From 5c5f857076d168bd1bc358a5529c9d83ca5173ca Mon Sep 17 00:00:00 2001 From: Tomas Juhasz Date: Fri, 10 Jan 2025 13:30:29 +0100 Subject: [PATCH 1/4] Added patch for CVE-2024-4068 --- 0001-CVE-2024-4068-fix.patch | 38 ++++++++++++++++++++++++++++++++++++ nodejs-nodemon.spec | 6 +++++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 0001-CVE-2024-4068-fix.patch diff --git a/0001-CVE-2024-4068-fix.patch b/0001-CVE-2024-4068-fix.patch new file mode 100644 index 0000000..db163f6 --- /dev/null +++ b/0001-CVE-2024-4068-fix.patch @@ -0,0 +1,38 @@ +From 1dfe8b9208dade21baad8344d6e9847eecb5837d Mon Sep 17 00:00:00 2001 +From: Aaron Moat <2937187+AaronMoat@users.noreply.github.com> +Date: Tue, 21 May 2024 17:32:41 +1000 +Subject: [PATCH] Lower defaultLength to 10000 + +--- + README.md | 2 +- + lib/constants.js | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + + **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera. + +diff --git a/README.md b/README.md +index 6b94046..f59dd60 100644 +--- node_modules/braces/README.md ++++ node_modules/braces/README.md +@@ -178,7 +178,7 @@ console.log(braces.expand('a{b}c')); + + **Type**: `Number` + +-**Default**: `65,536` ++**Default**: `10,000` + + **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera. + +diff --git a/lib/constants.js b/lib/constants.js +index a937943..2bb3b88 100644 +--- node_modules/braces/lib/constants.js ++++ node_modules/braces/lib/constants.js +@@ -1,7 +1,7 @@ + 'use strict'; + + module.exports = { +- MAX_LENGTH: 1024 * 64, ++ MAX_LENGTH: 10000, + + // Digits + CHAR_0: '0', /* 0 */ diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 56cb406..8cf78af 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -12,6 +12,10 @@ License: ISC AND MIT URL: https://github.com/remy/nodemon Source0: %{npm_name}-v%{version}-bundled.tar.gz +# Patch in the fix for unlimited resource allocation of dependency +# Source: https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff +Patch: 0001-CVE-2024-4068-fix.patch + BuildRequires: nodejs-devel BuildRequires: nodejs-packaging BuildRequires: npm @@ -41,7 +45,7 @@ on the command line when you run your script. %prep %setup -q -n %{npm_name}-%{version} - +%patch -P 0 %build # nothing to do From d32d9b30c0eaaffd5be74e3d4cf81bd70f758d0d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 22:53:51 +0000 Subject: [PATCH 2/4] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From d59865a6e166c97f037be2fcd6e7f7a74c36fa5e Mon Sep 17 00:00:00 2001 From: tjuhasz Date: Wed, 12 Nov 2025 11:55:13 +0100 Subject: [PATCH 3/4] Rebuild for nodejs-packaging Recently, Node.js changed the way node modules are installed to allow for better parallel functionality and easier unbundling of certain parts of Node.js. Previously, Node.js was using a symlink, %{_libdir}/node_modules, which pointed to a versioned path, e.g., %{_libdir}/node_modules_22. This has changed to using a global %{_libdir}/node_modules static shared folder for generic modules and %{_libdir}/node_modules_XX for version-specific modules. This change is better described in the Fedora change proposal wiki: https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath. This also needed to be reflected in nodejs-packaging macros, which forces a rebuild of dependent packages. From 8dca4f8f2ca34c099bf3452429256aaa25c0c5bd Mon Sep 17 00:00:00 2001 From: tjuhasz Date: Wed, 12 Nov 2025 12:50:55 +0100 Subject: [PATCH 4/4] Update to version 3.1.11 (rhbz#2414185) --- nodejs-nodemon.spec | 2 +- sources | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 8337b5a..d3d2bc6 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -5,7 +5,7 @@ %global enable_tests 0 Name: nodejs-%{npm_name} -Version: 3.1.10 +Version: 3.1.11 Release: %autorelease Summary: Simple monitor script for use during development of a node.js app License: ISC AND MIT diff --git a/sources b/sources index ad676a3..7a6baf9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nodemon-v3.1.10-bundled.tar.gz) = 142996f7b4a91bacf1d4f18e5e5ba13483c3f50477288cade79a3f08cd43f5c1e01a149eef66889be1a3382455d6b6ffea2f5d088109dac4ce0d9cb59b72e14e +SHA512 (nodemon-v3.1.11-bundled.tar.gz) = 77a02847c266654c3cb4f49acc74235aa277c7dc786770097790e2f2c5addc4a4db79c23dbcbf9e5938f01b26ad79cb8cf001e76bf51fa28fc927125e8a3e9a8