # OBS broken /etc/hosts -- https://github.com/openSUSE/open-build-service/issues/13104