Fix CVE-2022-0613

resolves: #2055544

nodejs-bash-language-server.spec

@@ -4,13 +4,14 @@
 
 Name:           nodejs-bash-language-server
 Version:        2.0.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A language server for Bash
 License:        MIT
 Url:            https://github.com/bash-lsp/bash-language-server
 Source0:        %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz
 # Create with `bash prepare_vendor.sh`
 Source1:        %{pkg_name}-%{version}-vendor.tar.xz
+Patch0:         bashls-fix-CVE-2022-0613.patch
 BuildRequires:  fdupes
 BuildRequires:  nodejs-typescript
 BuildRequires:  nodejs-packaging
@@ -30,7 +31,7 @@ Bash with explainshell integration.
 
 %build
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
-yarn install --offline
+yarn install --offline --frozen-lockfile
 
 npm run compile
 
@@ -38,7 +39,7 @@ npm run compile
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
 
 # Only install production dependencies in node_modules
-yarn install --production --offline
+yarn install --production --offline --frozen-lockfile
 
 for S in $(grep -l '#!.*node' \
     server/bin/* \
@@ -82,6 +83,9 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete
 %{nodejs_sitelib}/%{pkg_name}/
 
 %changelog
+* Thu Feb 17 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-2
+- resolves: #2055544 - Fix CVE-2022-0613
+
 * Thu Aug 26 2021 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-1
 - Update to version 2.0.0
   * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md