BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
45,088 Commits 266 Branches 972 Tags
fbfbc83809cfcd8b128f8c6283fbe5aed5e022b2
Commit Graph
45088 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Anna Henningsen fbfbc83809 src: make AsyncWrap subclass internal field counts explicit 
This helps ensure that we already set the correct number of
internal fields when creating objects, even if the number of
internal fields of e.g. AsyncWrap changes over time.

PR-URL: https://github.com/nodejs/node/pull/62103
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2026-07-19 17:30:55 -05:00
Dmytro Semchuk 9e6dfe6435 doc: fix typo in --disable-wasm-trap-handler description 
PR-URL: https://github.com/nodejs/node/pull/61820
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:55 -05:00
Nikita Skovoroda f5e11a2d5f test: fix test-buffer-zero-fill-cli to be effective 
PR-URL: https://github.com/nodejs/node/pull/60623
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:55 -05:00
Antoine du Hamel 6eeefbd3bf doc: clarify that features cannot be both experimental and deprecated 
PR-URL: https://github.com/nodejs/node/pull/62456
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
 2026-07-19 17:30:55 -05:00
Antoine du Hamel 6018b37d7f tools: adopt the --check-for-duplicates NCU flag 
PR-URL: https://github.com/nodejs/node/pull/62478
Refs: https://github.com/nodejs/node-core-utils/pull/1035
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
 2026-07-19 17:30:54 -05:00
Antoine du Hamel 3e8ad4c05f build: support empty libname flags in configure.py 
PR-URL: https://github.com/nodejs/node/pull/62477
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-07-19 17:30:54 -05:00
Yuya Inoue c5870843a8 test: wait for reattach before initial break on restart 
PR-URL: https://github.com/nodejs/node/pull/62471
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
 2026-07-19 17:30:54 -05:00
James M Snell 86f5fd3365 test: disable flaky WPT Blob test on AIX 
The test Blob-array-buffer.any.js can be flaky on
AIX due to a recognized race condition in v8.

The failed assert is in deps/v8/src/base/platform/platform-aix.cc
on line 199, preceeded by the comment:

> If this check fails it's most likely due to a racing condition
> where another thread has mapped the same address right before we
> do. Since this could cause hard-to-debug issues, potentially with
> security impact, and we can't recover from this, the best we can do
> is abort the process.

Disabling the test on AIX until the underlying issue can
be resolved (if it can be resolved at all) is really the
only option currently.

Reliability Report: https://github.com/nodejs/reliability/blob/main/reports/2026-03-28.md
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62470
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2026-07-19 17:30:54 -05:00
Filip Skokan 2377eca925 src: improve EC JWK import performance 
PR-URL: https://github.com/nodejs/node/pull/62396
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-07-19 17:30:54 -05:00
Mert Can Altin d996238946 src: handle null backing store in ArrayBufferViewContents::Read 
Fixes: https://github.com/nodejs/node/issues/62342

src: handle null backing store in ArrayBufferViewContents::Read
PR-URL: https://github.com/nodejs/node/pull/62343
Fixes: https://github.com/nodejs/node/issues/62342
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-07-19 17:30:54 -05:00
Richard Lau cb75ed5581 deps: V8: cherry-pick cf1bce40a5ef 
Original commit message:

    [wasm] Fix S128Const on big endian

    Since http://crrev.com/c/2944437 globals are no longer little endian
    enforced.

    S128Const handling in the initializer needs to take this into account
    and byte reverse values which are hard coded in little endian order.

    This is currently causing failures on Node.js upstream:
    https://github.com/nodejs/node/pull/59034#issuecomment-4129144461

    Change-Id: Ifcc9ade93ee51565ab19b16e9dadf0ff5752f7a6
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7704213
    Commit-Queue: Milad Farazmand <mfarazma@ibm.com>
    Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106082}

Refs: https://github.com/v8/v8/commit/cf1bce40a5ef4c7c1da351754f5bf526c0c96463
PR-URL: https://github.com/nodejs/node/pull/62449
Refs: https://github.com/v8/v8/commit/cf1bce40a5ef4c7c1da351754f5bf526c0c96463
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:53 -05:00
Yuya Inoue 5ca31e53da test: avoid flaky run wait in debugger restart test 
PR-URL: https://github.com/nodejs/node/pull/62112
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:53 -05:00
Tim Perry f417abd4e4 crypto: add crypto::GetSSLCtx API for addon access to OpenSSL contexts 
This intended to replace usage of the unsupported _external field,
offering an official API for native addons to access OpenSSL directly
while reducing the JS API and internal field exposure.

PR-URL: https://github.com/nodejs/node/pull/62254
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:53 -05:00
Mowafak Almahaini d11fbc3602 doc: enhance clarification about the main field 
removed "this" to enhance sentence flow.

PR-URL: https://github.com/nodejs/node/pull/62302
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:53 -05:00
Jeff Matson ced0276cb3 doc: minor typo fix 
PR-URL: https://github.com/nodejs/node/pull/62358
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
 2026-07-19 17:30:53 -05:00
Matteo Collina 7748f609c2 test_runner: make it compatible with fake timers 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/59272
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2026-07-19 17:30:53 -05:00
Filip Skokan b60f32f234 lib: make SubtleCrypto.supports enumerable 
PR-URL: https://github.com/nodejs/node/pull/62307
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-07-19 17:30:52 -05:00
Chengzhong Wu d27545601d build: fix timezone-update path references 
PR-URL: https://github.com/nodejs/node/pull/62280
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:52 -05:00
Xavier Stouder c4e517b794 doc: test and test-only targets do not run linter 
`make test` and `make test-only` targets no longer runs linters.
This commit updates the inline comments and building doc to reflect
reality.

Fixes: https://github.com/nodejs/node/issues/58606
PR-URL: https://github.com/nodejs/node/pull/62120
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-07-19 17:30:52 -05:00
Marco 979e095bd4 module: fix coverage of mocked CJS modules imported from ESM 
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62133
Fixes: https://github.com/nodejs/node/issues/61709
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
 2026-07-19 17:30:52 -05:00
kovanandjorge guerrero 2d4e35961d doc,test: clarify --eval syntax for leading '-' scripts 
If the script passed to --eval starts with a hyphen, the CLI parser
treats it as another option flag. Document the --eval=<script> form
as the workaround and add tests for --eval=-42, --eval=-0, and the
-e -p missing-argument error.

Co-authored-by: jorge guerrero <grrr.jrg@gmail.com>
Refs: https://github.com/nodejs/node/issues/43397
Refs: https://github.com/nodejs/node/pull/61962
PR-URL: https://github.com/nodejs/node/pull/62244
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:52 -05:00
dependabot[bot] 49cc337ca7 tools: bump flatted from 3.3.3 to 3.4.1 in /tools/eslint 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.1.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.1)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62255
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:51 -05:00
Ali Hassan 38984dfc94 benchmark: fix destructuring in dgram/single-buffer 
PR #59872 renamed the config key from `num` to `n` but did not update
the destructuring in main(), leaving `{ num: n }` which resolves to
undefined. This caused the benchmark to produce near-zero throughput
since the send-batching logic never fires when n is undefined.

Refs: https://github.com/nodejs/node/pull/59872
PR-URL: https://github.com/nodejs/node/pull/62084
Refs: https://github.com/nodejs/performance/issues/187
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:51 -05:00
Antoine du Hamel 020d2b5eb9 doc: clarify that any truthy value of shell is part of DEP0190 
PR-URL: https://github.com/nodejs/node/pull/62249
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:51 -05:00
Antoine du Hamel 7a29409ed3 tools: validate all commits that are pushed to main 
PR-URL: https://github.com/nodejs/node/pull/62246
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:51 -05:00
Kit DallegeandClaude Opus 4.6 e7bf300619 doc: remove outdated Chrome 66 and ndb references from debugger 
Remove the Chrome 66.0.3345.0 version check (Chrome 66 shipped in
2018), the claim that Chrome DevTools doesn't support debugging worker
threads (which uses time-tied language), and the recommendation to use
ndb (which has been archived since July 2023).

Fixes: https://github.com/nodejs/node/issues/54078

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PR-URL: https://github.com/nodejs/node/pull/62202
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
 2026-07-19 17:30:51 -05:00
René 15a79da90f typings: rationalise TypedArray types 
PR-URL: https://github.com/nodejs/node/pull/62174
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
 2026-07-19 17:30:51 -05:00
Ali Hassan 289e747d5a stream: replace bind with arrow function for onwrite callback 
PR-URL: https://github.com/nodejs/node/pull/62087
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2026-07-19 17:30:50 -05:00
Filip Skokan cd6941d391 crypto: read algorithm name property only once in normalizeAlgorithm 
PR-URL: https://github.com/nodejs/node/pull/62170
Refs: https://redirect.github.com/web-platform-tests/wpt/pull/57614#pullrequestreview-3808145365
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:50 -05:00
Antoine du Hamel 46f24da4e8 doc: copyedit addons.md 
* Make the intro less C++-centric
* Give a GYP-less build example
* Remove the duplicate Node-API documentation
* Add an ESM example

PR-URL: https://github.com/nodejs/node/pull/62071
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:50 -05:00
Richard Lau ed7c6c4411 tools: revert timezone update GHA workflow to ubuntu-latest 
The timezone update script requires `icupkg` which doesn't
appear to be available on `ubuntu-slim`.

PR-URL: https://github.com/nodejs/node/pull/62140
Fixes: https://github.com/nodejs/node/issues/62109
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:50 -05:00
Mattias Buelens cfeaa8730e stream: optimize webstreams pipeTo 
PR-URL: https://github.com/nodejs/node/pull/62079
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-07-19 17:30:50 -05:00
dependabot[bot] 78c7630c74 meta: bump actions/download-artifact from 7.0.0 to 8.0.0 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62063
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
 2026-07-19 17:30:50 -05:00
dependabot[bot] 52a363faef meta: bump actions/upload-artifact from 6.0.0 to 7.0.0 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62062
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
 2026-07-19 17:30:49 -05:00
Rich Trott 98c53f813e tools: improve error handling in test426 update script 
If the current SHA is not found in the README for some reason,
exit with an error.

PR-URL: https://github.com/nodejs/node/pull/62121
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:49 -05:00
Filip Skokan 6e532736f4 test: improve WPT report runner 
Add incremental report writing after each spec completes and on
worker errors so that reports survive if the process is killed
before the exit handler runs.

Add bytes() method to readAsFetch() to match the Response API
used by newer WPT tests.

PR-URL: https://github.com/nodejs/node/pull/62107
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
 2026-07-19 17:30:49 -05:00
Anna Henningsen eb3d1475d2 src: expose async context frame debugging helper to JS 
This was invaluable for debugging the previous change,
so I'm suggesting we add it regardless of it being a
debugging-only API.

PR-URL: https://github.com/nodejs/node/pull/62103
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2026-07-19 17:30:49 -05:00
Gerhard Stöbich a89339faf5 http: fix use-after-free when freeParser is called during llhttp_execute 
When pipelined requests arrive in one TCP segment, llhttp_execute()
parses them all in a single call. If a synchronous 'close' event
handler invokes freeParser() mid-execution, cleanParser() nulls out
parser state while llhttp_execute() is still on the stack, crashing on
 the next callback.

Add an is_being_freed_ flag that freeParser() sets via
parser.markFreed() before cleaning state. Proxy::Raw checks the flag
before every callback and returns HPE_USER to abort execution early if
set.

PR-URL: https://github.com/nodejs/node/pull/62095
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2026-07-19 17:30:49 -05:00
Filip Skokan b933e86422 tools: fix daily wpt workflow nighly release version lookup 
PR-URL: https://github.com/nodejs/node/pull/62076
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:49 -05:00
Richard Lau eb88e6b1f4 tools: fix example in release proposal linter 
`changelog-maker` writes 10 character length short form SHA's.
Explicitly set the `git log format` in the example to match.

PR-URL: https://github.com/nodejs/node/pull/62074
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:48 -05:00
Marco 2308c74ad9 stream: fix TransformStream race on cancel with pending write 
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62040
Fixes: https://github.com/nodejs/node/issues/62036
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
 2026-07-19 17:30:48 -05:00
dependabot[bot] 80d65bd46c tools: bump minimatch from 3.1.3 to 3.1.5 in /tools/clang-format 
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.3 to 3.1.5.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v3.1.3...v3.1.5)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62013
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
 2026-07-19 17:30:48 -05:00
dependabot[bot] 0e1030b961 meta: bump step-security/harden-runner from 2.14.2 to 2.15.0 
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.2 to 2.15.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/5ef0c079ce82195b2a36a210272d6b661572d83e...a90bcbc6539c36a85cdfeb73f7e2f433735f215b)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62064
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:48 -05:00
Gerhard Stöbich cd6368089a src: release context frame in AsyncWrap::EmitDestroy 
Release the async context frame in AsyncWrap::EmitDestroy to allow
gc to collect it.

This is in special relevant for reused resources like HTTPParser
otherwise they might keep ALS stores alive.

PR-URL: https://github.com/nodejs/node/pull/61995
Fixes: https://github.com/nodejs/node/issues/61882
Refs: https://github.com/nodejs/node/pull/48528
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2026-07-19 17:30:48 -05:00
Antoine du Hamel aab80f9595 test: fix skipping behavior for test-runner-run-files-undefined 
PR-URL: https://github.com/nodejs/node/pull/62026
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:48 -05:00
Nikita Skovoroda 831b9d91f3 src: use validate_ascii_with_errors instead of validate_ascii 
It has better performance

PR-URL: https://github.com/nodejs/node/pull/61122
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:47 -05:00
Matteo Collina 775ae50221 http: validate ClientRequest path on set 
The `path` property on `ClientRequest` was only validated at
construction time. Add a getter/setter so that the same
`INVALID_PATH_REGEX` check runs whenever `req.path` is reassigned,
preventing invalid characters from reaching `_implicitHeader()`.

PR-URL: https://github.com/nodejs/node/pull/62030
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-07-19 17:30:47 -05:00
Rafael Gonzaga 5c4d681699 doc: expand SECURITY.md with non-vulnerability examples 
PR-URL: https://github.com/nodejs/node/pull/61972
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-07-19 17:30:47 -05:00
Richard Clarke 956d8db822 http: validate headers in writeEarlyHints 
Add validateHeaderName/validateHeaderValue checks for non-link
headers and checkInvalidHeaderChar for the Link value in HTTP/1.1
writeEarlyHints, closing a CRLF injection gap where header names
and values were concatenated into the raw response without
validation.

Also tighten linkValueRegExp to reject CR/LF inside the <...>
URL portion of Link header values.

PR-URL: https://github.com/nodejs/node/pull/61897
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-07-19 17:30:47 -05:00
René 0206134748 doc: separate in-types and out-types in SQLite conversion docs 
PR-URL: https://github.com/nodejs/node/pull/62034
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
 2026-07-19 17:30:47 -05:00