diff --git a/.gitignore b/.gitignore index b960b92..6e08104 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -/nodemon-v2.0.3-bundled.tar.gz +/nodemon-v*-bundled.tar.gz diff --git a/0001-CVE-2024-4068-fix.patch b/0001-CVE-2024-4068-fix.patch new file mode 100644 index 0000000..db163f6 --- /dev/null +++ b/0001-CVE-2024-4068-fix.patch @@ -0,0 +1,38 @@ +From 1dfe8b9208dade21baad8344d6e9847eecb5837d Mon Sep 17 00:00:00 2001 +From: Aaron Moat <2937187+AaronMoat@users.noreply.github.com> +Date: Tue, 21 May 2024 17:32:41 +1000 +Subject: [PATCH] Lower defaultLength to 10000 + +--- + README.md | 2 +- + lib/constants.js | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + + **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera. + +diff --git a/README.md b/README.md +index 6b94046..f59dd60 100644 +--- node_modules/braces/README.md ++++ node_modules/braces/README.md +@@ -178,7 +178,7 @@ console.log(braces.expand('a{b}c')); + + **Type**: `Number` + +-**Default**: `65,536` ++**Default**: `10,000` + + **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera. + +diff --git a/lib/constants.js b/lib/constants.js +index a937943..2bb3b88 100644 +--- node_modules/braces/lib/constants.js ++++ node_modules/braces/lib/constants.js +@@ -1,7 +1,7 @@ + 'use strict'; + + module.exports = { +- MAX_LENGTH: 1024 * 64, ++ MAX_LENGTH: 10000, + + // Digits + CHAR_0: '0', /* 0 */ diff --git a/changelog b/changelog new file mode 100644 index 0000000..e5be8bf --- /dev/null +++ b/changelog @@ -0,0 +1,50 @@ +* Wed Aug 09 2023 Honza Horak - 2.0.3-9 +- Let nodemon work with any Node.js version + Resolves: #2230317 + +* Thu Jul 20 2023 Fedora Release Engineering - 2.0.3-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jan 19 2023 Fedora Release Engineering - 2.0.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Fri Jul 22 2022 Fedora Release Engineering - 2.0.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 2.0.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Jul 22 2021 Fedora Release Engineering - 2.0.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jan 26 2021 Fedora Release Engineering - 2.0.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 2.0.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri May 01 2020 Honza Horak - 2.0.3-1 +- Update to 2.0.3 + +* Mon Aug 13 2018 Zuzana Svetlikova - 1.18.3-1 +- Resolves: #1615413 +- Updated +- bundled + +* Mon Jul 03 2017 Zuzana Svetlikova - 1.11.0-2 +- rh-nodejs8 rebuild + +* Mon Oct 31 2016 Zuzana Svetlikova - 1.11.0-1 +- Updated with script + +* Sun Feb 14 2016 Zuzana Svetlikova - 1.8.1-6 +- rebuilt + +* Wed Jan 06 2016 Tomas Hrcka - 1.8.1-5 +- Enable scl macros + +* Thu Dec 17 2015 Troy Dawson - 1.8.1-2 +- Fix dependencies + +* Wed Dec 16 2015 Troy Dawson - 1.8.1-1 +- Initial package diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec index 30aaba8..d3d2bc6 100644 --- a/nodejs-nodemon.spec +++ b/nodejs-nodemon.spec @@ -5,17 +5,26 @@ %global enable_tests 0 Name: nodejs-%{npm_name} -Version: 2.0.3 -Release: 3%{?dist} +Version: 3.1.11 +Release: %autorelease Summary: Simple monitor script for use during development of a node.js app -License: MIT +License: ISC AND MIT URL: https://github.com/remy/nodemon Source0: %{npm_name}-v%{version}-bundled.tar.gz +# Patch in the fix for unlimited resource allocation of dependency +# Source: https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff +Patch: 0001-CVE-2024-4068-fix.patch + BuildRequires: nodejs-devel BuildRequires: nodejs-packaging BuildRequires: npm +# Let the nodemon work with any nodejs version available +%global __requires_exclude ^\/usr\/bin\/node +Requires: nodejs(engine) +Suggests: nodejs + ExclusiveArch: %{nodejs_arches} noarch BuildArch: noarch @@ -24,19 +33,19 @@ Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. -nodemon will watch the files in the directory in which nodemon -was started, and if any files change, nodemon will automatically +nodemon will watch the files in the directory in which nodemon +was started, and if any files change, nodemon will automatically restart your node application. -nodemon does not require any changes to your code or method of -development. nodemon simply wraps your node application and keeps -an eye on any files that have changed. Remember that nodemon is a -replacement wrapper for node, think of it as replacing the word "node" +nodemon does not require any changes to your code or method of +development. nodemon simply wraps your node application and keeps +an eye on any files that have changed. Remember that nodemon is a +replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. %prep %setup -q -n %{npm_name}-%{version} - +%patch -P 0 %build # nothing to do @@ -64,34 +73,4 @@ npm run test %{_bindir}/nodemon %changelog -* Tue Jan 26 2021 Fedora Release Engineering - 2.0.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Tue Jul 28 2020 Fedora Release Engineering - 2.0.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri May 01 2020 Honza Horak - 2.0.3-1 -- Update to 2.0.3 - -* Mon Aug 13 2018 Zuzana Svetlikova - 1.18.3-1 -- Resolves: #1615413 -- Updated -- bundled - -* Mon Jul 03 2017 Zuzana Svetlikova - 1.11.0-2 -- rh-nodejs8 rebuild - -* Mon Oct 31 2016 Zuzana Svetlikova - 1.11.0-1 -- Updated with script - -* Sun Feb 14 2016 Zuzana Svetlikova - 1.8.1-6 -- rebuilt - -* Wed Jan 06 2016 Tomas Hrcka - 1.8.1-5 -- Enable scl macros - -* Thu Dec 17 2015 Troy Dawson - 1.8.1-2 -- Fix dependencies - -* Wed Dec 16 2015 Troy Dawson - 1.8.1-1 -- Initial package +%autochangelog diff --git a/sources b/sources index 6838f58..7a6baf9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (nodemon-v2.0.3-bundled.tar.gz) = 2314e795ddea7eeda858a6179943f4b500791bb9ef2954de1a81056bf0fca416243af08c84058ffb0748237259c3e47cc785898adffa653393aacf7a5156739e +SHA512 (nodemon-v3.1.11-bundled.tar.gz) = 77a02847c266654c3cb4f49acc74235aa277c7dc786770097790e2f2c5addc4a4db79c23dbcbf9e5938f01b26ad79cb8cf001e76bf51fa28fc927125e8a3e9a8