mirrors/node
0
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-10-28 10:15:07 +08:00
Code Activity
49,265 Commits 74 Branches 969 Tags
main
Commit Graph
49265 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Guy Bedford ec7a28f2e0 module: cache compiled WebAssembly modules in the compile cache 
Extends the module compile cache to WebAssembly modules loaded through
the ES module integration. A new kWasm entry type is keyed on the module
URL with the wire bytes as the hashed source, and stores the serialized
CompiledWasmModule. On load, cached code is deserialized through
v8::WasmModuleCompilation with the same compile options the translator
uses (js-string builtins and imported string constants), falling back
to compilation when V8 rejects it.

As for JavaScript, the cache entry is generated right after compilation.
V8 only serializes optimized tier code, so with the default lazy
baseline compilation there is nothing to cache and no entry is written;
a complete cache requires --no-liftoff --no-wasm-lazy-compilation, which
is documented as the way to use the compile cache for WebAssembly.

Signed-off-by: Guy Bedford <guybedford@gmail.com>
Assisted-by: Claude Code
PR-URL: https://github.com/nodejs/node/pull/66191
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-10-28 01:46:44 +00:00
Trivikram Kamat c9b30827e8 ffi: free libuv error message on failed dlopen 
When uv_dlopen() fails, the error message it allocates is only
released by uv_dlclose(). DynamicLibrary::Close() skips uv_dlclose()
when the handle is null, so each failed ffi.dlopen() leaked the
message. Call uv_dlclose() on the failure path, as DLib::Open() does.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/67007
Fixes: https://github.com/nodejs/node/issues/67006
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2026-10-27 22:28:19 +00:00
Filip Skokan 8124a96447 build: remove unused FIPS export condition 
Refs: https://github.com/nodejs/node/pull/64777#pullrequestreview-5645113536
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67005
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-10-27 21:56:15 +00:00
Node.js GitHub Bot 628fd73a88 test: update test426-fixtures to fae1fa49815813088c433e8486e330e8d953a44 
PR-URL: https://github.com/nodejs/node/pull/66815
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-10-27 21:17:42 +00:00
Node.js GitHub Bot 37c6a1f0a3 tools: update gyp-next to 0.22.4 
PR-URL: https://github.com/nodejs/node/pull/66988
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-10-27 21:17:23 +00:00
Antoine du Hamel 26b9200af2 tools: do not lint GYP JS files 
They are not maintained in this repository.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66988
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-10-27 21:17:22 +00:00
Rafael Gonzaga 75191c45af deps: patch npm engines to accept alpha versions 
npm 12.1.0 declares `engines.node` as
`^22.22.2 || ^24.15.0 || >=26.0.0`, which does not match the Alpha
versions of the 27 release line (`27.0.0-alpha.x.y.z`). npm prints an
unsupported version warning on every invocation, and `test-release-npm`
fails on release builds.

Adds `>=27.0.0-alpha` to the range until a new npm release includes it.

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/67063
Refs: https://github.com/nodejs/node/pull/67062
Refs: https://github.com/npm/cli/issues/10169
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
 2026-10-27 19:01:42 +01:00
Philipp Dunkel 7622ebb3d7 zlib: add raw content read methods to ZipEntry 
zipEntry.rawContent was a getter that exposed the retained buffer of an
in-memory entry and returned null for a file-backed or streaming one,
so the still-compressed bytes of a member read through ZipFile could
not be obtained at all.

Replace it with rawContent(), rawContentSync() and
rawContentIterator(), which mirror content(), contentSync() and
contentIterator() but return the bytes as stored, without
decompressing or verifying them. They work for every entry that has
readable content, return caller-owned buffers from the buffered
variants, and accept a maxSize bound on the compressed size.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/66801
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-10-27 17:45:32 +00:00
dependabot[bot] 79c1fc4fbb tools: bump remark-preset-lint-node 
Bumps the lint-md group in /tools/lint-md with 1 update: [remark-preset-lint-node](https://github.com/nodejs/remark-preset-lint-node).

Updates `remark-preset-lint-node` from 5.1.2 to 5.2.0
- [Release notes](https://github.com/nodejs/remark-preset-lint-node/releases)
- [Commits](https://github.com/nodejs/remark-preset-lint-node/compare/v5.1.2...v5.2.0)

---
updated-dependencies:
- dependency-name: remark-preset-lint-node
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: lint-md
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/67023
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-10-27 17:31:29 +00:00
Ved Chaudhari 98dbf6070e events: report original once() listener on removal 
When a `once()` listener is removed, emit the original user-defined
function in the `removeListener` event instead of the internal wrapper,
matching the behavior of the single-listener path.

Assisted-by: claude:opus-5.5
Signed-off-by: vedchaudhari <vedc2853@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66621
Refs: https://github.com/nodejs/node/issues/5551
Refs: https://github.com/nodejs/node/pull/6394
Refs: https://github.com/nodejs/node/pull/33596
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
 2026-10-27 10:58:13 +00:00
Node.js GitHub Bot 8587d711a1 tools: update nixpkgs-unstable to 901c54c08bdc20e00c2b3c73716b97497b1 
PR-URL: https://github.com/nodejs/node/pull/66994
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-10-27 08:13:02 +01:00
Node.js GitHub Bot 640ce854c5 deps: update zlib to 1.3.2.1-motley-9f9f52c 
PR-URL: https://github.com/nodejs/node/pull/66989
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-10-27 01:11:13 +00:00
Node.js GitHub Bot 578d081148 deps: update brotli to 1.2.1 
PR-URL: https://github.com/nodejs/node/pull/66990
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2026-10-27 01:11:00 +00:00
Node.js GitHub Bot 0f2a5394a5 deps: update undici to 8.12.3 
PR-URL: https://github.com/nodejs/node/pull/66993
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2026-10-27 01:10:49 +00:00
Richard Lau ddba9a535f test: check html and json doc files are generated 
Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/66613
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-10-26 22:25:41 +01:00
Node.js GitHub Bot 352e81424f deps: patch V8 to 15.6.75.25 
Refs: https://github.com/v8/v8/compare/15.6.75.13...15.6.75.25
PR-URL: https://github.com/nodejs/node/pull/66820
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-10-26 17:50:47 +00:00
Rafael Gonzaga 7abbd56cfd doc: document the alpha release process 
Document how to prepare, version, tag and promote the Alpha releases
introduced by the new release schedule, starting with Node.js 27, and
how the first Alpha and semver-major releases are prepared with
git node release.

Refs: https://github.com/nodejs/Release/issues/1187
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66796
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-10-26 16:32:08 +00:00
Michał Fox eb663fe6f4 sqlite: avoid sqlite3_clear_bindings() before every run 
Since SQLite 3.54, sqlite3_clear_bindings() invalidates the query plan
of the statement, so a statement was re-prepared on every run. Bind NULL
only to the parameters that were not bound in this run instead, and skip
clearing in the tag store, which always binds every parameter.

Refs: https://github.com/nodejs/node/issues/66800
Signed-off-by: dualfroz <me@dualfroz.com>
PR-URL: https://github.com/nodejs/node/pull/66983
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
 2026-10-26 15:21:02 +00:00
Antoine du Hamel 1ae40765d6 Revert "build, doc: move to redesign" 
This reverts commit 18a9ba509a.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-10-26 16:08:31 +01:00
Antoine du Hamel 573807b316 Revert "build: toggle doc-kit verbosity based on V" 
This reverts commit 37d5c80f97.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-10-26 16:08:30 +01:00
Antoine du Hamel b0cf162cec Revert "tools: bump the doc group in /tools/doc with 4 updates" 
This reverts commit df775ec2ea.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-10-26 16:08:29 +01:00
Antoine du Hamel 2f8cf853db Revert "tools: bump the doc group in /tools/doc with 4 updates" 
This reverts commit 28194a3037.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-10-26 16:08:29 +01:00
Antoine du Hamel ec8e19d893 Revert "tools: bump the doc group in /tools/doc with 2 updates" 
This reverts commit 2192f7f916.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-10-26 16:08:28 +01:00
Antoine du Hamel 0991bdb623 Revert "tools: bump the doc group in /tools/doc with 4 updates" 
This reverts commit 1bc3cdae37.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-10-26 16:08:27 +01:00
Ravi Arnan Irianto ba3c34a93a doc: fix grammar and phrasing in typescript.md 
Fix grammatical issues and heading phrasing in `doc/api/typescript.md`:
- Correct subject-verb agreement ("files that contains" -> "files that
  contain").
- Add missing indefinite article ("result in an ... error").
- Change heading from "Paths aliases" to "Path aliases" to match
  standard TypeScript terminology.
- Clarify verb parallelism ("won't be transformed and will therefore
  produce an error").

Signed-off-by: Ravi Arnan <raviarnankeren@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66977
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
 2026-10-26 07:56:41 +00:00
Node.js GitHub Bot 3983092f63 deps: update archs files for openssl-4.1.0 
PR-URL: https://github.com/nodejs/node/pull/66971
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-10-26 00:58:37 +00:00
Node.js GitHub Bot 79239a48f1 deps: upgrade openssl sources to openssl-4.1.0 
PR-URL: https://github.com/nodejs/node/pull/66971
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-10-26 00:58:34 +00:00
Lazizbek Ergashev d630b5d88b sqlite: retry busy or locked backup steps 
Signed-off-by: lazerg <lazerg2@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66769
Fixes: https://github.com/nodejs/node/issues/66760
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
 2026-10-25 23:33:24 +00:00
Filip Skokan a2cd8aa883 crypto,https,tls: end OpenSSL engine support 
OpenSSL removed support for engines in version 4. Remove the Node.js
APIs, constants, native bindings, and implementation that depend on
ENGINE.

Keep recognizing the former TLS and HTTPS engine options so their use
fails explicitly instead of appearing to work while being ignored.

Move DEP0183 directly from Documentation-only to End-of-Life after
reverting its unreleased Runtime deprecation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:38 +01:00
Filip Skokan b61e682fc0 Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183)" 
This reverts commit da516920fc.

PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:37 +01:00
Filip Skokan fb8d52d75a crypto: move DEP0093 to End-of-Life 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:36 +01:00
Filip Skokan 21cfb2a4ad build: remove the bundled FIPS provider build 
--openssl-is-fips with bundled OpenSSL never worked: the
openssl-fipsmodule target had no dependency edge, so fipsinstall's
input was produced by nothing. Repairing it would not help, since a
FIPS provider built out of tree has no validation status.

Remove the machinery and restrict --openssl-is-fips to --shared-openssl.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:35 +01:00
Filip Skokan ee9ae88636 test,tools: drop OpenSSL 1.x-era FIPS leftovers 
The openssl_fips_*.cnf fixtures use OpenSSL 1.x syntax, and their test
branches can no longer run. Remove the fixtures and related version
gates while keeping the provider-backed FIPS assertions.

get_env_type() sniffed for a "-fips" version suffix that can no longer
occur, and the crypto-check lint rule listed a helper that no longer
exists.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:34 +01:00
Filip Skokan 7f16850ef6 doc: remove OpenSSL 1.x references 
Rename the openssl30 footnote, which marks APIs unavailable on
BoringSSL rather than ones requiring OpenSSL. Remove obsolete version
qualifiers from the provider and FIPS documentation, drop the "As of
OpenSSL 1.1.0" anchor from the PSK size limits, and point the man1.1.1
links at man3.0.

Document BoringSSL as the only backend with numeric key adapters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:33 +01:00
Filip Skokan acbc3ff133 test,benchmark: drop OpenSSL 1.x-only coverage 
Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish
is available only from OpenSSL's legacy provider and is absent from
BoringSSL.

The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks.
Remove legacy digest-alias coverage and unreachable OpenSSL 1.x
branches. JavaScript test and benchmark gates, skip reasons, and TLS
error expectations that distinguished OpenSSL 1.x from provider-backed
OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH
groups, private-key serialization, RSA-PSS parameters, consolidated
provider caches, FIPS availability, and empty KMAC output. Keep the CCM
alternate finalization error only for BoringSSL.

Provider-only test skips use version-neutral terminology or state the
actual minimum OpenSSL version.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:32 +01:00
Filip Skokan 8be36fb494 crypto: remove legacy OpenSSL code paths 
Remove the OpenSSL 1.x branches and stale version-specific assumptions
from src/. BoringSSL does not define OPENSSL_VERSION_MAJOR, so the
remaining version guards were excluding it as well; use
OPENSSL_IS_BORINGSSL checks instead, including the shared PKCS12 parser
and TLS PFX error handling.

Gate BoringSSL-only alternatives explicitly instead of leaving them
in #else branches, including the MAC/KMAC and OCB fallbacks. Fix the
BoringSSL guard on QUIC's unsupported-backend diagnostic.

Make the OpenSSL legacy-provider command-line help version-neutral.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:31 +01:00
Filip Skokan 85bfe9a938 deps: remove ncrypto legacy OpenSSL backend 
Remove the OpenSSL 1.x backend and its legacy dss1 digest aliases.
Rename the provider-backed path switch to NCRYPTO_USE_OPENSSL_PROVIDER
and rewrite the remaining version guards as OPENSSL_IS_BORINGSSL checks.

Remove version-adapter casts now that supported OpenSSL signatures are
uniform. Drop legacy digest-context, raw-key, seed, signature-context,
SM2, primality, and RSA2 key-detail fallbacks. Keep name-based key
algorithms and capability discovery, with numeric key adapters and
low-level key paths only for BoringSSL.

Use the same backend split for KDFs, PKCS#1 decoding, key serialization,
and provider EC/RSA key details. Gate BoringSSL-only alternatives
explicitly instead of leaving them in #else branches.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:30 +01:00
Filip Skokan 34e3b90621 build: require OpenSSL 3 or later 
configure now fails when --shared-openssl points at OpenSSL 1.x rather
than failing later at compile or link time. The check skips BoringSSL,
whose version macros claim 1.1.1.

Stop setting the OpenSSL 1.1 API compatibility level for bundled builds.
ncrypto selects the supported API level directly.

Update the assembler capability check, shared-library test matrix,
package fallbacks, and internal version-number typing for the new
baseline.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-10-25 22:36:29 +01:00
Guilherme Araújo e20da720c8 sqlite: validate backup() source is a Database 
backup() only checked that the source argument was a BaseObject before
casting it to Database, so passing a Statement or Session caused a
type confusion. Check against the Database constructor template
instead.

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66797
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
 2026-10-25 21:35:13 +00:00
Christian Aurich Zanettini Martins c7ae7ab5b9 vfs: fix readlink, realpath and mkdtemp encoding 
On a mounted VFS, `readlink()`, `realpath()` and `mkdtemp()` only
returned a Buffer for `{ encoding: 'buffer' }`. The string form
`'buffer'`, any other encoding, and a Buffer `mkdtemp()` prefix were
ignored. The `VirtualFileSystem` `readlink` and `realpath` methods
ignored the encoding with `MemoryProvider` and passed it on to
`RealFSProvider`, which threw `ERR_INVALID_ARG_TYPE` for `'buffer'`,
while for other encodings `realpath()` failed and `readlink()`
returned the host path of absolute targets.

Get these paths from the provider as strings and apply the encoding
to the result, normalizing the options with `getOptions()` and
converting with `encodeRealpathResult()` as `fs` does. The latter
moves to `internal/fs/utils` so the VFS can use it.

Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66352
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-10-25 17:19:12 +00:00
Antoine du Hamel 62b471723d test: adapt test-blocklist to libuv 1.53+ 
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/67002
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-10-25 16:54:41 +01:00
Matteo Collina 60e6c84f4e stream: keep async context of parked writes 
A TransformStream write that parks on backpressure was resumed from
the read that lifted the backpressure, so transform(), the writes
queued behind it, and flush() ran in the reader's async context
instead of the writer's. Capture the async context frame when the
write parks and restore it while the continuation runs, matching the
context the spec's [[backpressureChangePromise]] reaction had.

Fixes: https://github.com/nodejs/node/issues/66906

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66907
Fixes: https://github.com/nodejs/node/issues/66906
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-10-25 12:10:11 +00:00
Node.js GitHub Bot 3bc923a3e4 deps: update googletest to cd8e73f067129f8489e35c7b51c7a68552b289d2 
PR-URL: https://github.com/nodejs/node/pull/66814
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2026-10-25 11:56:04 +00:00
Filip Skokan b41fabb13c build: respect OpenSSL's configured API level 
Shared OpenSSL 3 builds configured with --api=1.1.1 reject
OPENSSL_API_COMPAT=30000. Cap the requested compatibility level at the
configured API level for both ncrypto targets, retaining the 3.0
deprecation checks where supported.

Fixes: https://github.com/nodejs/node/issues/66950
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66953
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-10-25 10:44:54 +00:00
Trevor Burnham 45ae12c3aa diagnostics_channel: fix dangling binding pointer 
`Channel` reads its subscriber count through a raw `BindingData*` that
was never cleared, so any native holder that outlives environment
cleanup reads a destroyed object. The null check in `HasSubscribers()`
could not fire, because the pointer was only ever assigned in the
constructor.

`node:sqlite` holds a strong `BaseObjectPtr<Channel>` for the lifetime
of a `Database`, which made this reachable from ordinary
JavaScript. A statement left mid-step at exit is finalized by the
destructor chain after `Environment::RunCleanup()` has destroyed the
binding, and `sqlite3_finalize()` invokes the profile callback for such
a statement. The result was a segfault at normal process exit; inside a
worker it took down the whole process.

Clear `binding_data_` on every `Channel` the binding owns whenever it
gives up that ownership, both in the destructor and in
`PrepareForSerialization()`, so that the existing null check in
`HasSubscribers()` does its job. The second check in `Publish()` is now
unreachable and is dropped. This protects any holder that is itself a
`BaseObject`, and so is destroyed later in the same cleanup. A holder
that is not a `BaseObject` still needs a cleanup hook or a weak
reference, because `Realm::~Realm()` checks that no `BaseObject`s
remain.

On the `node:sqlite` side, switch `Database::trace_channel_` to a
`BaseObjectWeakPtr`, so that it follows the same convention `permission`
documents, where `BindingData` is the sole owner of channels.
`TraceCallback` already null-checks, so this needs no other change
there.

Also check `AreTraceEventsSuppressed()` before the channel in
`TraceCallback()`, so that a suppressed callback does not dereference it
at all. `Statement::Finalize()` already suppresses trace events, so
the reported path was meant to be a no-op; only the order of the `||`
operands took it through the channel first.

Fixes: https://github.com/nodejs/node/issues/65858
Assisted-by: Claude Opus 5
Signed-off-by: Trevor Burnham <trevorburnham@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65860
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
 2026-10-25 07:24:48 +00:00
Trivikram Kamat cfb2de3db8 sqlite: skip return() on exhausted virtual table iterators 
Closing a virtual table cursor invoked the iterator's return() even
after next() had already reported done: true, deviating from for...of
semantics where return() only runs on abrupt termination. An empty
custom iterable with a throwing return() made an otherwise successful
query fail.

Only close the iterator when the scan stopped early, as with LIMIT, a
break, or a cursor re-filter; a normally finished iterator already ran
its cleanup.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66519
Fixes: https://github.com/nodejs/node/issues/66518
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
 2026-10-25 06:39:02 +00:00
Filip Skokan 9b5d938fad test: remove obsolete BoringSSL skips 
Run supported DH, ECDH, legacy TLS, TLS 1.2 PSK, cipher metadata,
raw key, and X.509 date cases with BoringSSL. Assert its DH flags,
curve format errors, and name-constraint behavior. Narrow key/cert
array exclusions to the failing multi-identity cases.

Use modp5 for the DH group setter checks and remove the unused legacy
protocol fallback helper.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-10-24 22:04:16 +00:00
Filip Skokan a0b4170764 tls: configure TLS 1.3 ciphers with BoringSSL 
Translate cipher-suite names into protocol IDs for BoringSSL's TLS 1.3
configuration API. Handle duplicates and unknown names, reject nonempty
lists without a supported suite, and implement honorCipherOrder through
preference flags.

Cover suite restrictions, explicit preference ordering, legacy-only
lists, runtime defaults, and command-line overrides.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-10-24 22:04:15 +00:00
Filip Skokan 7e58295439 crypto: wire up SHA-3 with BoringSSL 
Add SHA3-256, SHA3-384, and SHA3-512 to name lookup and getHashes().
BoringSSL exposes EVP_sha3_* descriptors but omits them from its
digest registry. Map the names directly to those descriptors so
node:crypto can use them too.

When using BoringSSL, limit WebCrypto SHA-3 support to digest
operations.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-10-24 22:04:14 +00:00
Filip Skokan a2ce2c6def tls,tools: update BoringSSL pin and TLS errors 
Use BoringSSL 0.20261020.0 for shared-library builds and expose the
package wrapper's version to the matrix updater.

The new verifier no longer emits UNABLE_TO_VERIFY_LEAF_SIGNATURE
after Node's verification callback accepts a missing-issuer error.
Expect UNABLE_TO_GET_ISSUER_CERT_LOCALLY for the affected leaf
certificates and suggest --use-system-ca for that error.

Drop the SSL_get_server_tmp_key() fallback now that BoringSSL supplies
SSL_get_peer_tmp_key() as a compatibility stub.

Refs: https://boringssl-review.googlesource.com/c/boringssl/+/103849
Refs: https://github.com/electron/electron/pull/55110/changes/b457e70e339e8bb3066b210edfb6f96582cdb374
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66922
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2026-10-24 22:04:13 +00:00