Accepting request 1239494 from devel:languages:nodejs

- Update to 22.13.1:
  * src,loader,permission: throw on InternalWorker use when
    permission model is enabled (bsc#1236251, CVE-2025-23083)
  * src: fix HTTP2 mem leak on premature close and ERR_PROTO
    (bsc#1236250, CVE-2025-23085)
  * deps: Use of Insufficiently Random Values in undici fetch()
    (bsc#1236258, CVE-2025-22150)

OBS-URL: https://build.opensuse.org/request/show/1239494
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nodejs22?expand=0&rev=9

CVE-2024-21538.patch

@@ -1,46 +0,0 @@
-Applied following patches,
-
-From 5ff3a07d9add449021d806e45c4168203aa833ff Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Andr=C3=A9=20Cruz?= <andremiguelcruz@msn.com>
-Date: Wed, 6 Nov 2024 22:02:49 +0000
-Subject: [PATCH] fix: disable regexp backtracking (#160)
-
----
- lib/util/escape.js | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-
-From 640d391fde65388548601d95abedccc12943374f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Andr=C3=A9=20Cruz?= <andre.cruz@uphold.com>
-Date: Thu, 7 Nov 2024 12:50:38 +0000
-Subject: [PATCH] fix: fix escaping bug introduced by backtracking
-
----
- lib/util/escape.js | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-
-Index: node-v18.20.5/deps/npm/node_modules/cross-spawn/lib/util/escape.js
-===================================================================
---- node-v18.20.5.orig/deps/npm/node_modules/cross-spawn/lib/util/escape.js
-+++ node-v18.20.5/deps/npm/node_modules/cross-spawn/lib/util/escape.js
-@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscap
-     arg = `${arg}`;
- 
-     // Algorithm below is based on https://qntm.org/cmd
-+    // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input
-+    // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information
- 
-     // Sequence of backslashes followed by a double quote:
-     // double up all the backslashes and escape the double quote
--    arg = arg.replace(/(\\*)"/g, '$1$1\\"');
-+    arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
- 
-     // Sequence of backslashes followed by the end of the string
-     // (which will become a double quote later):
-     // double up all the backslashes
--    arg = arg.replace(/(\\*)$/, '$1$1');
-+    arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1');
- 
-     // All other backslashes occur literally
- 

icu76.1.patch

@@ -1,13 +0,0 @@
-Index: node-v22.11.0/configure.py
-===================================================================
---- node-v22.11.0.orig/configure.py
-+++ node-v22.11.0/configure.py
-@@ -1876,7 +1876,7 @@ def configure_intl(o):
-   elif with_intl == 'system-icu':
-     # ICU from pkg-config.
-     o['variables']['v8_enable_i18n_support'] = 1
--    pkgicu = pkg_config('icu-i18n')
-+    pkgicu = pkg_config('icu-i18n icu-uc')
-     if not pkgicu[0]:
-       error('''Could not load pkg-config data for "icu-i18n".
-        See above errors or the README.md.''')