nodejs18: upgrade nodejs18 to 18.20.3 to fix CVE-2024-28863 (#9372)

Co-authored-by: Nick Samson <nisamson@microsoft.com>

Author: nisamson

SPECS/nodejs/nodejs18.signatures.json

@@ -1,5 +1,5 @@
 {
   "Signatures": {
-    "node-v18.20.2.tar.xz": "f17f61fffd80cc22591db48e62ab1b8de5302669bcaaa16c061195f3d05bb1c5"
+    "node-v18.20.3.tar.xz": "e82474c1336f45e5adf88434c52565ac5830a01569355bd119c3b5f186a5253c"
   }
 }

SPECS/nodejs/nodejs18.spec

@@ -1,12 +1,12 @@
 # Retrieved from 'deps/npm/package.json' inside the sources tarball.
-%define npm_version 10.5.0
+%define npm_version 10.7.0
 
 Summary:        A JavaScript runtime built on Chrome's V8 JavaScript engine.
 Name:           nodejs18
 # WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
 #           The version of NPM can be found inside the sources under 'deps/npm/package.json'.
-Version:        18.20.2
-Release:        2%{?dist}
+Version:        18.20.3
+Release:        1%{?dist}
 License:        BSD and MIT and Public Domain and NAIST-2003 and Artistic-2.0
 Group:          Applications/System
 Vendor:         Microsoft Corporation
@@ -117,6 +117,9 @@ make cctest
 %{_datadir}/systemtap/tapset/node.stp
 
 %changelog
+* Thu Jun 13 2024 Nick Samson <nisamson@microsoft.com> - 18.20.3-1
+- Upgrade to 18.20.3-1 to fix CVE-2024-28863
+
 * Wed May 29 2024 Mitch Zhu <mitchzhu@microsoft.com> - 18.20.2-2
 - Patch CVE-2023-21100.
 - Remove unused patches.

cgmanifest.json

@@ -14433,8 +14433,8 @@
         "type": "other",
         "other": {
           "name": "nodejs18",
-          "version": "18.20.2",
-          "downloadUrl": "https://nodejs.org/download/release/v18.20.2/node-v18.20.2.tar.xz"
+          "version": "18.20.3",
+          "downloadUrl": "https://nodejs.org/download/release/v18.20.3/node-v18.20.3.tar.xz"
         }
       }
     },