Regenerating sources for CVE-2026-13149

Currently remy's original repo is slightly behind npm's registry counterpart.

- changed upstream source to npm one
- tarball script edits

Resolves: rhbz#2494976

nodejs-nodemon.spec

@@ -9,7 +9,7 @@ Version:       3.1.14
 Release:       %autorelease
 Summary:       Simple monitor script for use during development of a node.js app
 License:       ISC AND MIT
-URL:           https://github.com/remy/nodemon
+URL:           https://www.npmjs.com/package/nodemon
 Source0:       %{npm_name}-v%{version}-bundled.tar.gz
 
 
@@ -41,8 +41,8 @@ replacement wrapper for node, think of it as replacing the word "node"
 on the command line when you run your script.
 
 %prep
-%setup -q -n %{npm_name}-%{version}
-%patch -P 0 
+%autosetup -n package
+
 %build
 
 # nothing to do
@@ -50,7 +50,7 @@ on the command line when you run your script.
 
 %install
 mkdir -p %{buildroot}%{nodejs_sitelib}/%{npm_name}
-cp -pr doc bin lib package.json website node_modules %{buildroot}%{nodejs_sitelib}/%{npm_name}
+cp -pr doc bin lib package.json node_modules %{buildroot}%{nodejs_sitelib}/%{npm_name}
 
 mkdir -p %{buildroot}%{_bindir}
 ln -sf %{nodejs_sitelib}/%{npm_name}/bin/nodemon.js %{buildroot}%{_bindir}/nodemon
@@ -65,7 +65,7 @@ npm run test
 %endif
 
 %files
-%doc CODE_OF_CONDUCT.md doc faq.md README.md
+%doc doc README.md
 %{nodejs_sitelib}/%{npm_name}
 %{_bindir}/nodemon
 

nodemon-tarball.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 version=$(rpm -q --specfile --qf='%{version}\n' nodejs-nodemon.spec | head -n1)
-wget https://github.com/remy/nodemon/archive/v$version.tar.gz
-tar -zxf v$version.tar.gz
-cd nodemon-$version
-npm install --production && cd .. && tar -zcf nodemon-v$version-bundled.tar.gz nodemon-$version
+wget https://registry.npmjs.org/nodemon/-/nodemon-$version.tgz
+tar -zxf nodemon-$version.tgz
+cd package
+npm install --production && cd .. && tar -zcf nodemon-v$version-bundled.tar.gz package

sources

@@ -1 +1 @@
-SHA512 (nodemon-v3.1.14-bundled.tar.gz) = 72d7ddb6ccc0783bf96a316b94fa428820d6e147fdd6192f22524b258cfe13ccc4ba274b8cef225f3a542b0c6175b35e6937cad8de218dab3491a98bc129e9f2
+SHA512 (nodemon-v3.1.14-bundled.tar.gz) = db8759bb731247799835e32d86b91dd124aa504c2484e70fcae167c71565bec5ab83dd05c363fd25a024d55c69eaf02edef3ac0eb76550581eb09fc1528c2471