From 03d5163236f1e7e8f00077bef4c068f5b33e5e08 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 19:38:01 +0000 Subject: [PATCH 1/9] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 9839f82f9246627f2d83d6adb21390191736b14e Mon Sep 17 00:00:00 2001 From: Andrei Radchenko Date: Mon, 16 Dec 2024 14:32:31 +0100 Subject: [PATCH 2/9] Update to version 3.1.9 (rhbz#2313708) --- nodejs-nodemon.spec | 2 +- sources | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 2da9846..56cb406 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -5,7 +5,7 @@ %global enable_tests 0 Name: nodejs-%{npm_name} -Version: 3.1.4 +Version: 3.1.9 Release: %autorelease Summary: Simple monitor script for use during development of a node.js app License: ISC AND MIT diff --git a/sources b/sources index 8d6bece..e94869b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nodemon-v3.1.4-bundled.tar.gz) = 81b2f6bb1383eaeb8d3dbfa74f31bfa2d3d6ea31107b8561282c3858e427b8512eb59431686d6ee6d8b28d905179e0a7004bb5303ec5b9c706bcda97dc220420 +SHA512 (nodemon-v3.1.9-bundled.tar.gz) = b701d8a9e0dc2fb6b947a2f99734b47f0e9dcc98069709508e6d2cf94d5a78c7f7b58de43f05ac9cd9f1273ef0c92c100edc655376039e95389fa450b3c8743c From 2452b766874cce759b7c27f0d2d51bb0af96ae7b Mon Sep 17 00:00:00 2001 From: Honza Horak Date: Fri, 3 Jan 2025 16:46:53 +0100 Subject: [PATCH 3/9] Upload the new tar --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index e94869b..5021745 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nodemon-v3.1.9-bundled.tar.gz) = b701d8a9e0dc2fb6b947a2f99734b47f0e9dcc98069709508e6d2cf94d5a78c7f7b58de43f05ac9cd9f1273ef0c92c100edc655376039e95389fa450b3c8743c +SHA512 (nodemon-v3.1.9-bundled.tar.gz) = ca23d8bb2cacc4c9dfafd904a3ebf4725ee5a69af4e585510196f0c95361fe4da0cc9006d7c6016bb0147c0c83c858d50019766df9a77d0ec15fb8983dd319a8 From df23a3e870777a4889a4afdb3053c15cf1ba233a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 20:15:23 +0000 Subject: [PATCH 4/9] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From fadc73790478a64928730fa9d1a6bd4b62c85b5a Mon Sep 17 00:00:00 2001 From: Tomas Juhasz Date: Fri, 10 Jan 2025 13:30:29 +0100 Subject: [PATCH 5/9] Added patch for CVE-2024-4068 --- 0001-CVE-2024-4068-fix.patch | 38 ++++++++++++++++++++++++++++++++++++ nodejs-nodemon.spec | 6 +++++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 0001-CVE-2024-4068-fix.patch diff --git a/0001-CVE-2024-4068-fix.patch b/0001-CVE-2024-4068-fix.patch new file mode 100644 index 0000000..db163f6 --- /dev/null +++ b/0001-CVE-2024-4068-fix.patch @@ -0,0 +1,38 @@ +From 1dfe8b9208dade21baad8344d6e9847eecb5837d Mon Sep 17 00:00:00 2001 +From: Aaron Moat <2937187+AaronMoat@users.noreply.github.com> +Date: Tue, 21 May 2024 17:32:41 +1000 +Subject: [PATCH] Lower defaultLength to 10000 + +--- + README.md | 2 +- + lib/constants.js | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + + **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera. + +diff --git a/README.md b/README.md +index 6b94046..f59dd60 100644 +--- node_modules/braces/README.md ++++ node_modules/braces/README.md +@@ -178,7 +178,7 @@ console.log(braces.expand('a{b}c')); + + **Type**: `Number` + +-**Default**: `65,536` ++**Default**: `10,000` + + **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera. + +diff --git a/lib/constants.js b/lib/constants.js +index a937943..2bb3b88 100644 +--- node_modules/braces/lib/constants.js ++++ node_modules/braces/lib/constants.js +@@ -1,7 +1,7 @@ + 'use strict'; + + module.exports = { +- MAX_LENGTH: 1024 * 64, ++ MAX_LENGTH: 10000, + + // Digits + CHAR_0: '0', /* 0 */ diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 56cb406..8cf78af 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -12,6 +12,10 @@ License: ISC AND MIT URL: https://github.com/remy/nodemon Source0: %{npm_name}-v%{version}-bundled.tar.gz +# Patch in the fix for unlimited resource allocation of dependency +# Source: https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff +Patch: 0001-CVE-2024-4068-fix.patch + BuildRequires: nodejs-devel BuildRequires: nodejs-packaging BuildRequires: npm @@ -41,7 +45,7 @@ on the command line when you run your script. %prep %setup -q -n %{npm_name}-%{version} - +%patch -P 0 %build # nothing to do From 1a3f970c01363ed652478035a7547723aa21696c Mon Sep 17 00:00:00 2001 From: tjuhasz Date: Wed, 23 Apr 2025 15:49:50 +0200 Subject: [PATCH 6/9] update to version 3.1.10 (rhbz#2361851) --- nodejs-nodemon.spec | 2 +- sources | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 8cf78af..8337b5a 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -5,7 +5,7 @@ %global enable_tests 0 Name: nodejs-%{npm_name} -Version: 3.1.9 +Version: 3.1.10 Release: %autorelease Summary: Simple monitor script for use during development of a node.js app License: ISC AND MIT diff --git a/sources b/sources index 5021745..ad676a3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nodemon-v3.1.9-bundled.tar.gz) = ca23d8bb2cacc4c9dfafd904a3ebf4725ee5a69af4e585510196f0c95361fe4da0cc9006d7c6016bb0147c0c83c858d50019766df9a77d0ec15fb8983dd319a8 +SHA512 (nodemon-v3.1.10-bundled.tar.gz) = 142996f7b4a91bacf1d4f18e5e5ba13483c3f50477288cade79a3f08cd43f5c1e01a149eef66889be1a3382455d6b6ffea2f5d088109dac4ce0d9cb59b72e14e From d32d9b30c0eaaffd5be74e3d4cf81bd70f758d0d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 22:53:51 +0000 Subject: [PATCH 7/9] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From d59865a6e166c97f037be2fcd6e7f7a74c36fa5e Mon Sep 17 00:00:00 2001 From: tjuhasz Date: Wed, 12 Nov 2025 11:55:13 +0100 Subject: [PATCH 8/9] Rebuild for nodejs-packaging Recently, Node.js changed the way node modules are installed to allow for better parallel functionality and easier unbundling of certain parts of Node.js. Previously, Node.js was using a symlink, %{_libdir}/node_modules, which pointed to a versioned path, e.g., %{_libdir}/node_modules_22. This has changed to using a global %{_libdir}/node_modules static shared folder for generic modules and %{_libdir}/node_modules_XX for version-specific modules. This change is better described in the Fedora change proposal wiki: https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath. This also needed to be reflected in nodejs-packaging macros, which forces a rebuild of dependent packages. From 8dca4f8f2ca34c099bf3452429256aaa25c0c5bd Mon Sep 17 00:00:00 2001 From: tjuhasz Date: Wed, 12 Nov 2025 12:50:55 +0100 Subject: [PATCH 9/9] Update to version 3.1.11 (rhbz#2414185) --- nodejs-nodemon.spec | 2 +- sources | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 8337b5a..d3d2bc6 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -5,7 +5,7 @@ %global enable_tests 0 Name: nodejs-%{npm_name} -Version: 3.1.10 +Version: 3.1.11 Release: %autorelease Summary: Simple monitor script for use during development of a node.js app License: ISC AND MIT diff --git a/sources b/sources index ad676a3..7a6baf9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nodemon-v3.1.10-bundled.tar.gz) = 142996f7b4a91bacf1d4f18e5e5ba13483c3f50477288cade79a3f08cd43f5c1e01a149eef66889be1a3382455d6b6ffea2f5d088109dac4ce0d9cb59b72e14e +SHA512 (nodemon-v3.1.11-bundled.tar.gz) = 77a02847c266654c3cb4f49acc74235aa277c7dc786770097790e2f2c5addc4a4db79c23dbcbf9e5938f01b26ad79cb8cf001e76bf51fa28fc927125e8a3e9a8