Upgade nodejs to version 24.20.0

SPECS/nodejs/CVE-2026-15157.patch

@@ -10,7 +10,7 @@ Upstream-reference: https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77
  1 file changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
-index ef3d38ea..e5e2924f 100644
+index 9455517a..a801ecb3 100644
 --- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
 +++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
 @@ -10,6 +10,7 @@ const {
@@ -21,7 +21,7 @@ index ef3d38ea..e5e2924f 100644
    HeadersTimeoutError,
    HeadersOverflowError,
    SocketError,
-@@ -923,8 +924,16 @@ function writeH1 (client, request) {
+@@ -993,8 +994,16 @@ function writeH1 (client, request) {
      }
      body = bodyStream.stream
      contentLength = bodyStream.length

SPECS/nodejs/disable-tlsv1-tlsv1-1.patch

@@ -1,8 +1,8 @@
 diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 3513afc5..146bed1b 100644
+index 05fc2a00..c62d6cf5 100644
 --- a/src/crypto/crypto_context.cc
 +++ b/src/crypto/crypto_context.cc
-@@ -1506,28 +1506,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -1583,28 +1583,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
        min_version = 0;
        max_version = kMaxSupportedVersion;
        method = TLS_client_method();

SPECS/nodejs/nodejs.signatures.json

@@ -3,6 +3,6 @@
   "btest402.js": "fabaf4dacc13e93d54f825b87ffde18573214b149388a5f96176236dd31d7768",
   "icu4c-78.3-data-bin-b.zip": "cb751fc5d46e218b6c71d69d9dea7ba98da937e2e41b662ad8313c9363d8b7e2",
   "icu4c-78.3-data-bin-l.zip": "982619632b78887f1895b063e96e8c3cc7f99283337c8abbd05aa71635de613c",
-  "node-v24.18.1.tar.xz": "353af024d6716de3962b7d0713f9a4d890d7337dfb8eb4e2fa7b2fbfea2f40f7"
+  "node-v24.20.0.tar.xz": "4dadfdceb1ad917bdabd5bc215ad36c57ccfc30b61ebf540abe87df2ddb76277"
  }
 }

SPECS/nodejs/nodejs.spec

@@ -1,5 +1,5 @@
 # Retrieved from 'deps/npm/package.json' inside the sources tarball.
-%define npm_version 11.16.0
+%define npm_version 11.19.0
 
 %global nodejs_datadir %{_datarootdir}/nodejs
 
@@ -15,8 +15,8 @@ Summary:        A JavaScript runtime built on Chrome's V8 JavaScript engine.
 Name:           nodejs
 # WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
 #           The version of NPM can be found inside the sources under 'deps/npm/package.json'.
-Version:        24.18.1
-Release:        2%{?dist}
+Version:        24.20.0
+Release:        1%{?dist}
 License:        BSD AND MIT AND Public Domain AND NAIST-2003 AND Artistic-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -35,9 +35,7 @@ Patch2:         CVE-2024-22195.patch
 Patch3:         CVE-2020-28493.patch
 Patch4:         CVE-2024-34064.patch
 Patch5:         CVE-2025-27516.patch
-Patch6:         CVE-2026-12151.patch
-Patch7:         CVE-2026-9679.patch
-Patch8:         CVE-2026-15157.patch
+Patch6:         CVE-2026-15157.patch
 BuildRequires:  brotli-devel
 BuildRequires:  c-ares-devel
 BuildRequires:  coreutils >= 8.22
@@ -195,6 +193,12 @@ make cctest
 %{_prefix}/lib/node_modules/*
 
 %changelog
+* Tue Sep 01 2026 Aditya Singh <v-aditysing@microsoft.com> - 24.20.0-1
+- Upgrade to 24.20.0 'Krypton' (LTS) (bundled npm 11.19.0).
+- Bundled ICU version remains the same as 78.3
+- This upgrade fixes CVE-2026-12151, CVE-2026-9679
+- This upgrade also updates npm dependency: undici to 6.27.0
+
 * Mon Aug 10 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 24.18.1-2
 - Patch for CVE-2026-15157
 

cgmanifest.json

@@ -14602,8 +14602,8 @@
         "type": "other",
         "other": {
           "name": "nodejs",
-          "version": "24.18.1",
-          "downloadUrl": "https://nodejs.org/download/release/v24.18.1/node-v24.18.1.tar.xz"
+          "version": "24.20.0",
+          "downloadUrl": "https://nodejs.org/download/release/v24.20.0/node-v24.20.0.tar.xz"
         }
       }
     },