Merge upstream Node.js v24.18.1 into dotnet/main - #375

The `node_protocol_generated_sources` action
was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja
to skip regeneration when PDL domain files changed.

PR-URL: nodejs#62888
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Kohei Ueno <[email protected]>

Without pinning Node.js, the runner defaults to Node 20 and npx falls
back to [email protected] instead of 6.0.0 (requires
Node 22+). Version 5 does not recognise the ffi subsystem, causing
false invalid-commit alerts.

Signed-off-by: Nenad Spasenic <[email protected]>
PR-URL: nodejs#63084
Fixes: nodejs#63070
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

PR-URL: nodejs#63090
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: nodejs#63097
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

Signed-off-by: David Thornton <[email protected]>
PR-URL: nodejs#63093
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: René <[email protected]>

Start working on re-enabling QUIC support with the availability
of OpenSSL 3.5. This will be a multi-step process.

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <[email protected]>

Since we need to be able to use the openssl adapter provided
by the ngtcp2 library, and because that adapter does not include
any compile guards to ensure that OpenSSL 3.5 is being used and
that the APIs are actually available, we need to add a compile
time check for the openssl version in order to conditionally
include the adapter to avoid build errors when using a shared
openssl library that is not OpenSSL 3.5.

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <[email protected]>

PR-URL: nodejs#59381
Fixes: nodejs#59369
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

PR-URL: nodejs#59381
Fixes: nodejs#59369
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

While I get that macros aren't the most loved thing in
the world, they do help reduce boilerplate, and there's
a lot of boilerplate in the QUIC code. This commit cleans
up some of that boilerplate, particularly around the
use of v8 APIs.

PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

PR-URL: nodejs#59884
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

Fixes: nodejs#60110
PR-URL: nodejs#60118
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

PR-URL: nodejs#60046
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

PR-URL: nodejs#61187
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: nodejs#61403
Refs: nodejs#61372
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: nodejs#62387
Reviewed-By: Stephen Belanger <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: nodejs#62387
Reviewed-By: Stephen Belanger <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: nodejs#62387
Reviewed-By: Stephen Belanger <[email protected]>

Previously Packets were ReqWrap objects with a shared
free-list. This commit changes to a per-Endpoint arena
with no v8 involvement. This is the design I originally
had in mind but I initially went with the simpler
freelist approach to get something working. There's
too much overhead in the reqrap/freelist approach and
individual packets do not really need to be observable
via async hooks.

This design should eliminate the risk of memory fragmentation
and eliminate a significant bottleneck in the hot path.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: nodejs#62589
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

Move node:quic behind a compile-time flag, disabled by default.
Use --experimental-quic at configure time to enable.

- Add --experimental-quic flag to configure.py
- Add node_use_quic variable and HAVE_QUIC define
- Make QUIC sources conditional in node.gyp
- Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi
- Update C++ guards to check HAVE_QUIC
- Update process.features.quic to check node_use_quic

PR-URL: nodejs#61444
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: nodejs#62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

PR-URL: nodejs#60746
Backport-PR-URL: nodejs#62760
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>

Refs: nodejs#60746 (review)
PR-URL: nodejs#60929
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: nodejs#58680
Reviewed-By: Marco Ippolito <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs#63752
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
CVE-ID: CVE-2026-56846

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#927
CVE-ID: CVE-2026-56847

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs-private/node-private#921
Refs: https://hackerone.com/reports/3833629
Reviewed-By: Rafael Gonzaga <[email protected]>
CVE-ID: CVE-2026-56848

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#930
Refs: https://hackerone.com/reports/3816840
CVE-ID: CVE-2026-56850

Refs: https://hackerone.com/reports/3815767
Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#926
CVE-ID: CVE-2026-58039

PR-URL: nodejs-private/node-private#904
Refs: https://hackerone.com/reports/3811980
CVE-ID: CVE-2026-58040

SQLTagStore Run/Iterate/Get/All reset the shared cached statement via
raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_
bump, so live iterators were never invalidated. Also mark the iterator
done on SQLITE_DONE so it cannot restart the statement.

PR-URL: nodejs-private/node-private#896
Refs: https://hackerone.com/reports/3564941
Reviewed-By: Robert Nagy <[email protected]>
CVE-ID: CVE-2026-58041

Refs: https://hackerone.com/reports/3795657
Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#929
Reviewed-By: Matteo Collina <[email protected]>
CVE-ID: CVE-2026-58042

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#911
Refs: https://hackerone.com/reports/3761342
CVE-ID: CVE-2026-58043

PR-URL: nodejs-private/node-private#922
Refs: https://hackerone.com/reports/3564941
CVE-ID: CVE-2026-58044

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#931
Refs: https://hackerone.com/reports/3857258
CVE-ID: CVE-2026-58045

PR-URL: nodejs#64713
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>

Signed-off-by: Paolo Insogna <[email protected]>
PR-URL: nodejs-private/node-private#935
Refs: nodejs-private/llhttp-private#244
Reviewed-By: Matteo Collina <[email protected]>

This is a security release.

Notable changes:

* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 7.29.0 (Node.js GitHub Bot)

PR-URL: nodejs-private/node-private#937
Signed-off-by: RafaelGSS <[email protected]>

Advances the fork from v24.7.0 to v24.18.1. This promotes the v24 line to
LTS `Krypton` and updates the bundled npm to 11.16.0.

Conflicts are resolved in `.gitignore`, `.npmrc` and `deps/ncrypto/ncrypto.cc`,
keeping both the new upstream entries and the dotnet-specific ones. The
`<vector>` include in `ncrypto.cc` is retained because `std::vector` is still
used in that file.

The `.npmrc` registry redirects are normalized so that each one sits next to a
`package.json`, which removes the orphans left behind by the npm restructure.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1

These directories carry `package.json` and `package-lock.json` files whose
development dependencies are reported as vulnerable, and none of them take
part in building or installing `node`. Removing them clears the alerts for
`js-yaml`, `lodash`, `koa`, `rollup` and the older `minimatch` and
`brace-expansion` entries without affecting the shipped product.

Removed `tools/doc`, `tools/lint-md`, `tools/eslint`, `tools/clang-format`,
`deps/v8/tools/clusterfuzz`, `deps/v8/tools/turbolizer`,
`deps/v8/tools/tracing/proto-converter`, the `deps/v8/tools` manifests, and the
lockfiles under `deps/undici/src` and `deps/minimatch`.

The 11 `deps/v8/tools/*.mjs` files referenced by `node.gyp` for
`--prof-process` are retained.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1

Component Governance resolves the commit recorded in `cgmanifest.json` to
inventory the vendored sources, so the hash has to advance together with the
merge. It is set to `9623d9ad85d37d2f0610ec4a82b48182cf2c6061`, the commit
that upstream tag `v24.18.1` points at. Note that the tag is annotated, so the
tag object hash is a different value and would not resolve.

`LINT_MD_TARGETS` feeds a `find` invocation that is expanded when the makefile
is parsed, so the now removed `tools/doc` caused every `make` invocation to
print a `find` error. It is dropped from the list.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1

npm 11.16.0 bundles `brace-expansion` 5.0.6, which is still affected by
CVE-2026-13149 and CVE-2026-14257. The first fixes them in 5.0.7 and the
second in 5.0.8, and no npm release available today carries 5.0.8 or later,
so the bundled copy is updated in place to 5.0.9.

Both consumers, `deps/minimatch` and `deps/npm/node_modules/minimatch`,
declare `^5.0.5`, and the vendored `balanced-match` 4.0.4 satisfies the
`^4.0.2` requirement. The change is additive on the public surface, adding
`EXPANSION_MAX_LENGTH`, and expansion results are unchanged.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1