BoringSSL declares EVP_CIPHER_do_all_sorted and
EVP_MD_do_all_sorted, but stock no-decrepit builds do not provide
those symbols. Add a Node build flag that keeps ncrypto and its
dependents on a local BoringSSL fallback list when libdecrepit is
absent.
Keep embedders that provide the EVP enumeration symbols on the normal
OpenSSL-compatible path, matching Electron's patched BoringSSL build.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63206
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
This uses the existing WebIDL infrastructure to handle the iteration
over the argument correctly according to the specification.
Note that we can't avoid looping over the input twice: we only know the
value of the 'endings' option after converting the blob parts into an
array.
PR-URL: https://github.com/nodejs/node/pull/62179
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
The test Blob-array-buffer.any.js can be flaky on
AIX due to a recognized race condition in v8.
The failed assert is in deps/v8/src/base/platform/platform-aix.cc
on line 199, preceeded by the comment:
> If this check fails it's most likely due to a racing condition
> where another thread has mapped the same address right before we
> do. Since this could cause hard-to-debug issues, potentially with
> security impact, and we can't recover from this, the best we can do
> is abort the process.
Disabling the test on AIX until the underlying issue can
be resolved (if it can be resolved at all) is really the
only option currently.
Reliability Report: https://github.com/nodejs/reliability/blob/main/reports/2026-03-28.md
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62470
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Implement QuotaExceededError as a DOMException-derived interface per the
WebIDL specification update.
QuotaExceededError is now a proper constructor exposed as a global
[Exposed=*] interface that extends DOMException with optional `quota`
and `requested` attributes (both nullable doubles, defaulting to null).
The constructor validates that quota and requested are finite,
non-negative, and that requested is not less than quota when both are
provided.
QuotaExceededError is [Serializable] and supports structuredClone,
preserving the quota and requested values across the serialization
boundary.
Callers updated:
- crypto.getRandomValues() now throws a QuotaExceededError instance
- WebStorage (C++) now constructs QuotaExceededError directly
Refs: https://redirect.github.com/whatwg/webidl/pull/1465
Fixes: https://github.com/nodejs/node/issues/58987
PR-URL: https://github.com/nodejs/node/pull/62293
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Convert brotli decompression errors to TypeError to match the
Compression Streams spec, by extending handleKnownInternalErrors()
in the adapters layer to recognize brotli error codes.
This replaces the manual error event handler on DecompressionStream
which was redundant with the adapter's built-in error propagation.
PR-URL: https://github.com/nodejs/node/pull/62107
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Pass rejectGarbageAfterEnd: true to createInflateRaw() and
createBrotliDecompress(), matching the behavior already in place
for deflate and gzip. The Compression Streams spec treats any
data following a valid compressed payload as an error.
When the underlying Node.js stream throws synchronously from
write() (e.g. zlib rejects an invalid chunk type), destroy the
stream so that the readable side is also errored. Without this,
the readable side hangs forever waiting for data that will never
arrive.
Introduce a kValidateChunk callback option in the webstreams
adapter layer. Compression streams use this to validate that
chunks are BufferSource instances not backed by SharedArrayBuffer,
replacing the previous monkey-patching of the underlying
handle's write method.
Unskip WPT compression bad-chunks tests which now run instead of
hang and mark the remaining expected failures.
PR-URL: https://github.com/nodejs/node/pull/62107
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
The WHATWG Streams spec requires that pipeTo's chunk handling must
queue a microtask before calling the write algorithm. This ensures
that enqueue() does not synchronously trigger writes.
Previously, PipeToReadableStreamReadRequest[kChunk] would synchronously
call writableStreamDefaultWriterWrite(), which violated the spec and
caused the WPT test "enqueue() must not synchronously call write
algorithm" to fail.
Fix by wrapping the write operation in queueMicrotask(), which defers
it to the next microtask as required by the spec.
Refs: https://github.com/whatwg/streams/issues/1243
PR-URL: https://github.com/nodejs/node/pull/61800
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Implements the WHATWG DOM specification for passive event listeners,
ensuring that calls to `preventDefault()` are correctly ignored within
a passive listener context.
An internal `kInPassiveListener` state is added to the Event object
to track when a passive listener is executing. The `preventDefault()`
method and the `returnValue` setter are modified to check this state,
as well as the event's `cancelable` property. This state is reliably
cleaned up within a `finally` block to prevent state pollution in
case a listener throws an error.
This resolves previously failing Web Platform Tests (WPT) in
`AddEventListenerOptions-passive.any.js`.
Refs: https://dom.spec.whatwg.org/#dom-event-preventdefault
PR-URL: https://github.com/nodejs/node/pull/59995
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Jeong SeokChan