48772 Commits
Author SHA1 Message Date
Node.js GitHub Bot 49072a0be4 2026-10-07, Version 26.11.0 (Current)
Notable changes:

buffer:
  * (SEMVER-MINOR) add isLatin1 (James M Snell) https://github.com/nodejs/node/pull/66298
  * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) https://github.com/nodejs/node/pull/66064
build, doc:
  * move to redesign (Aviv Keller) https://github.com/nodejs/node/pull/62045
doc:
  * promote Alpine Linux to tier 2 support (Stewart X Addison) https://github.com/nodejs/node/pull/63737
http:
  * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) https://github.com/nodejs/node/pull/66334
http2:
  * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) https://github.com/nodejs/node/pull/65619
perf_hooks:
  * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) https://github.com/nodejs/node/pull/66115
  * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) https://github.com/nodejs/node/pull/66114
  * (SEMVER-MINOR) add histogram.diff() (James M Snell) https://github.com/nodejs/node/pull/66099
  * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) https://github.com/nodejs/node/pull/66099
  * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) https://github.com/nodejs/node/pull/66098
process:
  * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) https://github.com/nodejs/node/pull/66213
sqlite:
  * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) https://github.com/nodejs/node/pull/65988
src:
  * (SEMVER-MINOR) add --process-timeout=N (James M Snell) https://github.com/nodejs/node/pull/66138
  * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) https://github.com/nodejs/node/pull/65737
  * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) https://github.com/nodejs/node/pull/66067

PR-URL: https://github.com/nodejs/node/pull/66546
v26.11.0
2026-10-06 13:15:55 +02:00
Stewart X Addison 6f6296fef9 doc: promote Alpine Linux to tier 2 support
kernel >= 6.12, musl >= 1.2.5 updated to align with
lowest supported version Alpine Linux 3.21
see https://alpinelinux.org/releases/
see https://alpinelinux.org/posts/Alpine-3.21.0-released.html

Alpine 3.22 listed as example version

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/63737
Backport-PR-URL: https://github.com/nodejs/node/pull/66353
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-10-06 13:14:41 +02:00
Node.js GitHub Bot 53b3a053a2 test: update test426-fixtures to 9ea66b466fd37e8a4050033d23b3e1480973c3d
PR-URL: https://github.com/nodejs/node/pull/66493
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
2026-10-06 12:37:26 +02:00
Node.js GitHub Bot ef1a602283 test: update WPT for WebCryptoAPI to 3127c3a492
PR-URL: https://github.com/nodejs/node/pull/66492
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-06 12:37:26 +02:00
Node.js GitHub Bot 8c556ab2b6 deps: update histogram to 0.12.0
PR-URL: https://github.com/nodejs/node/pull/66494
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2026-10-06 12:37:25 +02:00
Node.js GitHub Bot 55af1dcded crypto: update root certificates to NSS 3.129
This is the certdata.txt[0] from NSS 3.129.

This is the version of NSS that shipped in Firefox 157.0 on 2026-09-29.

[0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_129_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: https://github.com/nodejs/node/pull/66496
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
2026-10-06 12:37:25 +02:00
Trivikram Kamat 41e9ab96cd watch: escape quotes and backslashes in NODE_OPTIONS
When stripping watch flags, NODE_OPTIONS is tokenized and rejoined
for the child process. Values were only re-quoted if they contained
a space, and nothing inside the quotes was escaped. A value with a
double quote made the child fail with "unterminated string", and a
backslash inside a quoted value was silently dropped.

Quote values that contain a space or a double quote, and escape
backslashes and double quotes inside the quotes, so the child
tokenizes the string back to the same values.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66363
Fixes: https://github.com/nodejs/node/issues/66362
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
2026-10-06 01:43:12 +02:00
dependabot[bot] bec7c53400 meta: bump github/codeql-action/analyze from 4.38.0 to 4.38.2
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/66443
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-10-06 01:42:26 +02:00
dependabot[bot] 39d721abed meta: bump github/codeql-action/autobuild from 4.38.0 to 4.38.2
Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/66444
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-10-06 01:42:26 +02:00
dependabot[bot] 963804db4d meta: bump github/codeql-action/init from 4.38.0 to 4.38.2
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/66446
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-10-06 01:42:26 +02:00
dependabot[bot] 5837ef8608 meta: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.2
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/66447
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-10-06 01:42:26 +02:00
Yuya Inoue df96c928a2 tools: limit checkout for lint-cpp
Skip the V8 and OpenSSL vendored trees when checking out sources for
lint-cpp. Keep other paths included so new directories are checked out
by default.

Assisted-by: Codex
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66474
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-06 01:42:25 +02:00
Gaby Baghdadi 9f1db461d2 build: update common.gypi for z/OS
- Don't use icu data file on z/OS; use libnode's bundled ICU data.
- Include required defines, cflags, ldflags, and remove unsupported
  ones, following switch to clang compiler.
- Remove _ALL_SOURCE, as _POSIX_C_SOURCE and _POSIX_SOURCE already
  enable all required library functions (in deps/uv/CMakeLists.txt, only
  _OPEN_SYS is required to enable setgroups (in grp.h) instead of
  _ALL_SOURCE); also remove dup _OPEN_SYS_SOCK_IPV6.
- Add -D_EXT to defines (for setenv, and vsam.js' `__KEY_*` macros).
- Add _POSIX_C_SOURCE=200809L to enable at least `utimensat`.
- Add clang option -mzos-target=zosv2r5 also to ldflags, otherwise the
  default LE dataset is used that may not be for the current target.
- Add -m64 to ldflags, otherwise ld passes `AMODE=31,LIST,..` to
  the binder, causing unresolved symbols if the non-64 suffixed version
  of the compiler was used (e.g. ibm-clang instead of ibm-clang64).
- Add zoslib/include-wrappers/c++ in include_dirs for custom aligned new
  and delete operators.

PR-URL: https://github.com/nodejs/node/pull/66449
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Gaby Baghdadi <baghdadi@ca.ibm.com>
Signed-off-by: Richard Lau <richard.lau@ibm.com>
2026-10-06 01:42:25 +02:00
Gaby Baghdadi 0002037b3f build: update configure.py for z/OS
Signed-off-by: Gaby Baghdadi <baghdadi@ca.ibm.com>
PR-URL: https://github.com/nodejs/node/pull/66449
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2026-10-06 01:42:25 +02:00
Ved Chaudhari a341ac460a build: fix vcbuild format-md install and exit
Install the Markdown linter before formatting and exit afterwards.

Assisted-by: Claude Code
Signed-off-by: vedchaudhari <vedc2853@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66475
Refs: https://github.com/nodejs/node/pull/66467
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
2026-10-06 01:42:25 +02:00
Yuya Inoue 593c96446c tools: limit format-cpp checkout history
Use the first parent of the PR merge commit as the formatting base,
allowing a depth-two checkout instead of fetching the full history.

Assisted-by: Codex
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66479
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
2026-10-06 01:42:25 +02:00
Ved Chaudhari bec52d9103 build: fix vcbuild lint skipping lint-md-build
Jump to lint-md-build so vcbuild lint installs the Markdown linter.

Assisted-by: Claude Code
Signed-off-by: vedchaudhari <vedc2853@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66467
Refs: https://github.com/nodejs/node/pull/61318
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
2026-10-06 01:42:25 +02:00
Matteo Collina 158f6f78d4 stream: share webstreams async iterator methods
ReadableStream.prototype.values() built each iterator from an object
literal with a computed symbol-key method plus five closures. Such a
literal is rebuilt through the runtime on every evaluation, costing
close to a microsecond per iterator, which dominates iterating a
short-lived stream.

Move next() and return() to a shared ReadableStreamAsyncIterator
prototype, as for any WebIDL async iterator, and keep the per-iterator
state in its read request. The prototype chain and property shape are
the ones WPT checks; the placeholder AsyncIterator object in util.js is
no longer needed. As in WebIDL, next() and return() now reject when
called on something that is not a ReadableStream async iterator, and
iterators no longer carry own next/return properties.

Add an async-iterator kind to benchmark/webstreams/lifecycle.js.

webstreams/lifecycle.js kind='async-iterator'   ***  +16.22%

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66392
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
2026-10-06 01:42:25 +02:00
James M Snell aff60171cd util: make mime parsing faster
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/66369
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2026-10-06 01:42:16 +02:00
Tim Perry 7702a50e08 http2: add new connectionWindowSize option
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65619
Backport-PR-URL: https://github.com/nodejs/node/pull/66167
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
2026-10-05 18:23:30 +02:00
Filip Skokan 4251b8b1f9 tools: share CI and benchmark build configuration
Benchmark builds kept Temporal enabled on macOS after the Nix default
changed, while shared-library CI disabled it. This forced benchmarks
to rebuild V8 instead of reusing the cached derivation.

Define the common build defaults in a Nix shell used by CI, benchmark
builds, and the V8 cache job to keep their configurations aligned.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66351
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2026-10-03 18:00:34 +02:00
Matteo Collina 6487d36873 http: avoid dictionary-mode objects in responses
`setHeader()` stored headers in a `{ __proto__: null }` literal and
`OutgoingMessage` let EventEmitter create the same literal for its
listener table. V8 creates null-prototype literals in dictionary mode,
so every response paid for a hash table allocation on the first
`setHeader()`/`on()` call and for dictionary lookups on every header
access, including the `for...in` in `_storeHeader()`.

Use a fast-mode object with an empty null-prototype chain for the
headers, and preset the listener table with the common events, as
streams already do.

Hello-world server (`res.setHeader()` + `res.end()`), one core:
40.9k -> 50.0k req/s (+22%); CPU 24.4 -> 20.0 us/req; 4374 -> 3905 B
of young-gen allocation per request. Responses are byte-identical.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66420
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
2026-10-03 18:00:33 +02:00
James Ross bb3d33e610 zlib: fix abort with decodeStrings: false
Passing decodeStrings: false to a zlib stream, or to an async
convenience method, let strings reach the native handle, which
aborts the process on its Buffer check. Force decodeStrings back to
true, as is already done for encoding and objectMode.

Signed-off-by: James Ross <james@jross.me>
PR-URL: https://github.com/nodejs/node/pull/66359
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-03 17:59:39 +02:00
Antoine du Hamel 6948dd1232 tools: fix nixpkgs updater script
We only want the first match, which by convention is the global pin the
script is meant to update.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66337
Refs: https://github.com/nodejs/node/actions/runs/36284249504/job/108521854021
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
2026-10-03 17:49:51 +02:00
Matteo Collina f8d30110b6 http: cache parser callbacks
Cache the per-message callback lookups on the parser's JS object instead
of retaining callback functions in strong v8::Global handles. A callback
that captures its parser can otherwise keep the parser alive.

Clear the cache when a parser is initialized or freed so reused parsers
can load replacement callbacks and idle parsers do not retain them.
Header field names remain non-internalized because they are supplied by
clients.

Assisted-by: pi
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66152
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
2026-10-03 17:48:55 +02:00
Matteo CollinaandClaude Fable 5.1 e3f861b23e tools: wait for test processes instead of polling
RunProcess polled the child with an exponential backoff that capped at
100 ms, so every test longer than roughly 300 ms paid 30-75 ms of
latency after it had already exited. Across the parallel suite that
adds up to about 160 thread-seconds.

Block in wait() instead and let a timer thread deliver the kill when
the timeout is crossed. Set the shutdown flag from the SIGINT handler
so a worker whose child died from the same ctrl-c does not report it
as a failure before the main thread aborts the run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UH48w8TCtYmHd4P2UE6HEY
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66432
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
2026-10-03 17:30:28 +02:00
Donghoon Kang 021f7d8d98 ffi: accept safe integer numbers for 64-bit arguments
Allow safe integer numbers as int64 and uint64 arguments alongside
bigint values. Reject negative numbers for uint64 and numbers outside
the safe integer range. Keep 64-bit return values as bigint.

Apply validation and conversion across the Fast API, shared-buffer,
and generic argument conversion paths.

Add coverage for Number and BigInt boundaries, invalid inputs, and
single-argument calls before and after optimization.

Signed-off-by: HoonDongKang <d159123@naver.com>
Assisted-by: Codex:Astra-medium
PR-URL: https://github.com/nodejs/node/pull/66197
Fixes: https://github.com/nodejs/node/issues/66198
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
2026-10-03 17:30:28 +02:00
Trivikram Kamat edbff8caf1 src: fix --process-timeout message when exit waits
process.exit(), uncaught exceptions and unhandled rejections exit
through Environment::Exit(), which never calls OnEnvironmentStopping().
If a Worker blocked in a synchronous native call held up that exit past
the deadline, the watchdog blamed the main thread.

Check Environment::is_stopping() and report that the process did not
finish exiting instead.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66361
Fixes: https://github.com/nodejs/node/issues/66360
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
2026-10-03 17:30:28 +02:00
Yuya Inoue 14cc5877d7 tools: avoid repeated subtree scans in must-call-assert
Match the promise call chain before checking for a descendant return
statement, preserving the existing lint checks.

Assisted-by: Codex
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66408
Refs: https://github.com/nodejs/node/issues/64972
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
2026-10-03 17:30:28 +02:00
Matteo Collina 11c3d7115d benchmark: add implicit-framing case to http/set-header
The existing `setHeader` and `setHeaderWH` cases set `Content-Length`
explicitly, and `normal` passes every header to `writeHead()`. The very
common handler shape `res.setHeader(...)` + `res.end(body)`, where
`end()` derives the framing, exercises a different path and was not
covered.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66420
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
2026-10-03 17:30:28 +02:00
Miodrag Obradovic 83a1697f1c util: fix inspect indentation of detached DataView
formatExtraProperties() raised ctx.indentationLvl before reading the
property. The getters of a detached DataView throw, so the level was
never lowered again, and the DataView and everything inspected after it
in the same call ended up indented too far. Read the value first.

Signed-off-by: Miodrag Obradovic <mck097@gmail.com>
Assisted-by: a closed-source coding agent
PR-URL: https://github.com/nodejs/node/pull/66421
Refs: https://github.com/nodejs/node/pull/60131
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-03 17:30:28 +02:00
Antoine du Hamel 7fb76f9554 tools: add cache to lint-js-and-md
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66412
Refs: https://github.com/nodejs/node/issues/64972
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
2026-10-03 17:30:28 +02:00
Mert Can Altin 9fa31096d4 crypto: improve random synchronous number generation performance
Instead of creating a RandomBytesJob object, it calls CSPRNG()
directly now.

Assisted-by: Claude Code
Signed-off-by: Mert Can Altin <mertgold60@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66348
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2026-10-03 17:30:28 +02:00
dependabot[bot] 9015b992d0 tools: bump brace-expansion in /tools/clang-format
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.18 to 1.1.21.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/66418
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2026-10-03 17:30:27 +02:00
Filip Skokan 6c5806b53c test: wait for ZIP source streams to close
A destroyed read stream can still have a pending open or close. Wait for
closure before removing the temporary files, so cleanup cannot race a
pending open and cause ENOENT in test-zlib-zip-files.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66429
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-10-03 17:30:27 +02:00
Filip Skokan 4706cafc59 test: mark worker init failure flaky on SmartOS
Track the descriptor-dependent V8 entropy failure until the libuv update
in #66282 removes the dependency on opening /dev/urandom.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66428
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-03 17:30:27 +02:00
Filip Skokan c19e2cedd2 test: deflake process timeout report cleanup
The grandchild can briefly outlive the timed-out process while it waits
to detect its parent's exit. Give it a working directory outside the
test's temporary directory so it does not block cleanup on Windows.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66428
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-03 17:30:27 +02:00
Filip Skokan 1047188452 test: split process timeout report coverage
Move the blocked Worker case into its own test.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66428
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-03 17:30:27 +02:00
Trivikram Kamat 53fd8e7ebb ffi: remove permission checks from dlclose and dlsym
The docs describe `ffi.dlclose(handle)` and `ffi.dlsym(handle, symbol)`
as equivalent to `handle.close()` and `handle.getSymbol(symbol)`, but
only the functions called `checkFFIPermission()`. After
`process.permission.drop('ffi')`, `ffi.dlclose(lib)` threw
`ERR_ACCESS_DENIED` while `lib.close()` succeeded.

Remove the checks so the functions defer to the handle. Permission is
already checked when the `DynamicLibrary` is constructed, and dropping
a permission does not revoke resources that are already open.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66426
Fixes: https://github.com/nodejs/node/issues/66425
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
2026-10-03 17:30:27 +02:00
Christian Aurich Zanettini Martins da32c79034 fs: keep timestamps of files skipped by cpSync
With `force: false` and `preserveTimestamps: true`, the native
directory copy used by `cpSync()` left existing destination files in
place but still copied the source timestamps onto them. The JavaScript
walk, used by `cpSync()` with a `filter` and by `fs.cp()`, leaves
those files untouched.

Only copy the timestamps of files that were actually copied, as is
already done for their mode.

Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66305
Reviewed-By: Anna Henningsen <anna@addaleax.net>
2026-10-03 17:30:27 +02:00
dependabot[bot] 84db29179a tools: bump brace-expansion from 5.0.9 to 5.0.12 in /tools/eslint
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.9 to 5.0.12.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.9...v5.0.12)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.12
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/66417
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2026-10-03 17:30:27 +02:00
Jungwon Sohn dc6ef03ab6 module: centralize builtin exposure policies
Keep scheme-only and option-gated builtin exposure rules in the
JavaScript loader. Leave option registration and code-cache
categorization with their native owners.

Assisted-by: Codex
Signed-off-by: sjungwon03 <sjungwon03@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66292
Refs: https://github.com/nodejs/node/pull/65418
Refs: https://github.com/nodejs/node/pull/65964
Refs: https://github.com/nodejs/node/pull/65920
Refs: https://github.com/nodejs/node/pull/65840
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
2026-10-03 17:30:27 +02:00
Joyee Cheung 430262ecb0 test: do not hardcode V8 serialization header
The header changes when V8 is updated. Do not hardcode it to
avoid breaking V8 updates. The update should only surface in
test/parallel/test-v8-serdes.js

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66442
Refs: https://github.com/nodejs/node/pull/65161
Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-10-03 17:30:26 +02:00
Node.js GitHub Bot 4387cb46d2 deps: update timezone to 2026e
PR-URL: https://github.com/nodejs/node/pull/66419
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2026-10-03 17:30:26 +02:00
Matteo Collina afa02fb69c process: use a class for nextTick resources
The resource created for each `process.nextTick()` call was an object
literal with three computed symbol keys. V8 builds such literals from a
boilerplate that only covers the static keys, so the symbol-keyed
properties end up in a separate property array allocated per tick, and
each computed-key store goes through the runtime.

Construct the resource through a class instead, so that every tick
object shares one map with all five fields in-object.

process/next-tick-breadth-args.js: ~1.58M -> ~1.95M ops/s (+23%).

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66415
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
2026-10-03 17:30:26 +02:00
Trivikram Kamat fa7efaf782 ffi: validate pointer ranges in optimized calls
On x64 SysV and arm64, a Fast API signature with two or more
arguments that uses only pointer and float types got no JS wrapper.
V8 then truncated pointer BigInts silently. With `-1n` or
`2n ** 64n + 5n`, cold calls threw ERR_INVALID_ARG_VALUE, while
optimized calls passed 0xffffffffffffffff or 5 to native code.

Use the argument wrapper for any signature with a pointer argument.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66371
Fixes: https://github.com/nodejs/node/issues/66370
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
2026-10-03 17:30:26 +02:00
Trivikram Kamat 11f80798ba ffi: throw on allocation failure in toArrayBuffer()
The copy path of toArrayBuffer() allocated its backing store with
V8's default failure mode, so a large length aborted the process
with a fatal out-of-memory error. toBuffer() throws a catchable
ERR_MEMORY_ALLOCATION_FAILED for the same input.

Allocate with kReturnNull and throw ERR_MEMORY_ALLOCATION_FAILED
when the allocation fails. The memory is left uninitialized because
memcpy() fills it right after.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: https://github.com/nodejs/node/pull/66406
Fixes: https://github.com/nodejs/node/issues/66405
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
2026-10-03 17:30:26 +02:00
Aviv Keller 150c96ef3f deps: V8: cherry-pick c795f5948568
Original commit message:

    [immutable-array-buffer] Fix check order in TypedArray.prototype.set

    According to the spec, TypedArray.prototype.set checks
    IsImmutableBuffer(target.[[ViewedArrayBuffer]]) before converting
    the offset argument to integer and before reading from the source
    object.

    Additionally, when setting from a TypedArray source, reading from an
    immutable source TypedArray is permitted, so the source array should
    be validated using TypedArrayAccessMode::kRead rather than kWrite.

    Drive-By: Add a fast case for Smi indices where the steps are not
              observable and we can fold all checks.

    TAG=agy
    CONV=94aa3be8-9990-41fe-a565-c62e3daa9a42

    Bug: 450237486
    Change-Id: I21790be90cde9a96ba7c1f573f034016d9c29850
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8252528
    Reviewed-by: Igor Sheludko <ishell@chromium.org>
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Auto-Submit: Olivier Flückiger <olivf@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#109366}

Refs: https://github.com/v8/v8/commit/c795f5948568dc7c5cce585928b9a6acb307ca82
PR-URL: https://github.com/nodejs/node/pull/66380
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
2026-10-03 17:30:26 +02:00
René cd814e7f23 src: remove orphaned js_udp_wrap test binding
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/66399
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
2026-10-03 17:30:26 +02:00
René a952647d86 tools: keep OpenSSL update PRs in draft until arch configs committed
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/66398
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
2026-10-03 17:30:26 +02:00