Accepting request 1295284 from devel:languages:python:jupyter

- Refresh javascript dependencies to update form-data
  (CVE-2025-7783, bsc#1246814)

OBS-URL: https://build.opensuse.org/request/show/1295284
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-jupyterlab-templates?expand=0&rev=15

_service

@@ -0,0 +1,7 @@
+<services>
+  <service name="node_modules" mode="manual">
+    <param name="cpio">node_modules.obscpio</param>
+    <param name="output">node_modules.spec.inc</param>
+    <param name="source-offset">10000</param>
+  </service>
+</services>

node_modules.obscpio

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:30ad93febad2416e55190513fc2f355698938df033ee4ca0fa1bc43260f202a3
+size 41665156

python-jupyterlab-templates.changes

@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Wed Jul 23 08:58:34 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Refresh javascript dependencies to update form-data
+  (CVE-2025-7783, bsc#1246814)
+
+-------------------------------------------------------------------
+Thu Jun 19 08:40:43 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Build javascript from sources with local-npm-registry
+  (CVE-2025-5889, bsc#1244347)
+
 -------------------------------------------------------------------
 Thu May  9 06:22:23 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>
 

python-jupyterlab-templates.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-jupyterlab-templates
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -26,6 +26,12 @@ Summary:        Templates for notebooks in JupyterLab
 License:        Apache-2.0
 URL:            https://github.com/finos/jupyterlab_templates
 Source:         https://files.pythonhosted.org/packages/source/j/jupyterlab_templates/jupyterlab_templates-%{version}.tar.gz
+# package-lock.json file generated with command:
+# npm install --package-lock-only --legacy-peer-deps --ignore-scripts
+Source1:        package-lock.json
+# node_modules generated using "osc service mr" with the https://github.com/openSUSE/obs-service-node_modules
+Source2:        node_modules.spec.inc
+%include        %{_sourcedir}/node_modules.spec.inc
 BuildRequires:  %{python_module base >= 3.7}
 BuildRequires:  %{python_module hatch-jupyter-builder}
 BuildRequires:  %{python_module hatchling}
@@ -36,6 +42,7 @@ BuildRequires:  %{python_module pytest}
 BuildRequires:  fdupes
 BuildRequires:  jupyter-jupyterlab-filesystem
 BuildRequires:  jupyter-notebook-filesystem
+BuildRequires:  local-npm-registry
 BuildRequires:  python-rpm-macros
 Requires:       jupyter-jupyterlab-templates = %{version}
 Requires:       python-jupyterlab >= 4.0
@@ -63,8 +70,17 @@ Support for jupyter notebook templates in jupyterlab.
 
 %prep
 %autosetup -p1 -n jupyterlab_templates-%{version}
+rm js/yarn.lock
+rm jupyterlab_templates/labextension/static/*.js
+
+pushd js
+local-npm-registry %{_sourcedir} install --include=dev --include=peer
+popd
 
 %build
+pushd js
+npm run build
+popd
 %pyproject_wheel
 
 %install