Update to version 20250913+git83.bc629c8

(upstream git snapshot + cherry-picked fixes)

_service

@@ -0,0 +1,14 @@
+<services>
+  <service name="tar_scm" mode="manual">
+    <param name="scm">git</param>
+    <param name="url">https://github.com/hramrach/quickjs.git</param>
+    <param name="revision">master</param>
+    <param name="versionformat">@PARENT_TAG@+git@TAG_OFFSET@.%h</param>
+    <param name="changesgenerate">enable</param>
+  </service>
+  <service name="recompress" mode="manual">
+    <param name="file">*.tar</param>
+    <param name="compression">xz</param>
+  </service>
+  <service name="set_version" mode="manual" />
+</services>

_servicedata

@@ -0,0 +1,4 @@
+<servicedata>
+<service name="tar_scm">
+                <param name="url">https://github.com/hramrach/quickjs.git</param>
+              <param name="changesrevision">bc629c8b659edd31eb532ae7ccc5f7816098d5d6</param></service></servicedata>

quickjs-2024-01-13.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:3c4bf8f895bfa54beb486c8d1218112771ecfc5ac3be1036851ef41568212e03
-size 765800

quickjs-rpmlintrc

@@ -1,4 +0,0 @@
-#
-# static binary that qjsc currently depends on
-addFilter("devel-file-in-non-devel-package .*/usr/lib/quickjs/libquickjs.a")
-

quickjs.changes

@@ -1,3 +1,105 @@
+-------------------------------------------------------------------
+Mon Feb 16 11:44:51 UTC 2026 - msuchanek@suse.de
+
+- Update to version 20250913+git83.bc629c8 (upstream git snapshot + cherry-picked fixes):
+  * Fix heap buffer overflow via side-effects in js_typed_array_constructor
+  * Fix heap buffer overflow in js_typed_array_constructor_ta (bsc#1256914 CVE-2026-1145)
+  * Add tests for OOB access in atomic ops
+  * Fix use-after-free in Atomics operations with resizable ArrayBuffers (bsc#1256911 CVE-2026-1144)
+  * \x{N} is a syntax error
+  * slightly faster lexical variable assignment
+  * Don't call well-known Symbol methods for RegExp on primitive values
+  * removed use after free in js_create_module_bytecode_function() (#467)
+  * removed memory leak in case of error in cpool_add() (#468)
+  * fixed fast array extension optimization when there are multiple realms
+  * added regexp duplicate named groups - fixed reset of captures with quantizers
+  * updated to unicode 17.0.0 - updated test262 version
+  * fixed Worker freeing logic (#462)
+  * - optimized Regexp.prototype.exec - optimized String.prototype.replace - optimized 'arguments' object creation - optimized access to non strict 'arguments' elements
+  * faster and simpler implementation of regexp backtracking
+  * fixed BJSON array serialization (#457)
+  * Added Iterator.concat (initial patch by bnoordhuis)
+  * optimized add/sub int32 overflow
+  * added error checking in JS_InstantiateFunctionListItem()
+  * Closure optimization
+  * Restore a mistakenly removed goto on error in js_build_module_ns() (igorburago)
+  * fixed JS_PROP_AUTOINIT handling in js_closure_define_global_var() (#455)
+  * fixed exception handling in put_var operation (regression introduced by commit a6816be) (#454)
+  * More informative "not a constructor" error message (initial patch by bnoordhuis) (#368)
+  * Fix length check in ArrayBuffer.prototype.slice (bnoordhuis) (#451)
+  * fixed DataView resizing
+  * qjs: added --strict option
+  * Much faster destructuring at the expense of a slight incompatibility with the spec when direct evals are present (v8 behaves the same way).
+  * fixed operation order in Regexp constructor
+  * changed module rejection order according to spec change
+  * optimized Array.prototype.push
+  * added js_string_eq()
+  * fixed argument evaluation order in Date constructor and Date.UTC()
+  * faster and safer dbuf functions (#443)
+  * Faster context creation and exception checks in JS_NewContext (#404)
+  * faster appending of elements in arrays
+  * optimized string_buffer_putc()
+  * optimized post_inc and post_dec
+  * optimized array access
+  * optimized global variable access
+  * optimize the create of arrays
+  * Improve error handling in Promise.withResolvers (bnoordhuis)
+  * fixed Date parsing: "1997-03-08 11:19:10-0700" is a valid date and "1997-03-08T11:19:10-07" should yield an error
+  * added Math.sumPrecise()
+  * added Map and WeakMap upsert methods (bnoordhuis)
+  * - added Atomics.pause (bnoordhuis)
+  * - added resizable array buffers (bnoordhuis)
+  * fixed parsing of computed property name
+  * - added ArrayBuffer.prototype.transfer (Divy Srivastava)
+  * added the Iterator object
+  * added set methods (bnoordhuis)
+  * removed memory leak (#441)
+
+-------------------------------------------------------------------
+Fri Feb  6 01:23:13 UTC 2026 - Avindra Goolcharan <avindra@opensuse.org>
+
+- ship libquickjs in devel, qjsc works now
+
+-------------------------------------------------------------------
+Tue Nov 18 01:35:26 UTC 2025 - Avindra Goolcharan <avindra@opensuse.org>
+
+- update to 2025-09-13:
+  * added JSON modules and import attributes
+  * added JS_PrintValue() API
+  * qjs: pretty print objects in print() and console.log()
+  * qjs: better promise rejection tracker heuristics
+  * added RegExp v flag
+  * added RegExp modifiers
+  * added RegExp.escape
+  * added Float16Array
+  * added Promise.try
+  * improved JSON parser spec conformance
+  * qjs: improved compatibility of std.parseExtJSON() with JSON5 and
+    accept JSON5 modules
+  * added JS_FreePropertyEnum() and JS_AtomToCStringLen() API
+  * added Error.isError()
+  * misc bug fixes
+
+-------------------------------------------------------------------
+Wed Jun 18 00:26:00 UTC 2025 - Avindra Goolcharan <avindra@opensuse.org>
+
+- update to 2025-04-26:
+  * removed the bignum extensions and qjscalc to simplify the code.
+    The BFCalc calculator (web version) can be used as a
+    replacement for qjscalc.
+  * new BigInt implementation optimized for small numbers
+  * added WeakRef, FinalizationRegistry and symbols as weakrefs
+  * added builtin float64 printing and parsing functions for more correctness
+  * faster repeated string concatenation
+  * qjs: promise unhandled rejections are fatal errors by default
+  * added column number in debug information
+  * removed the "use strip" extension
+  * qjs: added -s and --strip-source options
+  * qjsc: added -s and --keep-source options
+  * added JS_GetAnyOpaque()
+  * added more callbacks for exotic objects in JSClassExoticMethods
+  * misc bug fixes
+
 -------------------------------------------------------------------
 Fri Feb  9 23:22:54 UTC 2024 - Avindra Goolcharan <avindra@opensuse.org>
 

quickjs.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package quickjs
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,28 +16,27 @@
 #
 
 
-%define ver 2024-01-13
+%if 0%{?suse_version} && 0%{?suse_version} < 1500
+%define compiler CC=gcc-7
+# /usr/include/c++/12/stdatomic.h
+BuildRequires:  gcc7-c++
+%else
+BuildRequires:  gcc-c++
+%endif
 Name:           quickjs
-Version:        20240113
+Version:        20250913+git83.bc629c8
 Release:        0
 Summary:        Small and embeddable Javascript engine
 License:        MIT
 URL:            https://bellard.org/quickjs/
-Source0:        https://bellard.org/quickjs/%{name}-%{ver}.tar.xz
-Source10:       quickjs-rpmlintrc
-%if 0%{?suse_version} && 0%{?suse_version} < 1500
-# /usr/include/c++/12/stdatomic.h
-BuildRequires:  gcc7-c++
-%define compiler CC=gcc-7
-%else
-BuildRequires:  gcc-c++
-%endif
+Source0:        %{name}-%{version}.tar.xz
 BuildRequires:  make
 
 %description
 QuickJS is a small and embeddable JavaScript engine and compiler that supports reference ES2020.
 
 %package docs
+BuildArch:      noarch
 Summary:        Documentation for quickjs
 
 %description docs
@@ -50,10 +49,10 @@ Summary:        Development headers for quickjs
 Development headers for quickjs
 
 %prep
-%setup -q -n %{name}-%{ver}
+%setup -q -n %{name}-%{version}
 # inject optflags (cannot be passed normally to build)
 cat >> "./Makefile" <<-EOF
-CFLAGS += %{optflags}
+CFLAGS += %{optflags} -ffat-lto-objects
 LDFLAGS += %{optflags}
 EOF
 
@@ -66,15 +65,14 @@ EOF
 rm -f %{buildroot}%{_prefix}/lib/quickjs/libquickjs.lto.a
 
 %files
+%license LICENSE
 %{_bindir}/qjs
 %{_bindir}/qjsc
-%{_bindir}/qjscalc
 %dir %{_prefix}/lib/%{name}
-# qjsc relies on it
-%{_prefix}/lib/%{name}/lib%{name}.a
 
 %files devel
 %{_includedir}/%{name}
+%{_prefix}/lib/quickjs/libquickjs.a
 
 %files docs
 %doc doc