Merge upstream Node.js v24.18.1 into dotnet/main - #375
Draft
kotlarmilos wants to merge 1635 commits into
Draft
Conversation
- Simplify `ZLIB_FAILURES` creation. - Cache `cause.code` in `handleKnownInternalErrors` in case of a getter. - Replace `SafePromiseAll` with `SafePromiseAllReturnVoid` to reduce the number of allocated promises. Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: nodejs#63034 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
The `node_protocol_generated_sources` action was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja to skip regeneration when PDL domain files changed. PR-URL: nodejs#62888 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
Without pinning Node.js, the runner defaults to Node 20 and npx falls back to core-validate-commit@5.0.1 instead of 6.0.0 (requires Node 22+). Version 5 does not recognise the ffi subsystem, causing false invalid-commit alerts. Signed-off-by: Nenad Spasenic <40522817+nsinfoPRO@users.noreply.github.com> PR-URL: nodejs#63084 Fixes: nodejs#63070 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com>
PR-URL: nodejs#63090 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Moshe Atlow <moshe@atlow.co.il> PR-URL: nodejs#63097 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Signed-off-by: David Thornton <david.m.thornton@gmail.com> PR-URL: nodejs#63093 Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Start working on re-enabling QUIC support with the availability of OpenSSL 3.5. This will be a multi-step process. Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Since we need to be able to use the openssl adapter provided by the ngtcp2 library, and because that adapter does not include any compile guards to ensure that OpenSSL 3.5 is being used and that the APIs are actually available, we need to add a compile time check for the openssl version in order to conditionally include the adapter to avoid build errors when using a shared openssl library that is not OpenSSL 3.5. Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: nodejs#59381 Fixes: nodejs#59369 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs#59381 Fixes: nodejs#59369 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
While I get that macros aren't the most loved thing in the world, they do help reduce boilerplate, and there's a lot of boilerplate in the QUIC code. This commit cleans up some of that boilerplate, particularly around the use of v8 APIs. PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: nodejs#59884 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Tim Perry <pimterry@gmail.com>
Fixes: nodejs#60110 PR-URL: nodejs#60118 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
PR-URL: nodejs#60046 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#61187 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: nodejs#61403 Refs: nodejs#61372 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode/Opus 4.6 PR-URL: nodejs#62387 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode/Opus 4.6 PR-URL: nodejs#62387 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode/Opus 4.6 PR-URL: nodejs#62387 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Previously Packets were ReqWrap objects with a shared free-list. This commit changes to a per-Endpoint arena with no v8 involvement. This is the design I originally had in mind but I initially went with the simpler freelist approach to get something working. There's too much overhead in the reqrap/freelist approach and individual packets do not really need to be observable via async hooks. This design should eliminate the risk of memory fragmentation and eliminate a significant bottleneck in the hot path. Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode:Opus 4.6 PR-URL: nodejs#62589 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Move node:quic behind a compile-time flag, disabled by default. Use --experimental-quic at configure time to enable. - Add --experimental-quic flag to configure.py - Add node_use_quic variable and HAVE_QUIC define - Make QUIC sources conditional in node.gyp - Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi - Update C++ guards to check HAVE_QUIC - Update process.features.quic to check node_use_quic PR-URL: nodejs#61444 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode:Opus 4.6 PR-URL: nodejs#62620 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#60746 Backport-PR-URL: nodejs#62760 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Refs: nodejs#60746 (review) PR-URL: nodejs#60929 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#58680 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Pass CryptoKey handles directly into KDF jobs instead of exporting secret bytes in lib. Normalize HKDF, PBKDF2, and Argon2 around the same job construction pattern so WebCrypto derivation paths avoid extra key material copies and keep operation failures in native job handling. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63363 Backport-PR-URL: nodejs#63563 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Avoid re-wrapping native WebCrypto promises with PromiseResolve(), since resolving a promise can read its user-mutated constructor. Add a helper for chaining internal WebCrypto job promises without consulting Promise species state, and use it for intermediate job results. Also align JWK wrapping and unwrapping with the spec's fresh-global JSON handling by detaching internal JWK values from user prototypes. Use the internal UTF-8 encoder/decoder bindings instead of shared TextEncoder/TextDecoder prototype methods. Expand the WebCrypto prototype pollution regression test to cover SubtleCrypto methods, export formats, zero-length KDF results, JWK toJSON/kty pollution, and encoder/decoder prototype poisoning. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63363 Backport-PR-URL: nodejs#63563 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: nodejs#63417 Backport-PR-URL: nodejs#63563 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Rework lib/internal/webidl.js into a documented shared converter module that follows the Web IDL conversion algorithms more closely. Improvements: - Add documented converters and helper factories for primitive values, dictionaries, enums, sequences, interfaces, required arguments, integers, `Uint8Array`, and `BufferSource`. - Move WebCrypto onto the shared converters, while keeping compatibility wrappers for its existing `BufferSource` and `BigInteger` behavior. - Use shared converters from Blob, Performance, Web Locks, and structured clone option handling. - Add benchmarks for `ConvertToInt` and WebCrypto Web IDL converter hot paths. - Add focused tests for core converters, WebCrypto converters, integer conversion, and buffer source behavior. Fixes: - Make the shared `BufferSource` and `Uint8Array` converters reject resizable `ArrayBuffer` and growable `SharedArrayBuffer` backing stores unless explicitly allowed. WebCrypto preserves its legacy resizable backing-store behavior through compatibility wrappers until a semver-major follow-up can opt in to the stricter behavior. - Use Web IDL `ToNumber` and `ToString` behavior for BigInt, Symbol, and object primitive conversion. - Use exact BigInt modulo for 64-bit `ConvertToInt` wrapping and document the final Number approximation behavior. - Normalize mathematical modulo results to `+0` where Web IDL requires it. - Process inherited dictionaries in least-derived to most-derived order, sorting members only within each dictionary level. - Use `IteratorComplete` truthiness for sequence conversion. - Cover detached buffers, resizable-backed views, growable-backed views, cross-realm buffer sources, mutation-after-call behavior, inherited dictionary member order, and sequence iterator completion behavior. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#62979 Backport-PR-URL: nodejs#63563 Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Instead of first discarding the top 24 bits of the argument and then checking that the low 8 bits are within the expected range, first check that the original 32-bit integer is within the expected range and then discard the top 24 bits. PR-URL: nodejs#62763 Backport-PR-URL: nodejs#63563 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#62645 Backport-PR-URL: nodejs#63563 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63161 Backport-PR-URL: nodejs#63563 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs#64004 Fixes: nodejs#63989 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Robert Nagy <ronagy@icloud.com>
Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) nodejs#63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) nodejs#63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) nodejs#62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) nodejs#64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) nodejs#63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) nodejs#63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) nodejs#63834 PR-URL: nodejs#64062
PR-URL: nodejs#64062
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs#63752 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> CVE-ID: CVE-2026-56846
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#927 CVE-ID: CVE-2026-56847
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs-private/node-private#921 Refs: https://hackerone.com/reports/3833629 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2026-56848
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#930 Refs: https://hackerone.com/reports/3816840 CVE-ID: CVE-2026-56850
Refs: https://hackerone.com/reports/3815767 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#926 CVE-ID: CVE-2026-58039
SQLTagStore Run/Iterate/Get/All reset the shared cached statement via raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_ bump, so live iterators were never invalidated. Also mark the iterator done on SQLITE_DONE so it cannot restart the statement. PR-URL: nodejs-private/node-private#896 Refs: https://hackerone.com/reports/3564941 Reviewed-By: Robert Nagy <ronagy@icloud.com> CVE-ID: CVE-2026-58041
Refs: https://hackerone.com/reports/3795657 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#929 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-58042
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#911 Refs: https://hackerone.com/reports/3761342 CVE-ID: CVE-2026-58043
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#931 Refs: https://hackerone.com/reports/3857258 CVE-ID: CVE-2026-58045
PR-URL: nodejs#64713 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Signed-off-by: Paolo Insogna <paolo@cowtech.it> PR-URL: nodejs-private/node-private#935 Refs: nodejs-private/llhttp-private#244 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This is a security release. Notable changes: * (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 7.29.0 (Node.js GitHub Bot) PR-URL: nodejs-private/node-private#937 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Advances the fork from v24.7.0 to v24.18.1. This promotes the v24 line to LTS `Krypton` and updates the bundled npm to 11.16.0. Conflicts are resolved in `.gitignore`, `.npmrc` and `deps/ncrypto/ncrypto.cc`, keeping both the new upstream entries and the dotnet-specific ones. The `<vector>` include in `ncrypto.cc` is retained because `std::vector` is still used in that file. The `.npmrc` registry redirects are normalized so that each one sits next to a `package.json`, which removes the orphans left behind by the npm restructure. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
These directories carry `package.json` and `package-lock.json` files whose development dependencies are reported as vulnerable, and none of them take part in building or installing `node`. Removing them clears the alerts for `js-yaml`, `lodash`, `koa`, `rollup` and the older `minimatch` and `brace-expansion` entries without affecting the shipped product. Removed `tools/doc`, `tools/lint-md`, `tools/eslint`, `tools/clang-format`, `deps/v8/tools/clusterfuzz`, `deps/v8/tools/turbolizer`, `deps/v8/tools/tracing/proto-converter`, the `deps/v8/tools` manifests, and the lockfiles under `deps/undici/src` and `deps/minimatch`. The 11 `deps/v8/tools/*.mjs` files referenced by `node.gyp` for `--prof-process` are retained. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
Component Governance resolves the commit recorded in `cgmanifest.json` to inventory the vendored sources, so the hash has to advance together with the merge. It is set to `9623d9ad85d37d2f0610ec4a82b48182cf2c6061`, the commit that upstream tag `v24.18.1` points at. Note that the tag is annotated, so the tag object hash is a different value and would not resolve. `LINT_MD_TARGETS` feeds a `find` invocation that is expanded when the makefile is parsed, so the now removed `tools/doc` caused every `make` invocation to print a `find` error. It is dropped from the list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
npm 11.16.0 bundles `brace-expansion` 5.0.6, which is still affected by CVE-2026-13149 and CVE-2026-14257. The first fixes them in 5.0.7 and the second in 5.0.8, and no npm release available today carries 5.0.8 or later, so the bundled copy is updated in place to 5.0.9. Both consumers, `deps/minimatch` and `deps/npm/node_modules/minimatch`, declare `^5.0.5`, and the vendored `balanced-match` 4.0.4 satisfies the `^4.0.2` requirement. The change is additive on the public surface, adding `EXPANSION_MAX_LENGTH`, and expansion results are unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Advances the fork from v24.7.0 to v24.18.1, which promotes the v24 line to LTS
Kryptonand updates the bundled npm to 11.16.0. The work is split into four commits so the upstream import stays separate from the changes made on top.Merge upstream Node.js v24.18.1 into dotnet/mainimports the upstream tag as a real merge and resolves the conflicts.Remove dev-only tool trees flagged by Component Governancedeletes 469 files that take no part in building or installingnode.Update cgmanifest to v24.18.1 and drop the deleted tools/doc lint targetrecords the new upstream commit and fixes a stale lint path.Bump vendored brace-expansion to 5.0.9updates the copy bundled by npm in place.