BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
44,857 Commits 266 Branches 972 Tags
17c0a610affc614eb4e98dffcc480680f162651d
Commit Graph
44857 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Antoine du Hamel 17c0a610af tools: fix parsing of commit trailers in lint-release-proposal GHA 
PR-URL: https://github.com/nodejs/node/pull/62077
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
 2026-05-11 15:01:40 +02:00
Antoine du Hamel 363f9a9d18 test: skip test-url on --shared-ada builds 
PR-URL: https://github.com/nodejs/node/pull/62019
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2026-05-11 15:01:12 +02:00
Weixie Cui cf39566277 src: fix flags argument offset in JSUdpWrap 
Signed-off-by: Weixie Cui <cuiweixie@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61948
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-05-11 14:58:12 +02:00
Antoine du Hamel 89ad7dc63b tools: enforce removal of lts-watch-* labels on release proposals 
PR-URL: https://github.com/nodejs/node/pull/61672
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
 2026-05-11 14:56:01 +02:00
René 447fb9a0b5 meta: persist sccache daemon until end of build workflows 
PR-URL: https://github.com/nodejs/node/pull/61639
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-05-11 14:54:44 +02:00
npm CLI robot d568a1bb53 deps: upgrade npm to 10.9.8 
PR-URL: https://github.com/nodejs/node/pull/62463
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-05-11 14:47:50 +02:00
semimikoh daaead342b test: simplify encodeInto large buffer regression test 
Drop the bounded subarray case, remove the unnecessary error code
check, and use a 2**31 byte Uint8Array directly instead of slicing
an offset subarray.

Signed-off-by: semimikoh <ejffjeosms@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62621
Fixes: https://github.com/nodejs/node/issues/62610
Refs: https://github.com/nodejs/node/pull/58070
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-05-11 14:46:04 +02:00
semimikoh 578a9a9230 src: clamp WriteUtf8 capacity to INT_MAX in EncodeInto 
In TextEncoder.encodeInto, the destination buffer's byte length is
read as a size_t but then implicitly narrowed to int when passed as
the capacity argument to v8::String::WriteUtf8. When the destination
view is larger than INT_MAX (2,147,483,647 bytes), the narrowing
conversion underflows to a negative value, V8 treats it as "no
capacity", and writes 0 bytes - returning { read: 0, written: 0 }
even though the buffer has plenty of room.

Clamp the capacity to INT_MAX before passing it to WriteUtf8. This
is sufficient because the source string in encodeInto is bounded in
practice and never requires more than INT_MAX bytes to encode; only
the destination view length can exceed INT_MAX.

This issue is already fixed on main and v24.x as a side effect of
PR #58070, which migrated to the non-deprecated WriteUtf8V2 method
whose capacity parameter is size_t. WriteUtf8V2 is not available in
v22.x's V8 version, so this minimal patch fixes only the EncodeInto
path instead of backporting the full migration.

Refs: https://github.com/nodejs/node/pull/58070
Fixes: https://github.com/nodejs/node/issues/62610
Signed-off-by: semimikoh <ejffjeosms@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62621
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-05-11 14:46:03 +02:00
Thibaud Michaud ec11f3c1d5 deps: V8: backport 85b390089e51 
Original commit message:

    [wasm][eh] Fix getArg() when exception has an S128

    We cannot read an S128 exception value from JS, but we can read a value
    at a higher index in the exception. So accept S128 values when we
    compute the encoded index.

    R=mliedtke@chromium.org

    Fixed: 403675482
    Change-Id: I7cc0238310863b6d579fcbe0a216ddce6f760c8b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6367014
    Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#99305}

Refs: https://github.com/v8/v8/commit/85b390089e51
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:23 +02:00
Thibaud Michaud 08609712ed deps: V8: backport 1b27e4674f11 
Original commit message:

    [wasm] Disallow v128 in exception handling JS API

    R=jkummerow@chromium.org

    Fixed: 395214627
    Change-Id: Ief84b0fd79a87e539dfbfed31d475926f0f0a288
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6249317
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#98608}

Refs: https://github.com/v8/v8/commit/1b27e4674f11
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:21 +02:00
Thibaud Michaud dcc60d5ab2 deps: V8: backport 9997fc013952 
Original commit message:

    [wasm][exnref] Use wasm_null for exnref

    A JS null caught in wasm as an exnref with catch_(all_)ref should be
    observably different from a null exnref: a JS null should behave like a
    regular JS exception with null as the externref package, while a null
    exnref is the actual null value for this type. In particular, a JS
    null exception can be rethrown while a null exnref cannot.
    Represent null exnrefs with wasm_null instead of JS null to avoid the
    confusion.

    R=jkummerow@chromium.org

    Fixed: 374790906
    Change-Id: If9f16a24407ee7d1399613255c3f14e0a6ebef9e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5953226
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96782}

Refs: https://github.com/v8/v8/commit/9997fc013952
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:19 +02:00
Clemens Backes 1d1f4451fb deps: V8: cherry-pick b96e40d5ac85 
Original commit message:

    [wasm][js-api] Fix exception handling in Exception

    Calling `Get` on the third argument can throw. If so, return
    immediately.

    R=thibaudm@chromium.org

    Fixed: 372993873
    Change-Id: I70ec0d0421833a60151f6bcdc9c386f6ad864256
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5937803
    Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96627}

Refs: https://github.com/v8/v8/commit/b96e40d5ac85272cd08d3adc0dc98b9ddbe1249a
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:18 +02:00
Thibaud Michaud 2268567237 deps: V8: cherry-pick 7cb6188cf913 
Original commit message:

    [wasm][exnref] Accept non-nullable exn catch type

    R=jkummerow@chromium.org

    Fixed: 373681572
    Change-Id: Iecfc86d2ce6592a6f442bc3504ddde58ff236f64
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5938956
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96637}

Refs: https://github.com/v8/v8/commit/7cb6188cf9132d43e6c631befb0584a47a0e7d69
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:16 +02:00
Thibaud Michaud 92804cdbea deps: V8: cherry-pick e7ccf0af1bdd 
Original commit message:

    [wasm] Fix default externref/exnref reference

    - The default nullexternref should be null instead of undefined
    - The default exnref/nullexnref should be null instead of wasm_null

    R=mliedtke@chromium.org

    Fixed: 372285204,372269618
    Change-Id: Id5addce2b196f7ba81aac3c2dd9447a91ed2ce2b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5922878
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96531}

Refs: https://github.com/v8/v8/commit/e7ccf0af1bdddd20dc58e1790a94739dba0209a3
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:15 +02:00
Thibaud Michaud eae2c27a40 deps: V8: cherry-pick 8e214ec3ec8c 
Original commit message:

    [wasm][exnref] Fix catchless try_table

    If the try_table does not have a catch handler, we don't update the
    {current_catch_} index or set the {previous_catch} field of the block
    when we enter it. Therefore also skip the reverse operation when the
    block ends.

    R=clemensb@chromium.org

    Fixed: 372261626
    Change-Id: Ib3a23e32f9d0ec153d6a00733d96b52cf040e8bd
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5920086
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96481}

Refs: https://github.com/v8/v8/commit/8e214ec3ec8cdbdb7f34433a48a52420dee19ba6
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:13 +02:00
Thibaud Michaud a1799a49bb deps: V8: backport 63b8849d73ae 
Original commit message:

    [wasm][exnref] Reject non-nullable exnref in JS import/export

    R=jkummerow@chromium.org

    Change-Id: I0ba2deb1a9671d87e76fea7bfe76df9eee56442a
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5920338
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96489}

Refs: https://github.com/v8/v8/commit/63b8849d73ae
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:12 +02:00
Thibaud Michaud a2df2d8731 deps: V8: backport 323942700cfe 
Original commit message:

    [wasm][exnref] Accept exnref subtypes for throw_ref

    Only accepting a strict exnref type was incorrect in two cases:
    - the stack-polymorphic case, with the bottom type
    - a noexn param

    R=jkummerow@chromium.org

    Fixed: 332931390
    Change-Id: I80c96a7026f2469e6a3ce54344c2d5e617b78be7
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5904414
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#96387}

Refs: https://github.com/v8/v8/commit/323942700cfe
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:11 +02:00
Thibaud Michaud e3d65c7dca deps: V8: backport 89dc6eab605c 
Original commit message:

    [wasm] Add missing type canonicalization for exceptions JS API

    When we encode a JS value in a wasm exception, canonicalize the type
    stored in the tag's signature first. Canonicalize it using the tag's
    original module by storing the instance on the tag object.

    R=jkummerow@chromium.org

    Bug: 346197738
    Change-Id: I7575fd79c792d98e4a11c00b466700f0ab82d164
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5613375
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#94335}

Refs: https://github.com/v8/v8/commit/89dc6eab605c
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:09 +02:00
Jakob Kummerow 5e7db133de deps: V8: backport 910cb91733dc 
Original commit message:

    [wasm][liftoff][arm64] Fix DropExceptionValueAtOffset

    We cannot exit the iteration early, we must update all entries
    in the cache state.

    Fixed: 343748812
    Change-Id: I8353acb7bd0edc4b979db92e44d24cb9028fd92b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5596273
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#94244}

Refs: https://github.com/v8/v8/commit/910cb91733dc
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:08 +02:00
Thibaud Michaud d0c24a28af deps: V8: cherry-pick b8f91e510e0f 
Original commit message:

    [wasm][exnref] Update WA.JSTag semantics

    According to the last spec updates:
    - Passing WebAssembly.JSTag to the WebAssembly.Exception constructor is
      not allowed in JS,
    - Throwing an exception with the JSTag in wasm is allowed, but the
      exception should conceptually be "unwrapped" when it exits wasm, and
      JS should observe the raw externref. Instead, we simply throw the
      externref in this case, which has the same observable behavior and is
      consistent with how JSTag has been implemented so far.

    R=ahaas@chromium.org

    Bug: 333067164
    Change-Id: I6f43df8d254dd7450137d99ff7cc9cbffb697663
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5454404
    Reviewed-by: Andreas Haas <ahaas@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#93398}

Refs: https://github.com/v8/v8/commit/b8f91e510e0f46985b72c7f9afcb0e7fc0659112
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:07 +02:00
Thibaud Michaud d358687824 deps: V8: cherry-pick cf03d55db2a0 
Original commit message:

    [wasm][exnref] Fix default value for null exnref

    R=manoskouk@chromium.org

    Bug: 332081797
    Change-Id: Ied777935946c880a78e2011040a4d9ab19a4ddd2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5444544
    Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#93310}

Refs: https://github.com/v8/v8/commit/cf03d55db2a0b7c5ff62e08ff5ad52312f6da0b4
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:05 +02:00
Sébastien Doeraene 67c8b2c349 deps: V8: cherry-pick 692f3d526a38 
Original commit message:

    [wasm][exnref] Implement special behavior of WA.JSTag in try_table.

    This commit ports the changes from 4e79015dc28659a8a031f06580e902720b35674c
    to `CatchCase`, i.e., the `try_table` instruction. In addition, it
    implements the same changes in Turboshaft, for which the implementation
    of exceptions initially came from 2c1c14d30c61fa4fa19184369e587cb663bd8580
    and already contained the `JSTag` handling for `CatchException`.

    This commit addresses part of https://issues.chromium.org/issues/333067164
    but not all. Only catching with `try_table` is fixed. `throw` remains
    unchanged.

    Change-Id: I7bad031e28eaf609fb12e7706d0b6a7cc63fa09d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5435077
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#93303}

Refs: https://github.com/v8/v8/commit/692f3d526a382b3c2f1d979105e777df16855e84
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:04 +02:00
Manos Koukoutos 71e5a59ffd deps: V8: cherry-pick c734674e03f9 
Original commit message:

    [wasm][exnref] Fix null value for constant expressions

    Bug: v8:14398
    Change-Id: Ia00d2de97a897d608d6c043b6e267c7d6313a18b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5402583
    Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#93107}

Refs: https://github.com/v8/v8/commit/c734674e03f9d065312c77016dc61bf046692429
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:02 +02:00
Thibaud Michaud f0dbe81c7b deps: V8: cherry-pick b2f3aea23a01 
Original commit message:

    [wasm][exnref] Do not allow exnref at the wasm/JS boundary

    R=mliedtke@chromium.org

    Bug: v8:14398
    Change-Id: I5bb75a83e9de9f838d8e530c77c89aa031f473f9
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5381603
    Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#92944}

Refs: https://github.com/v8/v8/commit/b2f3aea23a015430f02b5241fa9897f8088d9aa7
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:43:01 +02:00
Matthias Liedtke d333f480c3 deps: V8: cherry-pick 5f1342c20b59 
Original commit message:

    [wasm][exnref] Fix broken abstract casts

    ref.test, ref.cast, br_on_cast, br_on_cast_fail allow arbitrary heap
    types, so they also allow exnref and noexnref.

    This CL also fixes the missing type checks in the js to wasm wrapper.

    Bug: v8:14398
    Change-Id: Ieefb9a8e99d3d7a4b175db60f55b7fa9a96c5203
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5372489
    Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
    Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#92867}

Refs: https://github.com/v8/v8/commit/5f1342c20b5932c170c4c113dd4e78f6e25fdad3
PR-URL: https://github.com/nodejs/node/pull/62783
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-05-11 14:42:59 +02:00
Mike McCready 005508d509 doc: remove obsolete Boxstarter automated install 
PR-URL: https://github.com/nodejs/node/pull/61785
Backport-PR-URL: https://github.com/nodejs/node/pull/63190
Fixes: https://github.com/nodejs/node/issues/61690
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
 2026-05-11 14:37:17 +02:00
Richard Lau 5f9bb8ef0c tools: revert tools GHA workflow to ubuntu-latest 
The update script for undici requires Docker, which is not available
on `ubuntu-slim`.

PR-URL: https://github.com/nodejs/node/pull/62024
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
 2026-05-04 09:46:41 +02:00
Matteo Collina db722725bb deps: use npm undici@six tag in update-undici.sh 
Node.js 22 is using Undici 6 rather than the latest version.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/63012
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-05-04 09:42:33 +02:00
Joyee Cheung 5065a0acb3 module: do not invoke resolve hooks twice for imported cjs 
Previously the resolve hook can be invoked twice from the
synthetic module evaluation step of imported CJS in the extra
module._load() call that's invoked on the resolved full path.
Add an option to avoid it, since the resolution and loading
has already been done before.

PR-URL: https://github.com/nodejs/node/pull/61529
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Fixes: https://github.com/nodejs/node/issues/57125
Refs: https://github.com/nodejs/node/issues/55808
Refs: https://github.com/nodejs/node/issues/56241
Reviewed-By: Jacob Smith <jacob@frende.me>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:26 +02:00
Joyee Cheung 9a2e21305d module: do not wrap module._load when tracing is not enabled 
This prevents clobbering the stack traces with another internal
frame and removes the unnecessary hoops from step-debugging.

PR-URL: https://github.com/nodejs/node/pull/61479
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:23 +02:00
Joyee Cheung b9240bc063 module: fix sync resolve hooks for require with node: prefixes 
Previously, when require()-ing builtins with the node: prefix,
the sync resolve hooks were not properly invoked, and load hooks
could not override the builtin's format. This fixes the
handling and enables redirecting prefixed built-ins to on-disk
files and overriding them with other module types via hooks.

PR-URL: https://github.com/nodejs/node/pull/61088
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Fixes: https://github.com/nodejs/node/issues/60005
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:21 +02:00
Joyee Cheung 2e91b28aaf module: handle null source from async loader hooks in sync hooks 
This relaxes the validation in sync hooks so that it accepts
the quirky nullish source returned by the default step of the
async loader when the module being loaded is CommonJS.
When there are no customization hooks registered, a saner
synchronous default load step is used to use a property
instead of a reset nullish source to signify that the module
should go through the CJS monkey patching routes and reduce
excessive reloading from disk.

PR-URL: https://github.com/nodejs/node/pull/59929
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Fixes: https://github.com/nodejs/node/issues/59384
Fixes: https://github.com/nodejs/node/issues/57327
Refs: https://github.com/nodejs/node/issues/59666
Refs: https://github.com/dygabo/load_module_test
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:19 +02:00
Marco Ippolito 39147c154e module: use sync cjs when importing cts 
PR-URL: https://github.com/nodejs/node/pull/60072
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Fixes: https://github.com/nodejs/node/issues/59963
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:16 +02:00
Joyee Cheung 12a2462b2c module: only put directly require-d ESM into require.cache 
This reduces the impact of
https://redirect.github.com/nodejs/node/pull/59679
by delaying the require.cache population of ESM until they
are directly required. After that, it's necessary for them
to be in the cache to maintain correctness.

PR-URL: https://github.com/nodejs/node/pull/59874
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Refs: https://github.com/nodejs/node/issues/59868
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:12 +02:00
Joyee Cheung 1769d74613 esm: populate separate cache for require(esm) in imported CJS 
Otherwise if the ESM happens to be cached separately by the ESM loader
before it gets loaded with `require(esm)` from within an imported
CJS file (which uses a re-invented require() with a couple of quirks,
including a separate cache), it won't be able to load the esm properly
from the cache.

PR-URL: https://github.com/nodejs/node/pull/59679
Backport-PR-URL: https://github.com/nodejs/node/pull/62029
Refs: https://github.com/nodejs/node/issues/59666
Refs: https://github.com/nodejs/node/issues/52697
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Fixes: https://github.com/nodejs/node/issues/61801
 2026-04-27 18:03:09 +02:00
RafaelGSS dbabdf751c Working on v22.22.3 
PR-URL: https://github.com/nodejs-private/node-private/pull/844
 2026-03-24 17:05:48 -03:00
Antoine du Hamel 2645dc7372 2026-03-24, Version 22.22.2 'Jod' (LTS) 
This is a security release.

Notable changes:

build,test,deps:
  * (CVE-2026-21717) test array index hash collision
crypto:
  * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC
http:
  * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
  * (CVE-2026-21716) include permission check on lib/fs/promises
  * (CVE-2026-21715) add permission check to realpath.native
src:
  * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
tls:
  * (CVE-2026-21637) wrap SNICallback invocation in try/catch

PR-URL: https://github.com/nodejs-private/node-private/pull/844
v22.22.2 		2026-03-23 20:13:40 +01:00
Joyee Cheung 30a3ab11e2 deps: V8: cherry-pick aac14dd95e5b 
Original commit message:

    [string] add 3rd round to seeded array index hash

    Since we already have 3 derived secrets, and arithmetics are
    relatively cheap, add a 3rd round to the xorshift-multiply
    seeding scheme. This brings the bias from ~3.4 to ~0.4.

    Bug: 477515021
    Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117
    Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105824}

Refs: https://github.com/v8/v8/commit/aac14dd95e5be0d487eba6bcdaf9cef4f8bd806c
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-23 20:06:35 +01:00
Joyee Cheung 6f14ee5101 build,test: test array index hash collision 
This enables v8_enable_seeded_array_index_hash and add a test for it.

Fixes: https://hackerone.com/reports/3511792
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-23 20:06:35 +01:00
Joyee CheungandJoyee Cheung e3f4d6a42e deps: V8: backport 1361b2a49d02 
Original commit message:

    [strings] improve array index hash distribution

    Previously, the hashes stored in a Name's raw_hash_field for decimal
    numeric strings (potential array indices) consist of the literal
    integer value along with the length of the string. This means
    consecutive numeric strings can have consecutive hash values, which
    can lead to O(n^2) probing for insertion in the worst case when e.g.
    a non-numeric string happen to land in the these buckets.

    This patch adds a build-time flag v8_enable_seeded_array_index_hash that
    scrambles the 24-bit array-index value stored in a Name's raw_hash_field
    to improve the distribution.

    x ^= x >> kShift; x = (x * m1) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m2) & kMask;    // round 2
    x ^= x >> kShift;                          // finalize

    To decode, apply the same steps with the modular inverses of m1 and m2
    in reverse order.

    x ^= x >> kShift; x = (x * m2_inv) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m1_inv) & kMask;    // round 2
    x ^= x >> kShift;                              // finalize

    where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask,
    m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv,
    m2_inv (modular inverses) are precomputed modular inverse of m1 and m2.
    The pre-computed values are appended to the hash_seed ByteArray in
    ReadOnlyRoots and accessed in generated code to reduce overhead.
    In call sites that don't already have access to the seeds, we read them
    from the current isolate group/isolate's read only roots.

    To consolidate the code that encode/decode these hashes, this patch
    adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA
    that perform seeding/unseeding if enabled, and updates places where
    encoding/decoding of array index is needed to use them.

    Bug: 477515021
    Change-Id: I350afe511951a54c4378396538152cc56565fd55
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105596}

Refs: https://github.com/v8/v8/commit/1361b2a49d020a718dc5495713eae0fa67d697b9
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-22 17:04:57 +01:00
Joyee CheungandJoyee Cheung 7dc00fa5f4 deps: V8: backport 185f0fe09b72 
Original commit message:

    [numbers] Refactor HashSeed as a lightweight view over ByteArray

    Instead of copying the seed and secrets into a struct with value
    fields, HashSeed now stores a pointer pointing either into the
    read-only ByteArray, or the static default seed for off-heap
    HashSeed::Default() calls. The underlying storage is always
    8-byte aligned so we can cast it directly into a struct.

    Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105531}

Refs: https://github.com/v8/v8/commit/185f0fe09b72fb869fdcf9a89f40ff2295436bca
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-22 17:04:56 +01:00
snekandJoyee Cheung 076acd052d deps: V8: backport 0a8b1cdcc8b2 
Original commit message:

    implement rapidhash secret generation

    Bug: 409717082
    Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: snek <snek@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#101499}

Refs: https://github.com/v8/v8/commit/0a8b1cdcc8b243c62cf045fa8beb50600e11758a
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-22 17:04:56 +01:00
RafaelGSS 06fc3436f6 permission: include permission check on lib/fs/promises 
PR-URL: https://github.com/nodejs-private/node-private/pull/795
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-21716
 2026-03-22 17:04:56 +01:00
RafaelGSS db48d9c675 permission: add permission check to realpath.native 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/794
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-21715
 2026-03-22 17:04:56 +01:00
RafaelGSS 2a6105a63b src: handle NGHTTP2_ERR_FLOW_CONTROL error code 
Refs: https://hackerone.com/reports/3531737
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/832
CVE-ID: CVE-2026-21714
 2026-03-22 17:04:56 +01:00
Filip Skokan 52a52ef619 crypto: use timing-safe comparison in Web Cryptography HMAC 
Use `CRYPTO_memcmp` instead of `memcmp` in `HMAC`
Web Cryptography algorithm implementations.

Ref: https://hackerone.com/reports/3533945
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/830
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/822
CVE-ID: CVE-2026-21713
 2026-03-22 17:04:56 +01:00
Matteo Collina 91b970886f tls: wrap SNICallback invocation in try/catch 
Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().

Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.

Fixes: https://hackerone.com/reports/3556769
Refs: https://hackerone.com/reports/3473882
CVE-ID: CVE-2026-21637

PR-URL: https://github.com/nodejs-private/node-private/pull/819
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21637
 2026-03-22 17:04:52 +01:00
Matteo Collina a2fe9fd81a http: use null prototype for headersDistinct/trailersDistinct 
Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.

A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.

Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710
 2026-03-22 16:28:36 +01:00
Richard Lau 963c60a951 deps: V8: override depot_tools version 
For compatibility with Python >= 3.12 we need a newer version of
`depot_tools` than is used for the older versions of V8.

PR-URL: https://github.com/nodejs/node/pull/62344
Refs: https://github.com/nodejs/build/pull/4278
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-03-22 13:05:19 +01:00
npm CLI robot a688117d5d deps: upgrade npm to 10.9.7 
PR-URL: https://github.com/nodejs/node/pull/62330
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-03-20 18:27:07 +01:00