Update to version 3.1.11 (rhbz#2414185)

Recently, Node.js changed the way node modules are installed to allow for better parallel functionality and easier unbundling of certain parts of Node.js.

Previously, Node.js was using a symlink, %{_libdir}/node_modules, which pointed to a versioned path, e.g., %{_libdir}/node_modules_22.

This has changed to using a global %{_libdir}/node_modules static shared folder for generic modules and %{_libdir}/node_modules_XX for version-specific modules.

This change is better described in the Fedora change proposal wiki: https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath.

This also needed to be reflected in nodejs-packaging macros, which forces a rebuild of dependent packages.

.gitignore

@@ -1,2 +1 @@
-/nodemon-v2.0.3-bundled.tar.gz
-/nodemon-v3.0.1-bundled.tar.gz
+/nodemon-v*-bundled.tar.gz

0001-CVE-2024-4068-fix.patch

@@ -0,0 +1,38 @@
+From 1dfe8b9208dade21baad8344d6e9847eecb5837d Mon Sep 17 00:00:00 2001
+From: Aaron Moat <2937187+AaronMoat@users.noreply.github.com>
+Date: Tue, 21 May 2024 17:32:41 +1000
+Subject: [PATCH] Lower defaultLength to 10000
+
+---
+ README.md        | 2 +-
+ lib/constants.js | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+ **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera.
+ 
+diff --git a/README.md b/README.md
+index 6b94046..f59dd60 100644
+--- node_modules/braces/README.md
++++ node_modules/braces/README.md
+@@ -178,7 +178,7 @@ console.log(braces.expand('a{b}c'));
+ 
+ **Type**: `Number`
+ 
+-**Default**: `65,536`
++**Default**: `10,000`
+ 
+ **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera.
+ 
+diff --git a/lib/constants.js b/lib/constants.js
+index a937943..2bb3b88 100644
+--- node_modules/braces/lib/constants.js
++++ node_modules/braces/lib/constants.js
+@@ -1,7 +1,7 @@
+ 'use strict';
+ 
+ module.exports = {
+-  MAX_LENGTH: 1024 * 64,
++  MAX_LENGTH: 10000,
+ 
+   // Digits
+   CHAR_0: '0', /* 0 */

nodejs-nodemon.spec

@@ -5,13 +5,17 @@
 %global enable_tests 0
 
 Name:          nodejs-%{npm_name}
-Version:       3.0.1
+Version:       3.1.11
 Release:       %autorelease
 Summary:       Simple monitor script for use during development of a node.js app
-License:       MIT
+License:       ISC AND MIT
 URL:           https://github.com/remy/nodemon
 Source0:       %{npm_name}-v%{version}-bundled.tar.gz
 
+# Patch in the fix for unlimited resource allocation of dependency
+# Source: https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
+Patch:         0001-CVE-2024-4068-fix.patch
+
 BuildRequires: nodejs-devel
 BuildRequires: nodejs-packaging
 BuildRequires: npm
@@ -41,7 +45,7 @@ on the command line when you run your script.
 
 %prep
 %setup -q -n %{npm_name}-%{version}
-
+%patch -P 0 
 %build
 
 # nothing to do

sources

@@ -1 +1 @@
-SHA512 (nodemon-v3.0.1-bundled.tar.gz) = 945d7f3a1aa66f6d050da5e9e0eab702058b0fb4e75b4d48e3677b5f159c33f1a3974e7b48e5bc858a5959fffc0df29ef3a5dd5646ab574eec38fa350b64823c
+SHA512 (nodemon-v3.1.11-bundled.tar.gz) = 77a02847c266654c3cb4f49acc74235aa277c7dc786770097790e2f2c5addc4a4db79c23dbcbf9e5938f01b26ad79cb8cf001e76bf51fa28fc927125e8a3e9a8