V8 defaults `v8_enable_sandbox` to on whenever the shared pointer
compression cage and the external code space are enabled, and that is
the configuration embedders that use the sandbox build with. Now that
the sandbox builds and passes the tests, follow that default for
`--experimental-pointer-compression-shared-cage` so the configuration
is reachable from `configure`. Multi-cage pointer compression builds
stay without it: there every IsolateGroup gets its own sandbox, and
`NodeArrayBufferAllocator` always allocates from the default one.
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62237
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
A missing OPENSSL_VERSION_NUMBER macro raises TypeError while the
configure logic attempts to slice None. Treat that like the other
version detection failures so configure warns and records version 0.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64982
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
This separates the native crypto backend paths for OpenSSL >= 3,
BoringSSL, and legacy OpenSSL. The OpenSSL >= 3 path now builds with
`OPENSSL_API_COMPAT=30000` and `OPENSSL_NO_DEPRECATED`, moving normal
crypto/TLS code away from APIs that OpenSSL 3.0.0 marks deprecated.
BoringSSL remains on its own branch, and OpenSSL < 3 remains the legacy
fallback.
The exception is ENGINE support. ENGINE APIs are isolated into a
dedicated compatibility target so they can remain available while the
JS-facing engine APIs are runtime-deprecated in 27.x. That gives us a
clear removal point for 28.x, without letting ENGINE usage leak back
into the strict OpenSSL 3 path.
The split also makes the eventual OpenSSL 1.1.1 removal easier to reason
about. Once support for OpenSSL < 3 is dropped, the legacy branch can be
removed in a focused follow-up, possibly targeting 27.x, instead of
untangling mixed version guards throughout the crypto implementation.
No public crypto or TLS API behavior is intentionally changed.
Assisted-by: Codex:gpt-5
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/issues/56733
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
V8's Maglev compiler has supported riscv64 since V8 14.0 (with full
source files in deps/v8/src/maglev/riscv/), but Node.js never wired
it up:
- configure.py excluded riscv64 from maglev_enabled_architectures
- tools/v8_gypfiles/v8.gyp lacked GN-scraper conditions for riscv64
Maglev sources in both the v8_internal_headers and
v8_base_without_compiler blocks
This adds riscv64 to both, following the same pattern used for s390x
in #60863 and matching V8's own BUILD.gn which already lists riscv64
alongside arm, arm64, x64, s390x, and ppc64 as Maglev-enabled
architectures.
Refs: https://github.com/nodejs/build/issues/4099
Signed-off-by: Jamie Magee <jamie.magee@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62605
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Decided to take a short break from the work on QUIC
to implement a DTLS API. Very experimental at this
point but the basic API is there (inspired by the
QUIC API work).
The implementation is based on OpenSSL's built-in
DTLS support and no other dependencies are required.
DTLS is a datagram-based version of TLS that is used
for things like WebRTC and CoAP. It provides similar
security guarantees as TLS but is designed to work over
UDP instead of TCP.
This shouldn't be considered ready for production
but it is a good starting point for experimentation
and feedback.
```bash
./configure --experimental-dtls
make -j{nproc}
./node --experimental-dtls my-dtls-app.js
```
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/63182
Fixes: https://github.com/nodejs/node/issues/61630
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
When we build the macOS pkg, we build Node.js twice (on arm64):
- Once for arm64 (native)
- Once for x64, using a combination of Rosetta 2 and compiler flags
before combining both into a universal binary.
For the x64 case, pass target flag to `rustc` so that the binary is
built for the correct target architecture.
Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/63015
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Enabling Temporal support requires `cargo` and `rustc`, which are new
build toolchain requirements.
Add a `--v8-disable-temporal-support` option to `configure.py` to
explicitly opt-out of Temporal support (i.e. no need for Rust).
If the existing `--v8-enable-temporal-support` option is not explicitly
passed to `configure.py`:
- Attempt to detect `cargo` and `rustc`.
- If neither `cargo` and `rustc` are detected, print a warning and
disable Temporal support.
- If both `cargo` and `rustc` are detected, enable Temporal support.
If `--v8-enable-temporal-support` is passed to `configure.py`, then
the build will error and stop if `cargo` and/or `rustc` are not
detected.
To avoid ambiguity, `configure.py` will error and stop if both
`--v8-disable-temporal-support` and `--v8-enable-temporal-support` are
used.
Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/61806
Fixes: https://github.com/nodejs/node/issues/57127
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
When enabling support for Temporal, check for the `CARGO` environment
variable to locate the `cargo` binary (defaulting to `cargo` if not
set) and use this to build `deps/crates`.
This will allow using Cargo on systems where the Cargo binary name is
suffixed with the version, e.g. `cargo-1.82` on Ubuntu 24.04.
PR-URL: https://github.com/nodejs/node/pull/62421
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Build it with gdbjit support on supported platforms by default
allows debugging JIT-compiled code in gdb when it's also enabled
at run time (via --gdbjit). Simply building it in should not
incur an overhead if it's not also enabled at run time.
PR-URL: https://github.com/nodejs/node/pull/61010
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Instead of relying on a WASM build of postject to perform the
injection, add LIEF as dependency and generate the SEA directly
from core via a new CLI option --build-sea which takes the SEA
config. This simplifies SEA generation for users and makes it
easier to debug/maintain the SEA building process.
PR-URL: https://github.com/nodejs/node/pull/61167
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Move node:quic behind a compile-time flag, disabled by default.
Use --experimental-quic at configure time to enable.
- Add --experimental-quic flag to configure.py
- Add node_use_quic variable and HAVE_QUIC define
- Make QUIC sources conditional in node.gyp
- Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi
- Update C++ guards to check HAVE_QUIC
- Update process.features.quic to check node_use_quic
PR-URL: https://github.com/nodejs/node/pull/61444
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Chengzhong Wu