Merge upstream Node.js v24.18.1 into dotnet/main - #388
Merged
Conversation
The `node_protocol_generated_sources` action was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja to skip regeneration when PDL domain files changed. PR-URL: nodejs#62888 Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Kohei Ueno <[email protected]>
Without pinning Node.js, the runner defaults to Node 20 and npx falls back to [email protected] instead of 6.0.0 (requires Node 22+). Version 5 does not recognise the ffi subsystem, causing false invalid-commit alerts. Signed-off-by: Nenad Spasenic <[email protected]> PR-URL: nodejs#63084 Fixes: nodejs#63070 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Michaël Zasso <[email protected]>
PR-URL: nodejs#63090 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Chemi Atlow <[email protected]>
Signed-off-by: Moshe Atlow <[email protected]> PR-URL: nodejs#63097 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>
Signed-off-by: David Thornton <[email protected]> PR-URL: nodejs#63093 Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: René <[email protected]>
Start working on re-enabling QUIC support with the availability of OpenSSL 3.5. This will be a multi-step process. Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <[email protected]>
Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <[email protected]>
Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <[email protected]>
Since we need to be able to use the openssl adapter provided by the ngtcp2 library, and because that adapter does not include any compile guards to ensure that OpenSSL 3.5 is being used and that the APIs are actually available, we need to add a compile time check for the openssl version in order to conditionally include the adapter to avoid build errors when using a shared openssl library that is not OpenSSL 3.5. Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59249 Reviewed-By: Matteo Collina <[email protected]>
PR-URL: nodejs#59381 Fixes: nodejs#59369 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Richard Lau <[email protected]>
PR-URL: nodejs#59381 Fixes: nodejs#59369 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Richard Lau <[email protected]>
Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]>
Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]>
Signed-off-by: James M Snell <[email protected]> PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]>
While I get that macros aren't the most loved thing in the world, they do help reduce boilerplate, and there's a lot of boilerplate in the QUIC code. This commit cleans up some of that boilerplate, particularly around the use of v8 APIs. PR-URL: nodejs#59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]>
PR-URL: nodejs#59884 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Tim Perry <[email protected]>
Fixes: nodejs#60110 PR-URL: nodejs#60118 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>
PR-URL: nodejs#60046 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>
PR-URL: nodejs#61187 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>
The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: nodejs#61403 Refs: nodejs#61372 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Anna Henningsen <[email protected]>
Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode/Opus 4.6 PR-URL: nodejs#62387 Reviewed-By: Stephen Belanger <[email protected]>
Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode/Opus 4.6 PR-URL: nodejs#62387 Reviewed-By: Stephen Belanger <[email protected]>
Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode/Opus 4.6 PR-URL: nodejs#62387 Reviewed-By: Stephen Belanger <[email protected]>
Previously Packets were ReqWrap objects with a shared free-list. This commit changes to a per-Endpoint arena with no v8 involvement. This is the design I originally had in mind but I initially went with the simpler freelist approach to get something working. There's too much overhead in the reqrap/freelist approach and individual packets do not really need to be observable via async hooks. This design should eliminate the risk of memory fragmentation and eliminate a significant bottleneck in the hot path. Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: nodejs#62589 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Stephen Belanger <[email protected]>
Move node:quic behind a compile-time flag, disabled by default. Use --experimental-quic at configure time to enable. - Add --experimental-quic flag to configure.py - Add node_use_quic variable and HAVE_QUIC define - Make QUIC sources conditional in node.gyp - Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi - Update C++ guards to check HAVE_QUIC - Update process.features.quic to check node_use_quic PR-URL: nodejs#61444 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: nodejs#62620 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Tim Perry <[email protected]>
PR-URL: nodejs#60746 Backport-PR-URL: nodejs#62760 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Xuguang Mei <[email protected]>
Refs: nodejs#60746 (review) PR-URL: nodejs#60929 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>
PR-URL: nodejs#58680 Reviewed-By: Marco Ippolito <[email protected]>
PR-URL: nodejs#58680 Reviewed-By: Marco Ippolito <[email protected]>
Avoid re-wrapping native WebCrypto promises with PromiseResolve(), since resolving a promise can read its user-mutated constructor. Add a helper for chaining internal WebCrypto job promises without consulting Promise species state, and use it for intermediate job results. Also align JWK wrapping and unwrapping with the spec's fresh-global JSON handling by detaching internal JWK values from user prototypes. Use the internal UTF-8 encoder/decoder bindings instead of shared TextEncoder/TextDecoder prototype methods. Expand the WebCrypto prototype pollution regression test to cover SubtleCrypto methods, export formats, zero-length KDF results, JWK toJSON/kty pollution, and encoder/decoder prototype poisoning. Signed-off-by: Filip Skokan <[email protected]> PR-URL: nodejs#63363 Backport-PR-URL: nodejs#63563 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: René <[email protected]>
PR-URL: nodejs#63417 Backport-PR-URL: nodejs#63563 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
Rework lib/internal/webidl.js into a documented shared converter module that follows the Web IDL conversion algorithms more closely. Improvements: - Add documented converters and helper factories for primitive values, dictionaries, enums, sequences, interfaces, required arguments, integers, `Uint8Array`, and `BufferSource`. - Move WebCrypto onto the shared converters, while keeping compatibility wrappers for its existing `BufferSource` and `BigInteger` behavior. - Use shared converters from Blob, Performance, Web Locks, and structured clone option handling. - Add benchmarks for `ConvertToInt` and WebCrypto Web IDL converter hot paths. - Add focused tests for core converters, WebCrypto converters, integer conversion, and buffer source behavior. Fixes: - Make the shared `BufferSource` and `Uint8Array` converters reject resizable `ArrayBuffer` and growable `SharedArrayBuffer` backing stores unless explicitly allowed. WebCrypto preserves its legacy resizable backing-store behavior through compatibility wrappers until a semver-major follow-up can opt in to the stricter behavior. - Use Web IDL `ToNumber` and `ToString` behavior for BigInt, Symbol, and object primitive conversion. - Use exact BigInt modulo for 64-bit `ConvertToInt` wrapping and document the final Number approximation behavior. - Normalize mathematical modulo results to `+0` where Web IDL requires it. - Process inherited dictionaries in least-derived to most-derived order, sorting members only within each dictionary level. - Use `IteratorComplete` truthiness for sequence conversion. - Cover detached buffers, resizable-backed views, growable-backed views, cross-realm buffer sources, mutation-after-call behavior, inherited dictionary member order, and sequence iterator completion behavior. Signed-off-by: Filip Skokan <[email protected]> PR-URL: nodejs#62979 Backport-PR-URL: nodejs#63563 Reviewed-By: Сковорода Никита Андреевич <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
Instead of first discarding the top 24 bits of the argument and then checking that the low 8 bits are within the expected range, first check that the original 32-bit integer is within the expected range and then discard the top 24 bits. PR-URL: nodejs#62763 Backport-PR-URL: nodejs#63563 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Xuguang Mei <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>
Signed-off-by: Filip Skokan <[email protected]> PR-URL: nodejs#62645 Backport-PR-URL: nodejs#63563 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: James M Snell <[email protected]>
Signed-off-by: Filip Skokan <[email protected]> PR-URL: nodejs#63161 Backport-PR-URL: nodejs#63563 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]>
Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#64004 Fixes: nodejs#63989 Reviewed-By: René <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Robert Nagy <[email protected]>
Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) nodejs#63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) nodejs#63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) nodejs#62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) nodejs#64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) nodejs#63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) nodejs#63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) nodejs#63834 PR-URL: nodejs#64062
PR-URL: nodejs#64062
Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#63752 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> CVE-ID: CVE-2026-56846
Signed-off-by: RafaelGSS <[email protected]> PR-URL: nodejs-private/node-private#927 CVE-ID: CVE-2026-56847
Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs-private/node-private#921 Refs: https://hackerone.com/reports/3833629 Reviewed-By: Rafael Gonzaga <[email protected]> CVE-ID: CVE-2026-56848
Signed-off-by: RafaelGSS <[email protected]> PR-URL: nodejs-private/node-private#930 Refs: https://hackerone.com/reports/3816840 CVE-ID: CVE-2026-56850
Refs: https://hackerone.com/reports/3815767 Signed-off-by: RafaelGSS <[email protected]> PR-URL: nodejs-private/node-private#926 CVE-ID: CVE-2026-58039
SQLTagStore Run/Iterate/Get/All reset the shared cached statement via raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_ bump, so live iterators were never invalidated. Also mark the iterator done on SQLITE_DONE so it cannot restart the statement. PR-URL: nodejs-private/node-private#896 Refs: https://hackerone.com/reports/3564941 Reviewed-By: Robert Nagy <[email protected]> CVE-ID: CVE-2026-58041
Refs: https://hackerone.com/reports/3795657 Signed-off-by: RafaelGSS <[email protected]> PR-URL: nodejs-private/node-private#929 Reviewed-By: Matteo Collina <[email protected]> CVE-ID: CVE-2026-58042
Signed-off-by: RafaelGSS <[email protected]> PR-URL: nodejs-private/node-private#911 Refs: https://hackerone.com/reports/3761342 CVE-ID: CVE-2026-58043
Signed-off-by: RafaelGSS <[email protected]> PR-URL: nodejs-private/node-private#931 Refs: https://hackerone.com/reports/3857258 CVE-ID: CVE-2026-58045
PR-URL: nodejs#64713 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>
Signed-off-by: Paolo Insogna <[email protected]> PR-URL: nodejs-private/node-private#935 Refs: nodejs-private/llhttp-private#244 Reviewed-By: Matteo Collina <[email protected]>
This is a security release. Notable changes: * (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 7.29.0 (Node.js GitHub Bot) PR-URL: nodejs-private/node-private#937 Signed-off-by: RafaelGSS <[email protected]>
Advances the fork from v24.7.0 to v24.18.1. This promotes the v24 line to LTS `Krypton` and updates the bundled npm to 11.16.0. Conflicts are resolved in `.gitignore`, `.npmrc` and `deps/ncrypto/ncrypto.cc`, keeping both the new upstream entries and the dotnet-specific ones. The `<vector>` include in `ncrypto.cc` is retained because `std::vector` is still used in that file. The `.npmrc` registry redirects are normalized so that each one sits next to a `package.json`, which removes the orphans left behind by the npm restructure. Co-authored-by: Copilot <[email protected]> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
These directories carry `package.json` and `package-lock.json` files whose development dependencies are reported as vulnerable, and none of them take part in building or installing `node`. Removing them clears the alerts for `js-yaml`, `lodash`, `koa`, `rollup` and the older `minimatch` and `brace-expansion` entries without affecting the shipped product. Removed `tools/doc`, `tools/lint-md`, `tools/eslint`, `tools/clang-format`, `deps/v8/tools/clusterfuzz`, `deps/v8/tools/turbolizer`, `deps/v8/tools/tracing/proto-converter`, the `deps/v8/tools` manifests, and the lockfiles under `deps/undici/src` and `deps/minimatch`. The 11 `deps/v8/tools/*.mjs` files referenced by `node.gyp` for `--prof-process` are retained. Co-authored-by: Copilot <[email protected]> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
Component Governance resolves the commit recorded in `cgmanifest.json` to inventory the vendored sources, so the hash has to advance together with the merge. It is set to `9623d9ad85d37d2f0610ec4a82b48182cf2c6061`, the commit that upstream tag `v24.18.1` points at. Note that the tag is annotated, so the tag object hash is a different value and would not resolve. `LINT_MD_TARGETS` feeds a `find` invocation that is expanded when the makefile is parsed, so the now removed `tools/doc` caused every `make` invocation to print a `find` error. It is dropped from the list. Co-authored-by: Copilot <[email protected]> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
npm 11.16.0 bundles `brace-expansion` 5.0.6, which is still affected by CVE-2026-13149 and CVE-2026-14257. The first fixes them in 5.0.7 and the second in 5.0.8, and no npm release available today carries 5.0.8 or later, so the bundled copy is updated in place to 5.0.9. Both consumers, `deps/minimatch` and `deps/npm/node_modules/minimatch`, declare `^5.0.5`, and the vendored `balanced-match` 4.0.4 satisfies the `^4.0.2` requirement. The change is additive on the public surface, adding `EXPANSION_MAX_LENGTH`, and expansion results are unchanged. Co-authored-by: Copilot <[email protected]> Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reapply of #375 but this time with merge commit