diff --git a/.gitignore b/.gitignore
index 8b0f1a0..4b97fd1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,5 @@
+SOURCES/cjs-module-lexer-1.2.2.tar.gz
+SOURCES/icu4c-70_1-src.tgz
 SOURCES/node-ssl-shim-70e39fd.tar.gz
-SOURCES/node-v14.20.1-stripped.tar.gz
+SOURCES/node-v14.21.1-stripped.tar.gz
+SOURCES/wasi-sdk-wasi-sdk-11.tar.gz
diff --git a/.rh-nodejs14-nodejs.metadata b/.rh-nodejs14-nodejs.metadata
index 6a3be65..6b296f9 100644
--- a/.rh-nodejs14-nodejs.metadata
+++ b/.rh-nodejs14-nodejs.metadata
@@ -1,2 +1,5 @@
+6976e77068429bd0b47b573793289e065ceb6b27 SOURCES/cjs-module-lexer-1.2.2.tar.gz
+f7c1363edee6be7de8b624ffbb801892b3417d4e SOURCES/icu4c-70_1-src.tgz
 a49b02166a7bdba54fb45cba26a18fa48928ca0e SOURCES/node-ssl-shim-70e39fd.tar.gz
-a425ca61bff45d6bf09bc4c2b22a0d5489e689ec SOURCES/node-v14.20.1-stripped.tar.gz
+2812a06625a63430d5f36ce9019cc2df321956e6 SOURCES/node-v14.21.1-stripped.tar.gz
+8979d177dd62e3b167a6fd7dc7185adb0128c439 SOURCES/wasi-sdk-wasi-sdk-11.tar.gz
diff --git a/SOURCES/0004-Disable-unsupported-OpenSSL-features.patch b/SOURCES/0004-Disable-unsupported-OpenSSL-features.patch
index 68af894..3db8961 100644
--- a/SOURCES/0004-Disable-unsupported-OpenSSL-features.patch
+++ b/SOURCES/0004-Disable-unsupported-OpenSSL-features.patch
@@ -1,4 +1,4 @@
-From 4ba04fcbfd74f9b214c6dd25d82dad5a87cf8465 Mon Sep 17 00:00:00 2001
+From 38ed745edf7725660c59c9db63ad722aee126487 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= <jstanek@redhat.com>
 Date: Wed, 13 Jul 2022 14:30:43 +0200
 Subject: [PATCH] Disable unsupported OpenSSL features
@@ -36,30 +36,31 @@ Content-Transfer-Encoding: 8bit
   This reverts commit 8e8aef836cb9807c9fe5ca350f1e7febdb40c3a7.
 
 Signed-off-by: Jan Staněk <jstanek@redhat.com>
+Signed-off-by: rpm-build <rpm-build>
 ---
  BUILDING.md                                   | 14 ------
  configure.py                                  |  8 ----
- doc/api/cli.md                                | 18 --------
- doc/api/tls.md                                | 15 +++----
+ doc/api/cli.md                                | 18 -------
+ doc/api/tls.md                                | 15 +++---
  src/env.h                                     | 11 ++++-
- src/node.cc                                   | 43 -------------------
+ src/node.cc                                   | 48 -------------------
  src/node_crypto.cc                            |  8 +++-
- src/node_crypto_common.cc                     | 12 ++++++
+ src/node_crypto_common.cc                     | 12 +++++
  src/node_crypto_common.h                      |  6 +++
- src/node_options.cc                           | 10 ++++-
+ src/node_options.cc                           | 10 +++-
  test/fixtures/openssl_fips_disabled.cnf       |  2 +-
  test/fixtures/openssl_fips_enabled.cnf        |  2 +-
  .../test-tls-cli-max-version-1.3.js           |  0
  .../test-tls-cli-min-max-conflict.js          |  0
  .../test-tls-cli-min-version-1.3.js           |  0
  test/parallel/test-crypto-fips.js             |  2 +-
- 16 files changed, 53 insertions(+), 98 deletions(-)
+ 16 files changed, 53 insertions(+), 103 deletions(-)
  rename test/{parallel => known_issues}/test-tls-cli-max-version-1.3.js (100%)
  rename test/{parallel => known_issues}/test-tls-cli-min-max-conflict.js (100%)
  rename test/{parallel => known_issues}/test-tls-cli-min-version-1.3.js (100%)
 
 diff --git a/BUILDING.md b/BUILDING.md
-index 0ae3c09d99..5d2459eb76 100644
+index 0ae3c09..5d2459e 100644
 --- a/BUILDING.md
 +++ b/BUILDING.md
 @@ -52,7 +52,6 @@ file a new issue.
@@ -91,7 +92,7 @@ index 0ae3c09d99..5d2459eb76 100644
  
  The current version of Node.js does not support FIPS.
 diff --git a/configure.py b/configure.py
-index 892e1d4202..2ea4eb69f5 100755
+index 892e1d4..2ea4eb6 100755
 --- a/configure.py
 +++ b/configure.py
 @@ -176,12 +176,6 @@ parser.add_option("--link-module",
@@ -117,10 +118,10 @@ index 892e1d4202..2ea4eb69f5 100755
      def without_ssl_error(option):
        error('--without-ssl is incompatible with %s' % option)
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index ff5dff244e..61bac086bf 100644
+index 92cf190..a6a77ea 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -902,14 +902,6 @@ added:
+@@ -917,14 +917,6 @@ added:
  Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. Use to disable support for
  TLSv1.3.
  
@@ -135,7 +136,7 @@ index ff5dff244e..61bac086bf 100644
  ### `--tls-min-v1.0`
  <!-- YAML
  added:
-@@ -941,14 +933,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
+@@ -956,14 +948,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
  12.x and later, but the option is supported for compatibility with older Node.js
  versions.
  
@@ -150,7 +151,7 @@ index ff5dff244e..61bac086bf 100644
  ### `--trace-atomics-wait`
  <!-- YAML
  added: v14.3.0
-@@ -1391,11 +1375,9 @@ Node.js options that are allowed are:
+@@ -1407,11 +1391,9 @@ Node.js options that are allowed are:
  * `--tls-cipher-list`
  * `--tls-keylog`
  * `--tls-max-v1.2`
@@ -163,7 +164,7 @@ index ff5dff244e..61bac086bf 100644
  * `--trace-deprecation`
  * `--trace-event-categories`
 diff --git a/doc/api/tls.md b/doc/api/tls.md
-index 271dd095fb..0e8125fffd 100644
+index 271dd09..0e8125f 100644
 --- a/doc/api/tls.md
 +++ b/doc/api/tls.md
 @@ -1988,10 +1988,10 @@ added: v11.4.0
@@ -198,7 +199,7 @@ index 271dd095fb..0e8125fffd 100644
  [CVE-2021-44531]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531
  [Chrome's 'modern cryptography' setting]: https://www.chromium.org/Home/chromium-security/education/tls#TOC-Cipher-Suites
 diff --git a/src/env.h b/src/env.h
-index 824202ef52..90b04e2b1f 100644
+index 824202e..90b04e2 100644
 --- a/src/env.h
 +++ b/src/env.h
 @@ -50,6 +50,8 @@
@@ -234,7 +235,7 @@ index 824202ef52..90b04e2b1f 100644
    V(status_string, "status")                                                   \
    V(stdio_string, "stdio")                                                     \
 diff --git a/src/node.cc b/src/node.cc
-index d3b884aa66..683e36c1a5 100644
+index 9e7bf07..8a29f76 100644
 --- a/src/node.cc
 +++ b/src/node.cc
 @@ -44,7 +44,6 @@
@@ -263,11 +264,10 @@ index d3b884aa66..683e36c1a5 100644
  InitializationResult InitializeOncePerProcess(int argc, char** argv) {
    // Initialized the enabled list for Debug() calls with system
    // environment variables.
-@@ -1045,44 +1040,6 @@ InitializationResult InitializeOncePerProcess(int argc, char** argv) {
-     if (credentials::SafeGetenv("NODE_EXTRA_CA_CERTS", &extra_ca_certs))
+@@ -1046,49 +1041,6 @@ InitializationResult InitializeOncePerProcess(int argc, char** argv) {
        crypto::UseExtraCaCerts(extra_ca_certs);
    }
--
+ 
 -  // Passing NULL as the config file will allow the default openssl.cnf file
 -  // to be loaded, but the default section in that file will not be used,
 -  // instead only the section that matches the value of conf_section_name
@@ -275,6 +275,12 @@ index d3b884aa66..683e36c1a5 100644
 -  const char* conf_file = nullptr;
 -  // Use OPENSSL_CONF environment variable is set.
 -  std::string env_openssl_conf;
+-  // To allow for using the previous default where the 'openssl_conf' appname
+-  // was used, the command line option 'openssl-shared-config' can be used to
+-  // force the old behavior.
+-  if (per_process::cli_options->openssl_shared_config) {
+-    conf_section_name = "openssl_conf";
+-  }
 -  credentials::SafeGetenv("OPENSSL_CONF", &env_openssl_conf);
 -  if (!env_openssl_conf.empty()) {
 -    conf_file = env_openssl_conf.c_str();
@@ -309,7 +315,7 @@ index d3b884aa66..683e36c1a5 100644
    // the random source is properly initialized first.
    if (FIPS_mode()) {
 diff --git a/src/node_crypto.cc b/src/node_crypto.cc
-index 975a148fc8..8bb34ab620 100644
+index 975a148..8bb34ab 100644
 --- a/src/node_crypto.cc
 +++ b/src/node_crypto.cc
 @@ -7124,11 +7124,15 @@ namespace {
@@ -339,7 +345,7 @@ index 975a148fc8..8bb34ab620 100644
            data);
    Local<ArrayBuffer> buffer = ArrayBuffer::New(env->isolate(), store);
 diff --git a/src/node_crypto_common.cc b/src/node_crypto_common.cc
-index 7d313dd3df..a7bde45094 100644
+index 7d313dd..a7bde45 100644
 --- a/src/node_crypto_common.cc
 +++ b/src/node_crypto_common.cc
 @@ -143,6 +143,7 @@ long VerifyPeerCertificate(  // NOLINT(runtime/int)
@@ -430,7 +436,7 @@ index 7d313dd3df..a7bde45094 100644
                    info,
                    env->version_string(),
 diff --git a/src/node_crypto_common.h b/src/node_crypto_common.h
-index bf58df18f6..8e1ac58cd7 100644
+index bf58df1..8e1ac58 100644
 --- a/src/node_crypto_common.h
 +++ b/src/node_crypto_common.h
 @@ -67,15 +67,19 @@ long VerifyPeerCertificate(  // NOLINT(runtime/int)
@@ -466,7 +472,7 @@ index bf58df18f6..8e1ac58cd7 100644
  v8::MaybeLocal<v8::Value> GetCipherVersion(
      Environment* env,
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 06847ce332..66b9e4e917 100644
+index 35d518b..26a891a 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
 @@ -9,6 +9,8 @@
@@ -519,7 +525,7 @@ index 06847ce332..66b9e4e917 100644
  
  PerIsolateOptionsParser::PerIsolateOptionsParser(
 diff --git a/test/fixtures/openssl_fips_disabled.cnf b/test/fixtures/openssl_fips_disabled.cnf
-index 253c6906e3..8668370fac 100644
+index 253c690..8668370 100644
 --- a/test/fixtures/openssl_fips_disabled.cnf
 +++ b/test/fixtures/openssl_fips_disabled.cnf
 @@ -1,6 +1,6 @@
@@ -531,7 +537,7 @@ index 253c6906e3..8668370fac 100644
  
  [openssl_conf_section]
 diff --git a/test/fixtures/openssl_fips_enabled.cnf b/test/fixtures/openssl_fips_enabled.cnf
-index 79733c657a..9c1a90f508 100644
+index 79733c6..9c1a90f 100644
 --- a/test/fixtures/openssl_fips_enabled.cnf
 +++ b/test/fixtures/openssl_fips_enabled.cnf
 @@ -1,6 +1,6 @@
@@ -555,7 +561,7 @@ similarity index 100%
 rename from test/parallel/test-tls-cli-min-version-1.3.js
 rename to test/known_issues/test-tls-cli-min-version-1.3.js
 diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
-index bf8b3c157d..a1ed645184 100644
+index bf8b3c1..a1ed645 100644
 --- a/test/parallel/test-crypto-fips.js
 +++ b/test/parallel/test-crypto-fips.js
 @@ -64,7 +64,7 @@ testHelper(
@@ -568,5 +574,5 @@ index bf8b3c157d..a1ed645184 100644
  // --enable-fips should turn FIPS mode on
  testHelper(
 -- 
-2.36.1
+2.38.1
 
diff --git a/SOURCES/btest402.js b/SOURCES/btest402.js
new file mode 100644
index 0000000..277319c
--- /dev/null
+++ b/SOURCES/btest402.js
@@ -0,0 +1,151 @@
+// Copyright (C) 2014 IBM Corporation and Others. All Rights Reserved.
+// This file is part of the Node.JS ICU enablement work
+// https://github.com/joyent/node/pull/7719
+// and is under the same license.
+//
+// This is a very, very, very basic test of es402
+//
+// URL: https://github.com/srl295/btest402
+// Author: Steven R. Loomis <srl@icu-project.org>
+//
+// for a complete test, see http://test262.ecmascript.org
+//
+// Usage: node btest402.js
+
+try {
+    console.log("You have console.log.");
+} catch(e) {
+    // this works on d8
+    console = { log: print };
+    console.log("Now you have console.log.");
+}
+
+function runbtest() {
+    var summary = {};
+
+    try {
+        var i = Intl;
+        summary.haveIntl = true;
+        console.log("+ Congrats, you have the Intl object.");
+    } catch(e) {
+        console.log("You don't have the Intl object: " + e);
+    }
+
+    if(summary.haveIntl) {
+        var locs = [ "en", "mt", "ja","tlh"];
+        var d = new Date(196400000);
+        for ( var n=0; n<locs.length; n++ ) {
+            var loc = locs[n];
+            var lsummary = summary[loc] = {};
+
+            console.log(loc+":");
+            var sl=null;
+            try {
+                sl = Intl.DateTimeFormat.supportedLocalesOf([loc]);
+                if( sl.length > 0 ) {
+                    lsummary.haveSlo = true;
+                }
+            } catch (e) {
+                console.log("SLO err: " + e);
+            }
+            var dstr = "ERR";
+            try {
+                lsummary.dstr = d.toLocaleString(loc,{month: "long",day:"numeric",weekday:"long",year:"numeric"});
+                console.log(" date: (supported:"+sl+") " + lsummary.dstr);
+            } catch (e) {
+                console.log(" Date Format err: " + e);
+            }
+            try {
+                new Intl.v8BreakIterator();
+                console.log(" Intl.v8BreakIterator:" +
+                            Intl.v8BreakIterator.supportedLocalesOf(loc) + " Supported, first()==" +
+                            new Intl.v8BreakIterator(loc).first() );
+                lsummary.brkOk = true;
+            } catch ( e) {
+                console.log(" Intl.v8BreakIterator error (NOT part of EcmaScript402): " + e);
+            }
+            console.log();
+        }
+    }
+
+    // print summary
+    console.log();
+    console.log("--------- Analysis ---------");
+    stxt = "";
+    if( summary.haveIntl ) {
+        console.log("* You have the 'Intl' object. Congratulations! You have the possibility of being EcmaScript 402 compliant.");
+        stxt += "Have Intl, ";
+
+        if ( !summary.en.haveSlo ) {
+            stxt += "Date:no EN, ";
+            console.log("* English isn't a supported language by the date formatter. Perhaps the data isn't installed properly?");
+        }
+        if ( !summary.tlh.haveSlo ) {
+            stxt += "Date:no 'tlh', ";
+            console.log("* Klingon isn't a supported language by the date formatter. It is without honor!");
+        }
+        // now, what is it actually saying
+        if( summary.en.dstr.indexOf("1970") == -1) {
+            stxt += "Date:bad 'en', ";
+            console.log("* the English date format text looks bad to me. Doesn't even have the year.");
+        } else {
+            if( summary.en.dstr.indexOf("Jan") == -1) {
+                stxt += "Date:bad 'en', ";
+                console.log("* The English date format text looks bad to me. Doesn't have the right month.");
+            }
+        }
+
+        if( summary.mt.dstr == summary.en.dstr ) {
+            stxt += "Date:'mt'=='en', ";
+            console.log("* The English and Maltese look the same to me. Probably a 'small' build.");
+        } else if( summary.mt.dstr.indexOf("1970") == -1) {
+            stxt += "Date:bad 'mt', ";
+            console.log("* the Maltese date format text looks bad to me. Doesn't even have the year. (This data is missing from the Chromium ICU build)");
+        } else {
+            if( summary.mt.dstr.indexOf("Jann") == -1) {
+                stxt += "Date:bad 'mt', ";
+                console.log("* The Maltese date format text looks bad to me. Doesn't have the right month. (This data is missing from the Chromium ICU build)");
+            }
+        }
+
+        if ( !summary.ja.haveSlo ) {
+            stxt += "Date:no 'ja', ";
+            console.log("* Japanese isn't a supported language by the date formatter. Could be a 'small' build.");
+        } else {
+            if( summary.ja.dstr.indexOf("1970") == -1) {
+                stxt += "Date:bad 'ja', ";
+                console.log("* the Japanese date format text looks bad to me. Doesn't even have the year.");
+            } else {
+                if( summary.ja.dstr.indexOf("日") == -1) {
+                    stxt += "Date:bad 'ja', ";
+                    console.log("* The Japanese date format text looks bad to me.");
+                }
+            }
+        }
+        if ( summary.en.brkOk ) {
+            stxt += "FYI: v8Brk:have 'en', ";
+            console.log("* You have Intl.v8BreakIterator support. (Note: not part of ES402.)");
+        }
+    } else {
+        console.log("* You don't have the 'Intl' object. You aren't EcmaScript 402 compliant.");
+        stxt += " NO Intl. ";
+    }
+
+    // 1-liner.
+    console.log();
+    console.log("----------------");
+    console.log( "SUMMARY:" +  stxt );
+}
+
+var dorun = true;
+
+try {
+    if(btest402_noautorun) {
+        dorun = false;
+    }
+} catch(e) {}
+
+if(dorun) {
+    console.log("Running btest..");
+    runbtest();
+}
diff --git a/SOURCES/deps-minimist-improve-redos-protection.patch b/SOURCES/deps-minimist-improve-redos-protection.patch
new file mode 100644
index 0000000..8d56f8e
--- /dev/null
+++ b/SOURCES/deps-minimist-improve-redos-protection.patch
@@ -0,0 +1,298 @@
+From fb18c98b6ac91740165fd7c2a6f4449e880375a8 Mon Sep 17 00:00:00 2001
+From: isaacs <i@izs.me>
+Date: Sun, 6 Feb 2022 12:26:10 -0800
+Subject: [PATCH] Improve redos protection, add many tests
+
+100% line coverage, not quite 100% total though.
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ deps/npm/node_modules/minimatch/minimatch.js | 119 ++++++++++++-------
+ 1 file changed, 74 insertions(+), 45 deletions(-)
+
+diff --git a/deps/npm/node_modules/minimatch/minimatch.js b/deps/npm/node_modules/minimatch/minimatch.js
+index 5b5f8cf..0499a73 100644
+--- a/deps/npm/node_modules/minimatch/minimatch.js
++++ b/deps/npm/node_modules/minimatch/minimatch.js
+@@ -1,15 +1,15 @@
+ module.exports = minimatch
+ minimatch.Minimatch = Minimatch
+ 
+-var path = { sep: '/' }
+-try {
+-  path = require('path')
+-} catch (er) {}
++const path = (() => { try { return require('path') } catch (e) {}})() || {
++  sep: '/'
++}
++minimatch.sep = path.sep
+ 
+-var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {}
+-var expand = require('brace-expansion')
++const GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {}
++const expand = require('brace-expansion')
+ 
+-var plTypes = {
++const plTypes = {
+   '!': { open: '(?:(?!(?:', close: '))[^/]*?)'},
+   '?': { open: '(?:', close: ')?' },
+   '+': { open: '(?:', close: ')+' },
+@@ -19,22 +19,22 @@ var plTypes = {
+ 
+ // any single thing other than /
+ // don't need to escape / when using new RegExp()
+-var qmark = '[^/]'
++const qmark = '[^/]'
+ 
+ // * => any number of characters
+-var star = qmark + '*?'
++const star = qmark + '*?'
+ 
+ // ** when dots are allowed.  Anything goes, except .. and .
+ // not (^ or / followed by one or two dots followed by $ or /),
+ // followed by anything, any number of times.
+-var twoStarDot = '(?:(?!(?:\\\/|^)(?:\\.{1,2})($|\\\/)).)*?'
++const twoStarDot = '(?:(?!(?:\\\/|^)(?:\\.{1,2})($|\\\/)).)*?'
+ 
+ // not a ^ or / followed by a dot,
+ // followed by anything, any number of times.
+-var twoStarNoDot = '(?:(?!(?:\\\/|^)\\.).)*?'
++const twoStarNoDot = '(?:(?!(?:\\\/|^)\\.).)*?'
+ 
+ // characters that need to be escaped in RegExp.
+-var reSpecials = charSet('().*{}+?[]^$\\!')
++const reSpecials = charSet('().*{}+?[]^$\\!')
+ 
+ // "abc" -> { a:true, b:true, c:true }
+ function charSet (s) {
+@@ -45,7 +45,7 @@ function charSet (s) {
+ }
+ 
+ // normalizes slashes.
+-var slashSplit = /\/+/
++const slashSplit = /\/+/
+ 
+ minimatch.filter = filter
+ function filter (pattern, options) {
+@@ -58,41 +58,63 @@ function filter (pattern, options) {
+ function ext (a, b) {
+   a = a || {}
+   b = b || {}
+-  var t = {}
+-  Object.keys(b).forEach(function (k) {
+-    t[k] = b[k]
+-  })
++  const t = {}
+   Object.keys(a).forEach(function (k) {
+     t[k] = a[k]
+   })
++  Object.keys(b).forEach(function (k) {
++    t[k] = b[k]
++  })
+   return t
+ }
+ 
+ minimatch.defaults = function (def) {
+-  if (!def || !Object.keys(def).length) return minimatch
++  if (!def || typeof def !== 'object' || !Object.keys(def).length) {
++    return minimatch
++  }
+ 
+-  var orig = minimatch
++  const orig = minimatch
+ 
+-  var m = function minimatch (p, pattern, options) {
+-    return orig.minimatch(p, pattern, ext(def, options))
++  const m = function minimatch (p, pattern, options) {
++    return orig(p, pattern, ext(def, options))
+   }
+ 
+   m.Minimatch = function Minimatch (pattern, options) {
+     return new orig.Minimatch(pattern, ext(def, options))
+   }
++  m.Minimatch.defaults = options => {
++    return orig.defaults(ext(def, options)).Minimatch
++  }
++
++  m.filter = function filter (pattern, options) {
++    return orig.filter(pattern, ext(def, options))
++  }
++
++  m.defaults = function defaults (options) {
++    return orig.defaults(ext(def, options))
++  }
++
++  m.makeRe = function makeRe (pattern, options) {
++    return orig.makeRe(pattern, ext(def, options))
++  }
++
++  m.braceExpand = function braceExpand (pattern, options) {
++    return orig.braceExpand(pattern, ext(def, options))
++  }
++
++  m.match = function (list, pattern, options) {
++    return orig.match(list, pattern, ext(def, options))
++  }
+ 
+   return m
+ }
+ 
+ Minimatch.defaults = function (def) {
+-  if (!def || !Object.keys(def).length) return Minimatch
+   return minimatch.defaults(def).Minimatch
+ }
+ 
+ function minimatch (p, pattern, options) {
+-  if (typeof pattern !== 'string') {
+-    throw new TypeError('glob pattern string required')
+-  }
++  assertValidPattern(pattern)
+ 
+   if (!options) options = {}
+ 
+@@ -112,9 +134,7 @@ function Minimatch (pattern, options) {
+     return new Minimatch(pattern, options)
+   }
+ 
+-  if (typeof pattern !== 'string') {
+-    throw new TypeError('glob pattern string required')
+-  }
++  assertValidPattern(pattern)
+ 
+   if (!options) options = {}
+   pattern = pattern.trim()
+@@ -242,12 +262,9 @@ function braceExpand (pattern, options) {
+   pattern = typeof pattern === 'undefined'
+     ? this.pattern : pattern
+ 
+-  if (typeof pattern === 'undefined') {
+-    throw new TypeError('undefined pattern')
+-  }
++  assertValidPattern(pattern)
+ 
+-  if (options.nobrace ||
+-    !pattern.match(/\{.*\}/)) {
++  if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) {
+     // shortcut. no need to expand.
+     return [pattern]
+   }
+@@ -255,6 +272,17 @@ function braceExpand (pattern, options) {
+   return expand(pattern)
+ }
+ 
++const MAX_PATTERN_LENGTH = 1024 * 64
++const assertValidPattern = pattern => {
++  if (typeof pattern !== 'string') {
++    throw new TypeError('invalid pattern')
++  }
++
++  if (pattern.length > MAX_PATTERN_LENGTH) {
++    throw new TypeError('pattern is too long')
++  }
++}
++
+ // parse a component of the expanded set.
+ // At this point, no pattern may contain "/" in it
+ // so we're going to return a 2d array, where each entry is the full
+@@ -267,11 +295,9 @@ function braceExpand (pattern, options) {
+ // of * is equivalent to a single *.  Globstar behavior is enabled by
+ // default, and can be disabled by setting options.noglobstar.
+ Minimatch.prototype.parse = parse
+-var SUBPARSE = {}
++const SUBPARSE = {}
+ function parse (pattern, isSub) {
+-  if (pattern.length > 1024 * 64) {
+-    throw new TypeError('pattern is too long')
+-  }
++  assertValidPattern(pattern)
+ 
+   var options = this.options
+ 
+@@ -280,7 +306,7 @@ function parse (pattern, isSub) {
+   if (pattern === '') return ''
+ 
+   var re = ''
+-  var hasMagic = !!options.nocase
++  var hasMagic = false
+   var escaping = false
+   // ? => one single character
+   var patternListStack = []
+@@ -332,10 +358,11 @@ function parse (pattern, isSub) {
+     }
+ 
+     switch (c) {
+-      case '/':
++      case '/': /* istanbul ignore next */ {
+         // completely not allowed, even escaped.
+         // Should already be path-split by now.
+         return false
++      }
+ 
+       case '\\':
+         clearStateChar()
+@@ -620,7 +647,7 @@ function parse (pattern, isSub) {
+   var flags = options.nocase ? 'i' : ''
+   try {
+     var regExp = new RegExp('^' + re + '$', flags)
+-  } catch (er) {
++  } catch (er) /* istanbul ignore next - should be impossible */ {
+     // If it was an invalid regular expression, then it can't match
+     // anything.  This trick looks for a character after the end of
+     // the string, which is of course impossible, except in multi-line
+@@ -678,7 +705,7 @@ function makeRe () {
+ 
+   try {
+     this.regexp = new RegExp(re, flags)
+-  } catch (ex) {
++  } catch (ex) /* istanbul ignore next - should be impossible */ {
+     this.regexp = false
+   }
+   return this.regexp
+@@ -686,7 +713,7 @@ function makeRe () {
+ 
+ minimatch.match = function (list, pattern, options) {
+   options = options || {}
+-  var mm = new Minimatch(pattern, options)
++  const mm = new Minimatch(pattern, options)
+   list = list.filter(function (f) {
+     return mm.match(f)
+   })
+@@ -779,6 +806,7 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
+ 
+     // should be impossible.
+     // some invalid regexp stuff in the set.
++    /* istanbul ignore if */
+     if (p === false) return false
+ 
+     if (p === GLOBSTAR) {
+@@ -852,6 +880,7 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
+       // no match was found.
+       // However, in partial mode, we can't say this is necessarily over.
+       // If there's more *pattern* left, then
++      /* istanbul ignore if */
+       if (partial) {
+         // ran out of file
+         this.debug('\n>>> no match, partial?', file, fr, pattern, pr)
+@@ -900,16 +929,16 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
+     // this is ok if we're doing the match as part of
+     // a glob fs traversal.
+     return partial
+-  } else if (pi === pl) {
++  } else /* istanbul ignore else */ if (pi === pl) {
+     // ran out of pattern, still have file left.
+     // this is only acceptable if we're on the very last
+     // empty segment of a file with a trailing slash.
+     // a/* should match a/b/
+-    var emptyFileEnd = (fi === fl - 1) && (file[fi] === '')
+-    return emptyFileEnd
++    return (fi === fl - 1) && (file[fi] === '')
+   }
+ 
+   // should be unreachable.
++  /* istanbul ignore next */
+   throw new Error('wtf?')
+ }
+ 
+-- 
+2.39.1
+
diff --git a/SOURCES/deps-node-fetch-npm-backport-CVE-2022-0235-fix.patch b/SOURCES/deps-node-fetch-npm-backport-CVE-2022-0235-fix.patch
new file mode 100644
index 0000000..edc47ee
--- /dev/null
+++ b/SOURCES/deps-node-fetch-npm-backport-CVE-2022-0235-fix.patch
@@ -0,0 +1,54 @@
+From 84fe8b5ef9cd365ee305e6a0de85741e36fc5f65 Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 18 Jan 2023 16:10:26 +0100
+Subject: [PATCH] deps(node-fetch-npm): backport CVE-2022-0235 fix
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ .../node_modules/node-fetch-npm/src/index.js  | 23 +++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/deps/npm/node_modules/node-fetch-npm/src/index.js b/deps/npm/node_modules/node-fetch-npm/src/index.js
+index b2cf80f..14ea47c 100644
+--- a/deps/npm/node_modules/node-fetch-npm/src/index.js
++++ b/deps/npm/node_modules/node-fetch-npm/src/index.js
+@@ -21,6 +21,21 @@ const getNodeRequestOptions = Request.getNodeRequestOptions
+ const FetchError = require('./fetch-error')
+ const isURL = /^https?:/
+ 
++/**
++ * isDomainOrSubdomain reports whether sub is a subdomain (or exact match) of
++ * the parent domain.
++ *
++ * Both domains must already be in canonical form.
++ */
++const isDomainOrSubdomain = (destination, original) => {
++  const orig = original.hostname;
++  const dest = destination.hostname;
++
++  return orig === dest || (
++    orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest)
++  );
++};
++
+ /**
+  * Fetch function
+  *
+@@ -97,8 +112,12 @@ function fetch (uri, opts) {
+         } else {
+           redirectURL = url.parse(res.headers.location)
+         }
+-        if (url.parse(request.url).hostname !== redirectURL.hostname) {
+-          request.headers.delete('authorization')
++
++        // CVE-2022-0235
++        if (!isDomainOrSubdomain(url.parse(request.url), redirectURL)) {
++          for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
++            request.headers.delete(name)
++          }
+         }
+ 
+         // per fetch spec, for POST request with 301/302 response, or any request with 303 response, use GET when following redirect
+-- 
+2.39.0
+
diff --git a/SOURCES/deps-qs-parse-ignore-__proto__-keys.patch b/SOURCES/deps-qs-parse-ignore-__proto__-keys.patch
new file mode 100644
index 0000000..9155957
--- /dev/null
+++ b/SOURCES/deps-qs-parse-ignore-__proto__-keys.patch
@@ -0,0 +1,98 @@
+From f0ee81ba69c78dfb9d827eda45fd957b758ca9f2 Mon Sep 17 00:00:00 2001
+From: Jordan Harband <ljharb@gmail.com>
+Date: Mon, 27 Dec 2021 19:15:57 -0800
+Subject: [PATCH] `parse`: ignore `__proto__` keys (#428)
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ deps/npm/node_modules/qs/lib/parse.js  |  2 +-
+ deps/npm/node_modules/qs/test/parse.js | 60 ++++++++++++++++++++++++++
+ 2 files changed, 61 insertions(+), 1 deletion(-)
+
+diff --git a/deps/npm/node_modules/qs/lib/parse.js b/deps/npm/node_modules/qs/lib/parse.js
+index 8c9872e..08e623a 100644
+--- a/deps/npm/node_modules/qs/lib/parse.js
++++ b/deps/npm/node_modules/qs/lib/parse.js
+@@ -69,7 +69,7 @@ var parseObject = function (chain, val, options) {
+             ) {
+                 obj = [];
+                 obj[index] = leaf;
+-            } else {
++            } else if (cleanRoot !== '__proto__') {
+                 obj[cleanRoot] = leaf;
+             }
+         }
+diff --git a/deps/npm/node_modules/qs/test/parse.js b/deps/npm/node_modules/qs/test/parse.js
+index 0f8fe45..3e93784 100644
+--- a/deps/npm/node_modules/qs/test/parse.js
++++ b/deps/npm/node_modules/qs/test/parse.js
+@@ -515,6 +515,66 @@ test('parse()', function (t) {
+         st.end();
+     });
+ 
++    t.test('dunder proto is ignored', function (st) {
++        var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
++        var result = qs.parse(payload, { allowPrototypes: true });
++
++        st.deepEqual(
++            result,
++            {
++                categories: {
++                    length: '42'
++                }
++            },
++            'silent [[Prototype]] payload'
++        );
++
++        var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
++
++        st.deepEqual(
++            plainResult,
++            {
++                __proto__: null,
++                categories: {
++                    __proto__: null,
++                    length: '42'
++                }
++            },
++            'silent [[Prototype]] payload: plain objects'
++        );
++
++        var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
++
++        st.notOk(Array.isArray(query.categories), 'is not an array');
++        st.notOk(query.categories instanceof Array, 'is not instanceof an array');
++        st.deepEqual(query.categories, { some: { json: 'toInject' } });
++        st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
++
++        st.deepEqual(
++            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
++            {
++                foo: {
++                    bar: 'stuffs'
++                }
++            },
++            'hidden values'
++        );
++
++        st.deepEqual(
++            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
++            {
++                __proto__: null,
++                foo: {
++                    __proto__: null,
++                    bar: 'stuffs'
++                }
++            },
++            'hidden values: plain objects'
++        );
++
++        st.end();
++    });
++
+     t.test('can return null objects', { skip: !Object.create }, function (st) {
+         var expected = Object.create(null);
+         expected.a = Object.create(null);
+-- 
+2.39.0
+
diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec
index 033010c..e2b47f0 100644
--- a/SPECS/nodejs.spec
+++ b/SPECS/nodejs.spec
@@ -22,11 +22,13 @@
 # feature releases that are only supported for nine months, which is shorter
 # than a Fedora release lifecycle.
 %global nodejs_major 14
-%global nodejs_minor 20
+%global nodejs_minor 21
 %global nodejs_patch 1
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 %global nodejs_version %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}
-%global nodejs_release 2
+%global nodejs_release 3
+
+%global nodejs_datadir %{_datarootdir}/nodejs
 
 # == Bundled Dependency Versions ==
 # v8 - from deps/v8/include/v8-version.h
@@ -62,6 +64,25 @@
 %global nghttp2_patch 0
 %global nghttp2_version %{nghttp2_major}.%{nghttp2_minor}.%{nghttp2_patch}
 
+# ICU – from tools/icu/current_ver.dep
+%global icu_major 70
+%global icu_minor 1
+%global icu_version %{icu_major}.%{icu_minor}
+
+%global icudatadir %{nodejs_datadir}/icudata
+%{!?little_endian: %global little_endian %(%{__python3} -c "import sys;print(0 if sys.byteorder=='big' else 1)")}
+# " this line just fixes syntax highlighting for vim that is confused by the above and continues literal
+
+%global sys_icu_version %(/usr/bin/icu-config --version)
+
+%if "%{sys_icu_version}" >= "%{icu_version}"
+%global bundled_icu 0
+%global icu_flag system-icu
+%else
+%global bundled_icu 1
+%global icu_flag full-icu
+%endif
+
 # punycode - from lib/punycode.js
 %global punycode_major 2
 %global punycode_minor 1
@@ -121,6 +142,21 @@ Source100: %{pkg_name}-tarball.sh
 # between OpenSSL versions
 Source1: https://github.com/sclorg/node-ssl-shim/archive/70e39fdc1db4525191acc765f9d524ddb58a1756/node-ssl-shim-70e39fd.tar.gz
 
+Source2: btest402.js
+Source3: https://github.com/unicode-org/icu/releases/download/release-%{icu_major}-%{icu_minor}/icu4c-%{icu_major}_%{icu_minor}-src.tgz
+
+# These are full sources for dependencies included as WASM blobs in the source of Node itself.
+# Note: These sources would also include pre-compiled WASM blobs… so they are adjusted not to.
+# Recipes for creating these blobs are included in the sources.
+
+# Version: jq '.version' deps/cjs-module-lexer/package.json
+# Original: https://github.com/nodejs/cjs-module-lexer/archive/refs/tags/1.2.2.tar.gz
+# Adjustments: rm -f cjs-module-lexer-1.2.2/lib/lexer.wasm
+Source101: cjs-module-lexer-1.2.2.tar.gz
+# The WASM blob was made using wasi-sdk v11; compiler libraries are linked in.
+# Version source: Makefile
+Source102: https://github.com/WebAssembly/wasi-sdk/archive/wasi-sdk-11/wasi-sdk-wasi-sdk-11.tar.gz
+
 # Patches for making nodejs compatible with older openssl
 # Squashed and exported from https://gitlab.cee.redhat.com/nodejs/node
 # – please submit changes to the appropriate branch there (redhat/%%{version}).
@@ -139,6 +175,9 @@ Patch11: Make-icutrim.py-Python-2-compatible.patch
 
 # Address various CVEs in bundled deps
 Patch21: deps-ansi-regex-fix-potential-ReDoS.patch
+Patch22: deps-node-fetch-npm-backport-CVE-2022-0235-fix.patch
+Patch23: deps-qs-parse-ignore-__proto__-keys.patch
+Patch24: deps-minimist-improve-redos-protection.patch
 
 
 %{?scl:Requires: %{scl}-runtime}
@@ -212,6 +251,11 @@ Provides: bundled(%{?scl_prefix}nghttp2) = %{nghttp2_version}
 # Bundle zlib on RHEL7, as the system version is too old
 Provides: bundled(%{?scl_prefix}zlib) = %{zlib_version}
 
+# Bundle icu if not using the system one
+%if "%{icu_flag}" != "system-icu"
+Provides: bundled(%{?scl_prefix}icu) = %{icu_version}
+%endif
+
 # Bundle uvwasi, since it is not available on RHEL7
 Provides: bundled(%{?scl_prefix}uvwasi) = %{uvwasi_version}
 
@@ -245,6 +289,15 @@ Requires: %{?scl_prefix}http-parser-devel%{?_isa}
 Development headers for the Node.js JavaScript runtime.
 
 
+%package full-i18n
+Summary: Non-English locale data for Node.js
+Requires: %{name}%{?_isa} = %{nodejs_version}-%{nodejs_release}%{?dist}
+
+%description full-i18n
+Optional data files to provide full-icu support for Node.js. Remove this
+package to save space if non-English locales are not needed.
+
+
 %package -n %{?scl_prefix}npm
 Summary: Node.js Package Manager
 Version: %{npm_version}
@@ -308,7 +361,8 @@ export CFLAGS="%{optflags} ${extra_cflags[*]}" CXXFLAGS="%{optflags} ${extra_cfl
 # This is not autotools, even if it resembles it
 ./configure --prefix=%{_prefix} \
     %{?with_debug:--debug} \
-    --with-dtrace --with-intl=small-icu \
+    --with-dtrace \
+    --with-intl=%{icu_flag} --with-icu-default-data-dir=%{icudatadir} \
     --shared-openssl --openssl-use-def-ca-store --openssl-is-fips \
     --without-corepack \
     %{!?el7:--shared-zlib} \
@@ -316,6 +370,33 @@ export CFLAGS="%{optflags} ${extra_cflags[*]}" CXXFLAGS="%{optflags} ${extra_cfl
 
 %make_build %{!?with_parallel_build:-j1}
 
+# Extract the ICU data and convert it to the appropriate endianness
+pushd deps/
+tar -xzf '%{SOURCE3}'
+pushd icu/source
+
+mkdir -p converted
+
+%if 0%{?little_endian}
+# The little endian data file is included in the ICU sources
+install -Dpm0644 data/in/icudt%{icu_major}l.dat converted/
+%else
+# For the time being, we need to build ICU and use the included `icupkg` tool
+# to convert the little endian data file into a big-endian one.
+# At some point in the future, ICU releases will start including both data
+# files and we should switch to those.
+mkdir -p data/out/tmp
+
+%configure
+%make_build
+
+icu_root=$(pwd)
+LD_LIBRARY_PATH=./lib ./bin/icupkg -tb data/in/icudt%{icu_major}l.dat converted/icudt%{icu_major}b.dat
+%endif
+
+popd # icu/source
+popd # deps
+
 %{?scl:EOF}
 
 
@@ -382,6 +463,10 @@ do
   ln -s ../node_modules.bundled/$module %{buildroot}%{nodejs_sitelib}/npm/node_modules/$module
 done
 
+# Install the full-icu data files
+mkdir -p '%{buildroot}%{icudatadir}'
+install -Dpm0644 -t %{buildroot}%{icudatadir} deps/icu/source/converted/*
+
 
 %check
 %{?scl:scl enable %{scl} devtoolset-9 - << \EOF}
@@ -397,6 +482,9 @@ set -ex
 # Ensure we have npm and that the version matches
 NODE_PATH=%{buildroot}%{nodejs_sitelib} %{buildroot}/%{_bindir}/node -e "require('assert').equal(require('npm').version, '%{npm_version}')"
 
+# Make sure i18n support is working
+NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/node_modules/npm/node_modules LD_LIBRARY_PATH=%{buildroot}%{_libdir} %{buildroot}/%{_bindir}/node --icu-data-dir=%{buildroot}%{icudatadir} %{SOURCE2}
+
 # Only run suites that we are expected to pass
 RUN_SUITES=(
     abort
@@ -434,6 +522,10 @@ python2 tools/test.py "${RUN_SUITES[@]}" || :  # FIXME – disable all failing t
 %{_datadir}/node/common.gypi
 %{_pkgdocdir}/gdbinit
 
+%files full-i18n
+%dir %{icudatadir}
+%{icudatadir}/icudt%{icu_major}*.dat
+
 %files -n %{?scl_prefix}npm
 %{_bindir}/npm
 %{_bindir}/npx
@@ -467,6 +559,22 @@ python2 tools/test.py "${RUN_SUITES[@]}" || :  # FIXME – disable all failing t
 
 
 %changelog
+* Thu Jan 26 2023 Jan Staněk <jstanek@redhat.com> - 14.21.1-3
+- Properly apply upstream patch for CVE-2022-3517
+  Resolves: CVE-2022-3517
+
+* Tue Jan 10 2023 Jan Staněk <jstanek@redhat.com> - 14.21.1-2
+- Provide full-i18n subpackage
+  Resolves: rhbz#2009880
+- Properly backport CVE-2022-0235 fix
+  Resolves: CVE-2022-0235
+- Fix prototype poisoning in qs dependency
+  Resolves: CVE-2022-24999
+
+* Wed Nov 16 2022 Jan Staněk <jstanek@redhat.com> - 14.21.1-1
+- Rebase to version 14.21.1
+  Resolves: rhbz#2129806 CVE-2022-43548
+
 * Fri Oct 07 2022 Jan Staněk <jstanek@redhat.com> - 14.20.1-2
 - Record additional fixes included in current version
   Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824