Use it for the dbName, table, db, source and target options so they
all treat a missing or undefined value as the default. Also mark
ReadOptionalBool and ReadOptionalString as [[nodiscard]].
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67042
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Since chunked writes are coalesced while the message is corked,
write() decides backpressure from the byte length of the buffered
chunks and sets kNeedDrain. When uncork() flushes them, net.Socket
accounts string chunks in UTF-16 code units, so with multi-byte text it
can stay below its own highWaterMark. It then never needs to drain and
never emits 'drain'. If the flushed writes complete asynchronously, the
check at the end of uncork() also runs while bytes are still pending,
so the response stalls with writableNeedDrain === true and
writableLength === 0.
Re-check the drain condition once the flushed data has been written,
unless the message or its socket has been destroyed in the meantime.
Fixes: https://github.com/nodejs/node/issues/66781
Refs: https://github.com/nodejs/node/pull/64987
Assisted-by: AI coding agent
Signed-off-by: junyup0503 <97156898+junyup0503@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/66782
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
pipeTo defers each slow-path write to a microtask so it does not run
synchronously during enqueue(). A race allows the pipe to shut down and
release its writer after the write is scheduled but before it runs. The
deferred write then hits an ERR_INTERNAL_ASSERTION because
writer[[stream]] is undefined.
Skip the deferred write when shutdown has already started.
Fixes: https://github.com/nodejs/node/issues/63732
Signed-off-by: Qingyu Wang <wangqingyu.c0l1n@bytedance.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/63733
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
JSValueToSQLiteResult() passed the size_t length of returned
ArrayBuffers and ArrayBufferViews to sqlite3_result_blob(), which
takes an int. Buffers larger than INT_MAX bytes were narrowed,
yielding silently truncated blobs or bogus empty text values.
Use sqlite3_result_blob64() and sqlite3_result_text64(), matching
Statement::BindValue(), so oversized values are rejected with
SQLITE_TOOBIG.
Assisted-by: Claude Code
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67089
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
filterFile() reads #ownerDependencies with the dependency path, but
writes the set back keyed by the owner, so each call starts a fresh set
and overwrites the previous one. An owner keeps only the last
dependency registered for it.
unfilterFilesOwnedBy() walks that set to release an owner's
dependencies, so every other one stays in #filteredFiles and
#dependencyOwners. Under `node --test --watch` a restart re-reports the
modules the test still loads, which hides it for those, but a
dependency it stopped requiring is never reported again and keeps
re-running the test.
Read #ownerDependencies with the key it is written with, and collapse
the repeated #dependencyOwners lookup in the loop, which now runs once
per dependency rather than once per owner.
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66139
Refs: https://github.com/nodejs/node/pull/45214
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
When multiple callers issue dns.lookup() for the same (hostname, family,
hints, order) concurrently, only one getaddrinfo call is now dispatched
to the libuv threadpool. All callers share the result.
getaddrinfo is a blocking call that runs on the libuv threadpool (capped
at 4 threads by default, with a slow I/O concurrency limit of 2). When
DNS resolution is slow - e.g. ~10-20 s per call due to a misbehaving
resolver - identical requests queue behind each other, causing timeouts
that grow linearly with the number of concurrent callers:
Before: 100 parallel lookup('host') -> 50 batches × 10 s = 500+ s
After: 100 parallel lookup('host') -> 1 getaddrinfo call = ~10 s
This is particularly severe on WSL, where the DNS relay rewrites QNAMEs
in responses (appending the search domain), causing glibc to discard
them as non-matching and wait for a 5s timeout per retry.
The coalescing is keyed on (hostname, family, hints, order) so lookups
with different options still get separate getaddrinfo calls. Each
caller independently post-processes the shared raw result (applying the
'all' flag, constructing address objects, etc.).
Signed-off-by: Orgad Shaneh <orgad.shaneh@audiocodes.com>
Fixes: https://github.com/nodejs/node/issues/62503
PR-URL: https://github.com/nodejs/node/pull/62599
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Convert constructor arguments in Web IDL order before processing blob
parts, including inherited dictionary members and File.lastModified's
long long conversion.
Read buffer slots and copy bytes without invoking user getters, slice
methods, or species constructors. Treat detached parts as empty and
track Blob brands without invoking user getters or accepting proxies.
Keep rejecting bare SharedArrayBuffers and shared-memory views for
browser compatibility pending resolution of the union conversion rules.
Refs: https://github.com/whatwg/webidl/issues/1491
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66776
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: James M Snell <jasnell@gmail.com>
`response.createPushResponse()` wrapped the pushed stream in an
`Http2ServerResponse` without attaching an 'error' listener. Request
streams get one from `Http2ServerRequest`, but pushed streams have no
request, so a peer refusing the push with a non-clean RST_STREAM code
(e.g. REFUSED_STREAM) before the response finished emitted an unhandled
'error' on `response.stream` unless the application listened on it.
Attach `onStreamError` to the pushed stream before invoking the
callback, and make `onStreamError` tolerate the `null` request that
core sets on every stream.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/67053
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Check that HMAC instances duplicated from the same cached context stay
independent when their updates are interleaved, and that warmed digest
and HMAC caches follow FIPS mode changes without breaking an HMAC that
is already in progress.
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
Assisted-by: Grok
PR-URL: https://github.com/nodejs/node/pull/67109
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Explicit DH parameters are recognized as named groups during OpenSSL
provider import, but DHPointer::check() only skips primality checks for
groups constructed by name. This makes createDiffieHellman() block for
seconds on standard MODP groups.
Query the imported key's group name to restore the legacy DH_check()
shortcut without changing key generation. Add a deterministic regression
test with randomness disabled and cover explicit and padded parameters
through the JavaScript API.
Fixes: https://github.com/nodejs/node/issues/67067
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/67071
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Expose version, subjectName, issuerName, extensions, tbs, and signature
without requiring callers to parse display strings or certificate DER.
Names include complete DER and grouped, ordered RDN attributes.
Extensions retain their order, duplicate and unknown OIDs, criticality,
and raw values. Expose the exact signed TBSCertificate bytes and the
signature octets, algorithm OID, and DER parameters.
Return fresh objects, arrays, and Buffers from the new getters, leaving
existing getter caching unchanged. Report inspection failures as
ERR_CRYPTO_INVALID_X509_CERTIFICATE.
Fixes: https://github.com/nodejs/node/issues/48730
Assisted-by: Codex
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67082
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
v8.serialize() currently rejects X509Certificate objects. Add a host
object encoding containing the certificate's DER snapshot, including
its issuerCertificate chain, and reconstruct fresh X509Certificate
objects in v8.deserialize().
Read the stored snapshot rather than the cached raw Buffer, which can
be modified by callers. Decode each certificate independently without
imposing issuer relationships on the serialized sequence.
Assisted-by: Codex
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67083
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
amaro 1.3.0 turned dist/index.js into a thin wrapper that requires
./internal.js, where the implementation now lives. Register and
require internal.js as the built-in instead of index.js, which would
otherwise fail to resolve its sibling.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
PR-URL: https://github.com/nodejs/node/pull/66144
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
fs.watchFile() on a path served by a real-directory mount dispatches
to RealFSProvider.watchFile(), which ignored the supplied listener and
registered an empty function instead. The user callback never fired
after the file changed, and fs.unwatchFile(path, listener) could not
match the anonymous stub, so the stat watcher's poll timer stayed
registered and kept the process alive.
Accept the listener and pass it through to fs.watchFile() so the
callback fires on change and unwatchFile() removes it by identity.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: opencode
PR-URL: https://github.com/nodejs/node/pull/66224
Fixes: https://github.com/nodejs/node/issues/66223
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
WritableStreamDefaultControllerProcessClose clears the controller
algorithms while the stream is still 'writable', before the sink close
settles. A write in that window, such as writer.write() after
writer.close() while the sink's close() or a TransformStream's flush()
is pending, reached the cleared size algorithm and failed an internal
assertion instead of being rejected as closing. Accept that state in
writableStreamDefaultControllerGetChunkSize so the write is rejected
with a TypeError, as it is once the stream has closed.
Refs: https://github.com/nodejs/node/issues/57272
Refs: https://github.com/whatwg/streams/issues/1341
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/67058
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Writable.fromWeb() and Duplex.fromWeb() dispatch writes to the
WritableStream directly and complete them through a shared write
tracker. A write issued before the WritableStream had started was
queued and processed from its start step, so the sink ran in the async
context of the code that created the WritableStream, and the tracker
invoked the Node.js write callback synchronously from whatever context
completed the sink write, so the writes and final() it released ran
there too. The promise-based adapter waited for writer.ready and
received the result through a reaction, both in the context of the
Node.js write.
Dispatch writes issued before the start from a writer.ready reaction,
failing them if the stream was closed or errored meanwhile, and deliver
the write callback in the context of the Node.js write, from a reaction
when it completes in another context.
Refs: https://github.com/nodejs/node/issues/66906
Refs: https://github.com/nodejs/node/pull/65548
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/67055
Refs: https://github.com/nodejs/node/pull/67052
Refs: https://github.com/nodejs/node/pull/67054
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
OpenSSL 3 builds its table of algorithm names on first use. When
43d3fe9558 moved that first use after other threads had started, an
RSA-PSS key decoded while the table was being built could fail with
`ERR_OSSL_EVP_DECODE_ERROR`, and every later RSA-PSS decode in the
process failed too. #66903 reverted that change.
The new test fails if it comes back: Workers decode an RSA-PSS
certificate while the root certificate loader or a thread pool crypto
job uses OpenSSL for the first time. It is based on a reproduction by
Filip Skokan in #66903.
Refs: https://github.com/nodejs/node/pull/66903
Refs: https://github.com/nodejs/node/pull/66935
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66966
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Replace the test-only hooks on the crypto binding, and the process-wide
list and mutex they required on every handshake, with a fixture CA
whose public key is a permanent entry on the compiled-in blocklist. The
test now exercises the real list through full handshakes, without
--expose-internals, and the production path is a comparison against a
constant array.
The new fixtures provide two chains that contain the blocked key: a
server certificate issued by blocked-ca, and one issued by ca1 that
reuses the blocked key itself. The private key is checked in like every
other fixture key, so blocking it costs nothing. It is pinned in the
fixtures Makefile, since its digest is compiled in.
Refs: https://github.com/nodejs/node/pull/66871#discussion_r4325672378
Assisted-by: Claude, Codex
Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66949
Reviewed-By: Tim Perry <pimterry@gmail.com>
`ReadFileUtf8()` appends reads shorter than 8 KiB to a string and only
moves to a heap buffer at the first full 8 KiB read. That buffer always
started at 64 KiB, but a pipe can deliver more than that in short reads
first, so copying the string into it overflowed the heap. With
`big_len` past `big_cap`, the next read size also underflowed.
Size the heap buffer to at least what was already read. When that is
more than 64 KiB, the buffer is full and the existing growth step
enlarges it before the next read.
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66939
Fixes: https://github.com/nodejs/node/issues/66341
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
The ClosedPromiseHook records that pipeTo() and tee() install as the
[[closedPromise]] of their reader and writer enqueued the watcher from
whoever settled the record. The source-closed, source-errored and
dest-errored steps of pipeTo() therefore ran in the async context of
the code that closed or errored the stream, so the destination's
close() and abort() and the source's cancel() observed the wrong
AsyncLocalStorage store. Capture the async context frame when the
hook is installed and register the reaction in it, as the spec's
promise reaction would.
Add a test that records the context each underlying source, sink and
transformer callback observes across readable, writable, transform,
pipe and tee scenarios, so scheduling shortcuts that drop the context
are caught.
Refs: https://github.com/nodejs/node/issues/66906
Refs: https://github.com/nodejs/node/pull/66424
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/67052
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Guilherme Araújo