A portable compile cache is meant to be reused wherever the same module
layout is found, which includes being generated once (at build time,
say) and shipped read-only with an application for whoever runs it. On
platforms with uids the cache subdirectory is suffixed with the uid of
the user who created it, so such a cache is only ever found by that one
user. Omit the suffix in portable mode: a user who cannot write to the
directory still reads it, and a failed write is only a cache miss.
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65293
Reviewed-By: James M Snell <jasnell@gmail.com>
The example under "Setting security levels" does not run. The client
sets `maxVersion: 'TLSv1'` while its `minVersion` stays at the
`tls.DEFAULT_MIN_VERSION` default of `'TLSv1.2'`, so no version overlaps
and the connection fails with ERR_SSL_NO_PROTOCOLS_AVAILABLE. Setting
the client's `minVersion` is not enough on its own: the handshake then
fails with an alert 40, because `createServer` is given no key or
certificate and the server has no shared cipher.
Set `minVersion` on the client, add the key and certificate placeholders
and the openssl recipe that the other sections using them already carry,
pass the server certificate as the client's `ca`, and use port 8000 like
the rest of the file. The section now runs from an empty directory and
prints "Client connected with protocol: TLSv1".
Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65391
Fixes: https://github.com/nodejs/node/issues/60569
Refs: https://github.com/nodejs/node/pull/60571
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
An iterator can leave a statement active between sqlite3_step() calls.
Finalizing that statement from an authorizer callback can release its
locks and change the outcome of the statement being authorized.
Reject close() and Symbol.dispose when the statement is busy and the
connection is in an authorizer callback. Continue allowing idle
statements to be finalized.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: https://github.com/nodejs/node/pull/65369
Fixes: https://github.com/nodejs/node/issues/65368
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
An incoming stream was destroyed unless the session had an onstream
callback, even when session-level stream callbacks (onheaders et al)
were registered and the negotiated application (HTTP/3) would drive
the stream through them. Users had to register stub onstream handlers
just to keep their streams alive.
Destroy an incoming stream only when the session has no consumer for
it at all: no onstream callback, and no session-level stream callbacks
runnable on the negotiated application (checked via the existing
headersSupported session state, computed when the application is
selected from ALPN). Sessions with no consumers keep the current
destroy-and-warn behavior so unconsumed streams cannot accumulate and
hold flow control credit.
On HTTP/3 sessions only bidirectional request streams reach this path;
control and QPACK streams are consumed internally by nghttp3 and are
never exposed to JavaScript.
Fixes: https://github.com/nodejs/node/issues/64192
Signed-off-by: Naman Trivedi <trivenay@amazon.com>
PR-URL: https://github.com/nodejs/node/pull/65335
Fixes: https://github.com/nodejs/node/issues/64192
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
The file type of a directory entry returned by fs.readdir() or
fs.opendir() is the type reported by the operating system's directory
listing. Node.js falls back to lstat() only when the reported type is
unknown, and some file systems may report a type that differs from what
lstat() would return. Document this in the fs.Dirent class introduction,
with fs.lstat() as the accurate alternative.
Fixes: https://github.com/nodejs/node/issues/30646
Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64532
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Three entries in the fs documentation described their return
value only in prose, or not at all, so doc-kit could not parse
a return type and fell back to `void`:
* `filehandle[Symbol.asyncDispose]()` and
`dir[Symbol.asyncDispose]()` both return a promise, matching
the existing `Returns: {Promise}` annotations on other async
dispose methods.
* `new fs.Utf8Stream([options])` is a constructor and returns
an instance of the class.
Verified at runtime and by rendering the page locally with
doc-kit.
Refs: https://github.com/nodejs/doc-kit/issues/953
Signed-off-by: Chxxeton <43923165+Chxxeton@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/65307
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
SQLite requires that an authorizer callback not modify the connection
that invoked it, and counts sqlite3_prepare_v2() and sqlite3_step() as
modifications. node:sqlite let the callback call prepare(), exec(), the
statement execution methods, and other connection-mutating APIs on the
same DatabaseSync. Track authorizer depth on DatabaseSync with an RAII
guard around the callback and throw ERR_INVALID_STATE from the affected
entry points while it is on the stack. Covering every authorizer
invocation, including the re-prepare that SQLite can run during
sqlite3_step(), exposed a second and distinct hazard: reentering a
statement that is currently being stepped is a use-after-free rather
than a contract violation, since finalizing it frees the virtual machine
under sqlite3_step() and re-running it resets that machine
mid-execution. Any callback SQLite invokes during execution can reach
it, so a user-defined function is enough. Track the statements currently
being stepped and reject reentry into only those, which leaves a
user-defined function free to prepare, run, and finalize its own helper
statements.
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
Fixes: https://github.com/nodejs/node/issues/63207
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/65156
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Convert ZlibBase, Zlib, and the remaining zlib/Brotli stream
constructors to ES6 class syntax. Calling these constructors without
`new` is no longer supported (DEP0184 End-of-Life); use `new` or the
create* factory helpers instead.
This is a semver-major change: code that relied on `zlib.Gzip()`
(without `new`) will now throw TypeError. The createGzip/createDeflate
helpers and all documented `new`-based usage remain unchanged. The
wire behavior and public options are preserved.
Refs: https://github.com/nodejs/node/pull/55718
Refs: https://github.com/nodejs/node/pull/54708
Assisted-by: Grok
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: https://github.com/nodejs/node/pull/64849
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Two doc-only improvements to `doc/api/repl.md`, both filling gaps left
by recent semver-major REPL changes:
1. `repl.REPLServer` is an ES class; calling it without `new` is
End-of-Life (DEP0185) and throws a native V8 `TypeError`. The
"Class: REPLServer" section now notes this and links to the DEP0185
entry in `doc/api/deprecations.md`. No `Stability: 0` banner is
added because the class itself is not deprecated — only the
`new`-less invocation is — matching the parallel DEP0184/DEP0195
"classes without `new`" convention.
2. PR #64034 ("repl: use inspector over vm") removed the old
"Global uncaught exceptions" subsection because the `domain`-based
restrictions it documented no longer exist. A new top-level
`### Error handling` section documents the current model (mirroring
the `### Error handling` convention in async_hooks/http2/quic),
anchored to the existing `Uncaught Error: REPL await` example.
Refs: https://github.com/nodejs/node/pull/59495
Refs: https://github.com/nodejs/node/pull/54869
Refs: https://github.com/nodejs/node/pull/54842
Refs: https://github.com/nodejs/node/pull/64034
Signed-off-by: Adrian Estrada <edsadr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64993
Reviewed-By: Erick Wendel <erick.workspace@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Upgrades the experimental tag filter introduced by stage 1 to accept a
boolean expression instead of a literal tag name.
Grammar: `and`/`&&`, `or`/`||`, `not`/`!`, parentheses for grouping,
and `*` wildcards inside identifiers. Standard precedence
(`not > and > or`); binary operators are left-associative. Word forms
require whitespace separation; punctuation forms do not. Untagged
tests evaluate `false` for any include expression and `true` for
`not X`, so excluding tags does not accidentally remove untagged
tests.
The flag and `testTagFilters` option are still repeatable; multiple
expressions still AND together. Malformed expressions fail fast at
the parent process at startup.
Tag value validation tightens to reject whitespace, operator
characters (`& | ! ( ) *`), and the reserved words `and`/`or`/`not`
in any casing - a breaking change relative to the stage 1 ship,
acceptable at Stability 1.0 (Early development).
Signed-off-by: atlowChemi <chemi@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/63054
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Several improvements:
1. In histogram-inl, Add previous locked only this->mutex while
reading the other's fields unsafely.
2. In histogram.cc, PrepareCB now uses ContainerOf
3. In histogram.cc, BigInt value range is checked
4. In histogram.js, simplified impl and reduced duplication
5. In event_loop_delay.js, use a more consistent constructor
Adds new analytical APIs to Histogram
* histogram.ccdf(value)
* histogram.cdf(value)
* histogram.countAt(value)
* histogram.ksTest(other)
* histogram.kurtosis
* histogram.linearBuckets(stepSize)
* histogram.logBuckets(first, base)
* histogram.percentilesAt(percentiles)
* histogram.shewness
On RecordableHistogram
* histogram.recordCorrected(val, expectedInterval)
* histogram.subtract(other)
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus
PR-URL: https://github.com/nodejs/node/pull/65024
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Apply the same check to DatabaseSync::Prepare() so that statement-less
SQL is rejected at preparation instead of on first use. This matches
SQLite's own oo1 JavaScript API, which throws when the SQL contains no
statements rather than exposing the C API's null statement pointer.
Previously db.prepare('-- comment') returned a StatementSync whose
statement_ was null. Every method on it threw "statement has been
finalized", which was misleading because nothing had been finalized, and
the object was still inserted into statements_. Since IsFinalized() is
true for a null statement, its destructor skipped UntrackStatement() and
left a dangling pointer in the set that a later close() would finalize.
Refs: https://github.com/nodejs/node/pull/65157#discussion_r3742903347
Refs: https://sqlite.org/wasm/doc/trunk/api-oo1.md
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65157
Fixes: https://github.com/nodejs/node/issues/65149
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Promotes the diagnostics_channel.tracingChannel() factory and the
TracingChannel class from experimental to stable.
TracingChannel has been available since v18.19.0 / v19.9.0 with an
unchanged surface and now has broad adoption: fastify, pino, mysql2,
redis, ioredis, mongoose, graphql, h3, srvx, and the Vercel AI SDK
publish TracingChannel events natively, and it is consumed by
OpenTelemetry, Sentry, Datadog, and New Relic. The last behavioral
wart, tracePromise stripping custom thenables (#59936), was resolved
in #61766.
This mirrors the scoping in #45290: BoundedChannel, the bindStore /
runStores store helpers, and the concrete built-in channels stay
experimental.
Signed-off-by: Abdelrahman Awad <abdelrahman.awad@sentry.io>
PR-URL: https://github.com/nodejs/node/pull/64525
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
CreateFunction() ran on every getFunction() call, every getFunctions()
call, and every read of the functions accessor, each time emitting a
trampoline, allocating an FFIFunctionInfo, and on the SharedBuffer path
an ArrayBuffer. lib.functions.foo was therefore a different function on
each read, and calling through the accessor in a loop leaked a page per
iteration until GC: 20000 calls grew RSS by 58 MiB.
Cache the created callable per symbol in function_wrappers_, and
memoize the JS wrapper composed around it. Both entries are weak, so
dropping the last user reference still releases the wrapper and its
trampoline. The JS side stores a WeakRef because V8 can keep a raw
function alive after the wrapper is gone, and a strong value would pin
every wrapper for the lifetime of the library.
Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5
PR-URL: https://github.com/nodejs/node/pull/64971
Fixes: https://github.com/nodejs/node/issues/64970
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
이혜미