2026-09-08, Version 26.9.0 (Current) - #65881
Open
github-actions[bot] wants to merge 280 commits into
Open
Conversation
Three call sites still duplicated the ArrayIsArray check that validateArray already performs. Both files were already importing other validators next to these checks. The error code, argument name and expected type are unchanged, so the thrown error stays identical. The ArrayIsArray primordial is no longer used in histogram.js and is dropped from its destructuring; blocklist.js still uses it elsewhere. The existing tests only asserted the error code, so assertions covering the full error message are added for all three call sites. They pass both before and after this change. Refs: #64959 Assisted-by: claude:fable-5 Signed-off-by: JunHwan Choi <devjunsday@gmail.com> PR-URL: #65344 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Provide a binary export/import mechanism for histograms. Since there is no standard interchange format for histograms, using CBOR is meant to make the format as platform/runtime agnostic as possible while producing a compact/efficient result. No new dependency is introduced, we just encode the CBOR directly. Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode/Opus PR-URL: #65434 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #65434 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Describe how to run WPT modules, select source files or generated tests, and choose the existing thread or process backend. Document the WPTRunner options and remove duplicated run instructions. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65510 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: James M Snell <jasnell@gmail.com>
Add WPT_INSPECT to launch one generated main-thread test with --inspect-brk on an available port. Forward debugger stderr so an inspector client can attach while the child is paused. Require an exact generated test path and reject worker variants, whose test code runs in a nested Worker. Cover backend precedence, selector errors, inspector attachment, and clean shutdown. Refs: #51854 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65510 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: jakecastelli <38635403+jakecastelli@users.noreply.github.com> PR-URL: #65515 Reviewed-By: Jason Zhang <xzha4350@gmail.com> Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #65436 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Signed-off-by: Alexander Lichter <github@lichter.io> PR-URL: #64003 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
This removes a guard (no reads while write pending) that creates this deadlock, which was added as a security mechanism. This guard is redundant given then other existing mechanisms, and a test is added to demonstrate that. Signed-off-by: Tim Perry <pimterry@gmail.com> PR-URL: #65440 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Both tests read the destination file with no ordering guarantee against the fs.write() that Utf8Stream still has in flight, so under load the read can observe an empty file. In test-fastutf8stream-destroy the read is issued right after destroy(). In test-fastutf8stream-reopen it is ordered on 'drain', documented as emitted when the buffer has drained enough to allow continued writing, which says nothing about the bytes being observable in the file. The reopen path also emits a 'drain' of its own from a nextTick before the write has landed. Order both reads on 'write' instead, documented as emitted when a write operation has completed and emitted from #release() once the underlying write returned. In sync mode it is emitted from within write(), so the listener is attached before the write call. No data is lost by Utf8Stream here: re-reading the file after a failed assertion shows the expected content. This corrects an expectation of the tests, not the runtime. Signed-off-by: Christian Aurich <christian.aurichzm@gmail.com> PR-URL: #65554 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-08-20.md Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-08-26.md Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Tim Perry <pimterry@gmail.com> PR-URL: #65519 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Add type declarations for the `permission` internalBinding so lib/internal/process/permission.js gets editor autocomplete and type checking for `has()` and `drop()`. Signed-off-by: seungmin Nam <nhjbest22@g.skku.edu> PR-URL: #65385 Reviewed-By: James M Snell <jasnell@gmail.com>
Hmac.prototype._flush was aliased to Hash.prototype._flush, which finalizes the native HMAC context but never sets the JavaScript-side kFinalized flag. After an Hmac has been used as a stream, a subsequent Hmac.prototype.digest() call therefore still believes the object has not been finalized and calls into C++ a second time. On that second call the native context has already been reset, so the digest buffer is never written and Digest::MAX_SIZE bytes of uninitialized stack memory are returned to JavaScript. Hash is not affected because Hash::HashDigest caches its digest (refs #28245); Hmac never received the equivalent protection. Give Hmac its own _flush that sets kFinalized so repeat digest() calls after stream use are handled by the existing DEP0206 guard. As defense in depth, also set buf.len = 0 on the native side when the context has already been reset so unwritten bytes can never be emitted. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #65112 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
The previous fix (f67e45e) wrapped header/response event dispatch in reqAsync.runInAsyncScope(), but missed the stream.push(null) call that triggers the 'end' event. When END_STREAM arrives on a trailing HEADERS frame (as gRPC does), the 'end' event fires in the session's async context instead of the request's context. Wrap stream.push(null) at end-of-stream in reqAsync.runInAsyncScope() so that the 'end' event preserves the correct AsyncLocalStorage context. Refs: #55460 Signed-off-by: Orgad Shaneh <orgad.shaneh@audiocodes.com> PR-URL: #63814 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Other calls in initialization code often already check for null pointers via CHECK_NOT_NULL(). Do the same here. Signed-off-by: ndossche <7771979+ndossche@users.noreply.github.com> PR-URL: #63457 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>
Signed-off-by: Huáng Jùnliàng <jlhwung@gmail.com> PR-URL: #62352 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Measure construction and low-cost method paths for crypto classes whose state is stored in native or private slots. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65518 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Cache constructor-known KeyObject types in the existing private slot until a native handle is needed. Prime normal CryptoKey slot arrays from constructor arguments while retaining the native fallback for transferred keys. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65518 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Construct X509Certificate instances directly on the existing native X.509 wrapper and keep lazy cached values in private state. Use a non-throwing native brand check while preserving the existing structured-clone behavior. Preserve derived-constructor prototype semantics without rereading new.target.prototype. Add coverage for receiver validation, hidden state, prototype edge cases, subclassing, and structured cloning through workers and message ports. Replace the key-only instanceof lint rule with a module-aware crypto class guard and extend it to X509Certificate. Resolve references by lexical binding so shadowed constructor names remain valid. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65518 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
removeEventListener(type, fn, true) never matched a listener added the same way, because removeEventListener compared options?.capture === true directly while addEventListener flattened a boolean third argument via validateEventListenerOptions(). The underlying fix landed independently in #64894 (worker: add support for Web Workers), as a side effect of an unrelated refactor, so this PR now only adds the regression test that would have caught it. WPT does not cover this path: the EventTarget-removeEventListener.any.js test is skipped in test/wpt/status/dom/events.json. Fixes: #65244 Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com> PR-URL: #65245 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
fs.rmSync previously embedded paths directly into custom error messages while also passing the path to ThrowErrnoException. This caused duplicated paths for ASCII names and corrupted paths for non-ASCII directory names on Linux, and inconsistent path formatting on Windows. Remove path concatenation from custom messages and rely on ThrowErrnoException to attach the path safely. Add a test to cover non-ASCII directory names. Signed-off-by: Yeaseen <yeaseen.arafat96@gmail.com> PR-URL: #61233 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Release QUIC stream stats and state arena slots when the stream is destroyed instead of from the Stream destructor. Realm cleanup destroys QUIC binding data before draining remaining BaseObjects, so a stream that survives until process teardown must not need BindingData from its destructor. HTTP/3 header callbacks can synchronously destroy their stream. Check whether the stream was destroyed after those callbacks before accessing its arena-backed state, and make repeated native destruction safe after the slots have been released. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: codex:gpt-5.6-sol PR-URL: #65410 Fixes: #65408 Reviewed-By: James M Snell <jasnell@gmail.com>
Currently, any runtime gated experimental feature security vulnerability is considered a "valid" vulnerability, even if the work is still very much work in progress. This adds friction because it ends up requiring that things be compile time gated which makes it more difficult if there is not a corresponding CI job to run tests. This relaxes the policy a bit. For anything that is 1.0 and 1.1, a vuln report is only valid if it directly compromises a stable feature, allows a workaround that compromises a stable feature, etc. An example would be an obvious DOS vector that can be exploited even if the feature is not enabled, for instance. This gives us leeway to reject vuln reports on things that are enabled only by `--experimental-*` runtime flag that are still works in progress. Given it's complexity and active development, give ourselves coverage by specifically excluding QUIC/H3 from vuln reports. Any vuln reports received for QUIC, unless it's something that can compromise security of something else in Node.js when the `--experimental-quic` runtime flag is not enabled, should be handled as regular issues and not as security vulns Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #65438 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
When node itself is not position independent (the official Linux
binaries, and any build with a toolchain that does not default to PIE),
LIEF made room for the extra program header by moving the header table
into the largest gap between two PT_LOAD segments and extending the
earlier segment across that gap. Whenever the gap it picked was the one
between the read-only data and the read-write segment, whose boundary
is not page aligned, the extended segment ended inside the first page
of the next one. Linux 4.17 to 5.3, and RHEL 8's 4.18 kernel, map an
executable's segments with MAP_FIXED_NOREPLACE and refuse the second
mapping, so the single executable was killed with SIGSEGV before it ran
a single instruction ('elf segment at ... requested but the memory is
mapped already' in the kernel log). Which gap is largest depends on
section sizes, so roughly one build in three produced such binaries.
Ask LIEF to place the table after .bss for non-PIE executables instead,
which leaves every existing segment as the linker laid it out; the
output grows by the size of .bss. A test checks that no two PT_LOAD
segments of a --build-sea executable share a page.
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: #65564
Refs: nodejs/build#4433
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Bind the path, symbols, and functions getter templates to the DynamicLibrary constructor signature. This causes V8 to reject incompatible receivers before invoking the native callbacks, preventing them from crashing the process. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: codex:gpt-5.6-sol PR-URL: #65415 Fixes: #65287 Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Add contribution guidance and an advisory AgentScan warning for first-time pull request authors. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65533 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: kyungrae <kyungrae2002@gmail.com> PR-URL: #65450 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Document the lifecycle of node:test reporter events under Class: TestsStream, with an ASCII diagram that distinguishes declaration-order events from their execution-order twins (test:dequeue/test:complete), the leaf vs suite flow, and the run-level finale. Fixes: #51908 Signed-off-by: sangwook <rewq5991@gmail.com> PR-URL: #63780 Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #65431 Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: leah-1ee <selee3196@gmail.com> PR-URL: #65661 Reviewed-By: Filip Skokan <panva.ip@gmail.com>
ffi.getInt8() through ffi.getFloat64(), ffi.setInt8() through ffi.setFloat64(), ffi.toBuffer() and ffi.toArrayBuffer() return undefined instead of throwing when a required argument is omitted, so a call that read or wrote nothing cannot be told apart from one that read a zero byte. All 22 helpers behave this way. GetValidatedPointerAddress() and GetValidatedSize() already reject the same argument when it is passed explicitly as undefined. The args.Length() test in front of them short-circuits the call and returns Nothing without scheduling an exception. These six are the only tests in src/ where args.Length() can skip a call that throws; the only other Length() tests that guard a call at all guard Buffer::HasInstance(), which cannot throw. The remaining tests in this file guard an inline predicate and throw in the branch, which is why setUint8(ptr) reports "Expected an offset argument" while setUint8() reports nothing at all. Drop those tests. FunctionCallbackInfo::operator[] returns Undefined for an out-of-range index, which is exactly the value these validators reject, so each missing argument now produces the error its explicit undefined counterpart produces. The documentation already describes this behavior: the signatures are ffi.getInt8(pointer[, offset]), ffi.setInt8(pointer, offset, value) and ffi.toBuffer(pointer, length[, copy]), and the getters are documented to return a number or a bigint. ExportBytes() carried the same two tests. They are unreachable through the public API because exportBytes is not exported and its three callers all validate len in JavaScript first, but they are the same shape. Signed-off-by: Soul Lee <alus20x@gmail.com> PR-URL: #65500 Fixes: #65499 Refs: #62072 Refs: #62858 Refs: #65842 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #65788 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk> PR-URL: #65800 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk> PR-URL: #65688 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
V8 defaults `v8_enable_sandbox` to on whenever the shared pointer compression cage and the external code space are enabled, and that is the configuration embedders that use the sandbox build with. Now that the sandbox builds and passes the tests, follow that default for `--experimental-pointer-compression-shared-cage` so the configuration is reachable from `configure`. Multi-cage pointer compression builds stay without it: there every IsolateGroup gets its own sandbox, and `NodeArrayBufferAllocator` always allocates from the default one. Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #62237 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
The C++ fast path that fs.cpSync() takes when no filter is given created the destination directories with default permissions, so a 0700 directory came out of the copy as 0755 (with the default umask). The JavaScript implementation, which fs.cp(), fs.promises.cp() and fs.cpSync() with a filter still use, chmod()s every directory it creates to the mode of its source, and so did cpSync before the port. Set the source directory's permissions on each directory the copy creates (the destination root included); directories that already exist keep theirs, as before. Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #65488 Refs: #58461 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
fs.cp() and fs.promises.cp() walked the tree in JavaScript with several thread pool round trips per entry (opendir batches, two stat()s, the copyFile(), a chmod()), all awaited in sequence: a 2 100-file tree took ~215 ms with ~110 ms of that on the main thread, against ~36 ms for fs.cpSync(), which copies the tree in C++ when no filter is given. Factor that C++ walk into CopyDirRecursive(), which records the error instead of throwing so that it can run on any thread, and run it as one ThreadPoolWork request (CpDirJob) for fs.cp()/fs.promises.cp() when the destination directory does not exist yet and nothing has to run per entry (no filter, no dereference, permission model off). Copying into an existing tree keeps the JavaScript walk and its rules for what may already be there. The same tree now takes ~30 ms with under 1 ms on the main thread. For that job the walk follows the JavaScript walk's rules rather than cpSync's: it creates every directory with mkdir() and every file with an exclusive uv_fs_copyfile() (honouring the copyFile() mode flags) and fails with EEXIST if anything has appeared in their place since the JavaScript check, so it never opens or follows something it did not create; sockets, FIFOs and unknown entries are reported back to JavaScript, which rejects them with the same SystemErrors as before; relative link targets are made absolute lexically as path.resolve() does. cpSync keeps merging into existing directories, skipping special files and canonicalizing link targets. The walk now uses the error_code overloads of std::filesystem throughout (directory iteration included), so an unreadable directory inside the tree is reported as EACCES by both cp() and cpSync() instead of terminating the process, which cpSync() has done since the walk moved to C++. Filesystem errors raised inside the walk keep their codes, with 'cp' or 'copyfile'/'mkdir' as the syscall. With preserveTimestamps the walk stamps each directory it filled, root included, so cp() keeps preserving directory times and cpSync() without a filter now does too. Both file copies set the destination's mode before writing the data, which clears setuid and setgid, so the walk puts the source mode back after each file it copied; the JavaScript walk already chmod()s there. Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #65488 Refs: #58461 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
The GN build always compiles the bundled copies of brotli, c-ares, HdrHistogram, llhttp, libuv, nghttp2, SQLite and zstd, so anyone packaging a GN-built Node.js for a Linux distribution has no counterpart to configure's --shared-* options. Add node_shared_* args named after the GYP variables. When one is set, that dependency's GN template defines its target as a group carrying a pkg-config config instead of the bundled sources, so every existing "deps/<name>" reference picks up the system library without further changes, and config.gypi reports the choice like a GYP build does. Refs: #55903 Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #65797 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Build `v8_debug_helper.{so|dylib}` to enable V8 gdb/lldb postmortem
plugin support for the V8 version that Node.js built with.
Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: #65786
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Original commit message:
[objects]: Defer CallSiteInfo creation
Store the raw data in a FixedArray and create the CallSiteInfo objects
only on demand.
This can be further optimized to omit CallSiteInfo creation altogether
in some code paths, but currently those code paths are not critically important.
Change-Id: I6480862caf6b64020737527c571e3e3eac704ed3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7673818
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#106127}
Refs: v8/v8@ebd1578
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #65764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Original commit message:
[stack traces] Reduce stack frame summarization costs
During stack trace capture, Summarize() is the most expensive step — it
creates a full TranslatedState for every optimized frame even though
most frames are never inspected. This CL reduces that cost in two ways:
1. Lightweight Summarize() for optimized frames: instead of building a
full TranslatedState, walk only the deopt translation frame headers
and resolve function/receiver via ResolveTaggedValue(), falling back
to the full TranslatedState path for wasm-inlined or unresolvable
closures.
2. Deferred baseline frames: during CaptureSimpleStackTrace, baseline
frames store the raw Code + PC offset and defer bytecode offset
resolution to ExpandDeferredFrames(), which runs lazily before the
stack trace is formatted or inspected.
A new Torque bitfield flag (is_deferred_baseline_frame) marks entries in
the raw capture array that still need resolution. All consumers
(GetSimpleStackTrace, GetDetailedStackTraceFromCallSiteInfos,
GetFormattedStack, PrintCurrentStackTrace) call ExpandDeferredFrames()
before processing the array.
Change-Id: I1fe8cce918ba129d655d66f608ac6aa0ed160920
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7722138
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#106237}
Refs: v8/v8@74e153d
Refs: v8/v8@c9c0abf
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #65764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Original commit message:
[stack traces] Fall back to full walk when receiver is unboxed
The lightweight OptimizedJSFrame::Summarize path added in
crrev.com/c/7722138 assumed that closure and receiver are always
encoded as LITERAL or TAGGED_STACK_SLOT in the deopt translation.
This holds for the closure (a JSFunction reference is always tagged)
but not for the receiver: the "receiver" slot in an InterpretedFrame
translation is just parameter 0 of the (possibly inlined) frame and
is emitted via BuildDeoptFrameSingleValue, which encodes it according
to the value's representation. An inlined frame whose `this` was
typed as Float64 ends up as DOUBLE_STACK_SLOT, hitting UNREACHABLE in
ResolveTaggedValue.
Rename ResolveTaggedValue to TryResolveTaggedValue, return
std::optional, and fall back to SummarizeFull when the receiver isn't
a directly-resolvable tagged value.
Fixed: 499260582
Change-Id: I1f9cdd28e4b6b76a253a46e43b248d9239a4ecd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7748309
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#106423}
Refs: v8/v8@1a00890
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #65764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
aduh95
force-pushed
the
v26.9.0-proposal
branch
from
September 7, 2026 16:11
c561d20 to
ea09fd0
Compare
aduh95
added a commit
that referenced
this pull request
Sep 7, 2026
Notable changes: crypto: * (SEMVER-MINOR) add a generic MAC API (Filip Skokan) #65553 * (SEMVER-MINOR) discover ciphers from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) discover hashes from OpenSSL providers (Filip Skokan) #65484 doc: * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) #65593 ffi: * (SEMVER-MINOR) enable module by default (Matteo Collina) #65475 lib: * (SEMVER-MINOR) implement node:bench (James M Snell) #65606 meta: * refine the security vuln posture for experimental features (James M Snell) #65438 perf_hooks: * (SEMVER-MINOR) implement Histogram meanCI API (James M Snell) #65606 * (SEMVER-MINOR) add CBOR export/import for histogram exchange (James M Snell) #65434 src: * (SEMVER-MINOR) let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352 src,lib: * (SEMVER-MINOR) implement experimental DTLS API (James M Snell) #63182 vfs: * (SEMVER-MINOR) integrate with CJS and ESM module loaders (Matteo Collina) #63653 worker: * (SEMVER-MINOR) add support for Web Workers (Aviv Keller) #64894 PR-URL: #65881
aduh95
force-pushed
the
v26.9.0-proposal
branch
from
September 7, 2026 16:16
ea09fd0 to
28bd0ba
Compare
aduh95
added a commit
that referenced
this pull request
Sep 7, 2026
Notable changes: crypto: * (SEMVER-MINOR) add a generic MAC API (Filip Skokan) #65553 * (SEMVER-MINOR) discover ciphers from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) discover hashes from OpenSSL providers (Filip Skokan) #65484 doc: * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) #65593 ffi: * (SEMVER-MINOR) enable module by default (Matteo Collina) #65475 lib: * (SEMVER-MINOR) implement node:bench (James M Snell) #65606 meta: * refine the security vuln posture for experimental features (James M Snell) #65438 perf_hooks: * (SEMVER-MINOR) implement Histogram meanCI API (James M Snell) #65606 * (SEMVER-MINOR) add CBOR export/import for histogram exchange (James M Snell) #65434 src: * (SEMVER-MINOR) let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352 src,lib: * (SEMVER-MINOR) implement experimental DTLS API (James M Snell) #63182 vfs: * (SEMVER-MINOR) integrate with CJS and ESM module loaders (Matteo Collina) #63653 worker: * (SEMVER-MINOR) add support for Web Workers (Aviv Keller) #64894 PR-URL: #65881
aduh95
marked this pull request as ready for review
September 7, 2026 16:19
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #65614 Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #65614 Reviewed-By: James M Snell <jasnell@gmail.com>
Notable changes: crypto: * (SEMVER-MINOR) add a generic MAC API (Filip Skokan) #65553 * (SEMVER-MINOR) discover ciphers from OpenSSL providers (Filip Skokan) #65484 * (SEMVER-MINOR) discover hashes from OpenSSL providers (Filip Skokan) #65484 doc: * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) #65593 ffi: * (SEMVER-MINOR) enable module by default (Matteo Collina) #65475 lib: * (SEMVER-MINOR) implement node:bench (James M Snell) #65606 meta: * refine the security vuln posture for experimental features (James M Snell) #65438 perf_hooks: * (SEMVER-MINOR) implement Histogram meanCI API (James M Snell) #65606 * (SEMVER-MINOR) add CBOR export/import for histogram exchange (James M Snell) #65434 src: * (SEMVER-MINOR) let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352 src,lib: * (SEMVER-MINOR) implement experimental DTLS API (James M Snell) #63182 vfs: * (SEMVER-MINOR) integrate with CJS and ESM module loaders (Matteo Collina) #63653 worker: * (SEMVER-MINOR) add support for Web Workers (Aviv Keller) #64894 PR-URL: #65881
aduh95
force-pushed
the
v26.9.0-proposal
branch
from
September 7, 2026 16:26
28bd0ba to
b37bb62
Compare
aduh95
approved these changes
Sep 7, 2026
Collaborator
|
CI: https://ci.nodejs.org/job/node-test-pull-request/77152/ |
Contributor
Author
Changelog@@ -16,0 +17,8 @@
+/nix/store/93m11ia5mwwmk9yp157zkf8bl83l2986-abseil-cpp-20260107.1 (aarch64-darwin)
+/nix/store/kby3f9rpgvmqy5hsbnf33211iyw1mlc8-abseil-cpp-20260107.1 (aarch64-linux)
+/nix/store/9iy9w6mqpjbhcym3cf4dvcwx8z0fqhb2-abseil-cpp-20260107.1 (x86_64-darwin)
+/nix/store/bw3y1jl96xv3nplfv4hpzgij5l33jfdd-abseil-cpp-20260107.1 (x86_64-linux)
+/nix/store/8fhpp08zmzvrkpjbi5j4s9wzbfmhpjl1-abseil-cpp-20260107.1-dev (aarch64-darwin)
+/nix/store/rkxhknyx88fzn02vbh0w6jzr9fi12a35-abseil-cpp-20260107.1-dev (aarch64-linux)
+/nix/store/69mn1s5i3b8d6bxh18imnp8fm9f0jfip-abseil-cpp-20260107.1-dev (x86_64-darwin)
+/nix/store/rscary19rj16kvywqqnkn380dxz2i1wx-abseil-cpp-20260107.1-dev (x86_64-linux)
@@ -486,0 +495,4 @@
+/nix/store/hjr35k1yq2f7rm3j5hmxn8gb6za4557r-jemalloc-5.3.0-unstable-2025-09-12 (aarch64-darwin)
+/nix/store/01sxs0dygizxrpi68ns4ch3gdv25vilj-jemalloc-5.3.0-unstable-2025-09-12 (aarch64-linux)
+/nix/store/8f7ndm2gn04xa7089iikd77qycypfvy8-jemalloc-5.3.0-unstable-2025-09-12 (x86_64-darwin)
+/nix/store/fpf6nabl7s37fxyx4f27mmnxcwazbbrj-jemalloc-5.3.0-unstable-2025-09-12 (x86_64-linux)
@@ -602,0 +615,4 @@
+/nix/store/077acjdv5divn0pffvz0yxzqck1nm9ik-libhwy-1.3.0 (aarch64-darwin)
+/nix/store/k3ga5zgc77hzrd7hxik72pfd84yxfs2r-libhwy-1.3.0 (aarch64-linux)
+/nix/store/icvfgmqhbqiv2cinqf75b2abk38zy26h-libhwy-1.3.0 (x86_64-darwin)
+/nix/store/014jxvsrwbqv5l6ibyjammkyi80cwlsz-libhwy-1.3.0 (x86_64-linux)
@@ -838,0 +855,4 @@
+/nix/store/xya4zy2f463yfzipmxvy2pxm5b1gw0m4-libyaml-0.2.5 (aarch64-darwin)
+/nix/store/z27lhbwzcx0zjn3wjqv797rnw5m486j9-libyaml-0.2.5 (aarch64-linux)
+/nix/store/dvarchpp13i33rm7acxjldsajlpk0d4p-libyaml-0.2.5 (x86_64-darwin)
+/nix/store/5by3i4053gppzf3ci7ygv1mj8gjhp6mk-libyaml-0.2.5 (x86_64-linux)
@@ -1318,0 +1339,8 @@
+/nix/store/b27xnafjjpy07dr7qjiwj04agaf704yk-perfetto-sdk-58.2 (aarch64-darwin)
+/nix/store/kiwsc84kxcg8n465nkd5k2hbkyqv555q-perfetto-sdk-58.2 (aarch64-linux)
+/nix/store/s7l1dywyvb5hj4zgmkm5156h06lqwa9w-perfetto-sdk-58.2 (x86_64-darwin)
+/nix/store/bal0a4hdwd9x32vmfgzbkhbr3f80ygid-perfetto-sdk-58.2 (x86_64-linux)
+/nix/store/dm9p6rnr204982vw5vw6q55j16w4vqkq-perfetto-sdk-58.2-dev (aarch64-darwin)
+/nix/store/pxfrag2k2pxmxc48wr9gdpzmqg9mas0m-perfetto-sdk-58.2-dev (aarch64-linux)
+/nix/store/w2c535v3i80mk2nn4lg2by23m1lz6842-perfetto-sdk-58.2-dev (x86_64-darwin)
+/nix/store/si74y3znclrxhd43pj3qi445iz08rz9j-perfetto-sdk-58.2-dev (x86_64-linux)
@@ -1502,0 +1531,4 @@
+/nix/store/8sznlbjn2dlq29x9s01lx3616f46xgby-protobuf-34.1 (aarch64-darwin)
+/nix/store/9nhaq7n5l6r6dq110a3qf9slnrbggyml-protobuf-34.1 (aarch64-linux)
+/nix/store/wpklc2ahh4vfip8i8zjkj47qc05kcn45-protobuf-34.1 (x86_64-darwin)
+/nix/store/ccj85ihhvb51dx0ql1kanwd31my50zwr-protobuf-34.1 (x86_64-linux)
@@ -1520,0 +1553,16 @@
+/nix/store/iblkhb2ma6kzfp4h18yk7m9dc8wgh9jy-python3.13-pathspec-0.12.1 (aarch64-darwin)
+/nix/store/jk4fd3xp3pb6mv320lx9zpbwxdbibp6i-python3.13-pathspec-0.12.1 (aarch64-linux)
+/nix/store/3x5srsy0agan4d1jqizkbn7ws14gxl45-python3.13-pathspec-0.12.1 (x86_64-darwin)
+/nix/store/pdjdz9mqsj6az0znlrgh2fj6wp1rb032-python3.13-pathspec-0.12.1 (x86_64-linux)
+/nix/store/2hipkj74d1jkh5y0fl0zq3w50b0mq39c-python3.13-pyyaml-6.0.3 (aarch64-darwin)
+/nix/store/p8sajismwcq0jc23g6jmbablbwj22hzj-python3.13-pyyaml-6.0.3 (aarch64-linux)
+/nix/store/gajdg005yjbw5x9lbf4ldc5cm38ml7hn-python3.13-pyyaml-6.0.3 (x86_64-darwin)
+/nix/store/jl0mxihyizv77l66mzbvmv49iiri72sd-python3.13-pyyaml-6.0.3 (x86_64-linux)
+/nix/store/0yhwlrn6j4bpk8pqz0p5a53ml2a1h00v-python3.13-yamllint-1.37.1 (aarch64-darwin)
+/nix/store/m9g8qnggdzc6pjdw7w21vaywmlix2ccn-python3.13-yamllint-1.37.1 (aarch64-linux)
+/nix/store/s7aj93h2895lmyk13c6ypn22rsd6nf36-python3.13-yamllint-1.37.1 (x86_64-darwin)
+/nix/store/jx6bzribg9fa0mxbr8b602rq74k24dr7-python3.13-yamllint-1.37.1 (x86_64-linux)
+/nix/store/32s4c8qgg8lch0y6k4cqxs09qkyazjw9-python3.13-yamllint-1.37.1-dist (aarch64-darwin)
+/nix/store/14lw229a8sjsbfjvjj97b3m0jc11q147-python3.13-yamllint-1.37.1-dist (aarch64-linux)
+/nix/store/xx2yyh67vr217s8iv5gmkdhsibmqrdrw-python3.13-yamllint-1.37.1-dist (x86_64-darwin)
+/nix/store/sdyqiyd0aw6n3fv2fj33srgvqi779rsp-python3.13-yamllint-1.37.1-dist (x86_64-linux)
@@ -1596,0 +1645,8 @@
+/nix/store/0fcj69kr6hnp5lbkym155qync8sdnkhr-re2-2025-11-05 (aarch64-darwin)
+/nix/store/gi78v68qvvhpp8k4xr7rvkqmzir5c8ms-re2-2025-11-05 (aarch64-linux)
+/nix/store/bwgi0wlqj8avcmf9bykdkyhinkaa7ydg-re2-2025-11-05 (x86_64-darwin)
+/nix/store/m44fcgqfymlyjgjqkpp6a0m7zjh3846i-re2-2025-11-05 (x86_64-linux)
+/nix/store/7vcmsjx75jp2lysbcs6yx3wzllhwadw6-re2-2025-11-05-dev (aarch64-darwin)
+/nix/store/3qinzq6shjz8yc45i85d3kyvfalaldby-re2-2025-11-05-dev (aarch64-linux)
+/nix/store/aksmv6lzn5rywab1231lgjd5d4xbqg3i-re2-2025-11-05-dev (x86_64-darwin)
+/nix/store/hn3ihwvcn7vb00j4v3ymz0kvil78j3q6-re2-2025-11-05-dev (x86_64-linux)
@@ -1608,0 +1665,4 @@
+/nix/store/vaqnnrhxwmj73hwn8jwcs1q6ix17fd2k-ruff-0.15.12 (aarch64-darwin)
+/nix/store/b4hb3zim99khxjl4ncliy5pm9gzkq9ba-ruff-0.15.12 (aarch64-linux)
+/nix/store/wbrlvj0zkrchsnwyd0l6s36nzvfpq9hm-ruff-0.15.12 (x86_64-darwin)
+/nix/store/97mrhz21xc7dx218i36m6s9jyi7q5469-ruff-0.15.12 (x86_64-linux) |
|
Is #65759 intentionally excluded from this release or might be an oversight? |
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
93248801fa] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #655539b52db81eb] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484d0d300f01f] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484616bd3fa26] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #655934e69bef69a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475815971b646] - (SEMVER-MINOR) lib: implementnode:bench(James M Snell) #65606db036ea65e] - meta: refine the security vuln posture for experimental features (James M Snell) #65438962c3f5451] - (SEMVER-MINOR) perf_hooks: implement HistogrammeanCIAPI (James M Snell) #6560690871a34bb] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352d86d7467e4] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182e1c807a029] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #636530efd1f20b5] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894Commits
136b93b386] - (SEMVER-MINOR) benchmark: implement node:bench version of bench tools (James M Snell) #65606dcbb380d88] - benchmark: fix max-regressions detection in compare.js (James M Snell) #655876062fc3ed1] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #655943c78e86a11] - benchmark: add crypto class benchmarks (Filip Skokan) #655183f9236ab57] - buffer: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #656052f74486b3e] - buffer: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #65430ec6b06e7bc] - build: add--shared-perfettoflag (Antoine du Hamel) #65614bc73deae06] - build: enable V8 gdb/lldb plugin support (Chengzhong Wu) #657865d4743f787] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #65797c58d762461] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #6223765af3265b2] - build: add--shared-highwayconfigure flag (Antoine du Hamel) #65686d1938db8bc] - build: add--shared-abseilconfigure flag (Antoine du Hamel) #65682b452598b4e] - build: skip dockit on riscv64 (Stewart X Addison) #622516019418b8c] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708cdbd354e72] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #654917e7e3fb1c8] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #6546425711392a7] - build: remove obsolete configure flags (Chengzhong Wu) #654569d741c0d44] - build,src: make --use-largepages a no-op (Joyee Cheung) #653896fd0785458] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #6553556c43c7809] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649471147554f] - crypto: cache valid ECDH key pairs (Filip Skokan) #656154e7015fb6c] - crypto: add strict mode to --force-fips (Filip Skokan) #656452aef11a140] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #65645aab6dd1ca4] - crypto: fix public PKCS8 export error (한국) #6560993248801fa] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #655538861722a7a] - crypto: validate JWK usages before key_ops (Filip Skokan) #6555037df4ace61] - crypto: fix private SPKI export error (Filip Skokan) #655503b203bf5fc] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #65550358bf6a42e] - crypto: correct CCM decryption FIPS error message (kyungrae) #654500f3c615e16] - crypto: harden X509Certificate state (Filip Skokan) #65518cee1dbd260] - crypto: optimize key slot caching (Filip Skokan) #655188106d02a54] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457a7524cbfaf] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #65112b2faeb6d55] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #65503ae6136e7ab] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #655039b52db81eb] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484d0d300f01f] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484d83195c904] - deps: V8: backport 1a0089053443 (Jakob Linke) #657642f0cfb6e8a] - deps: V8: backport c9c0abfa51f0 (Jakob Linke) #657648f85acde4a] - deps: V8: backport ebd15783b7ba (Marja Hölttä) #65764f173cc9dc4] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #657880e1443ba2c] - deps: V8: backport f3d4d458fe59 (Olivier Flückiger) #6570299ce7997ae] - deps: upgrade npm to 11.19.1 (npm team) #65573cf05a2ef43] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #656538abc083a24] - deps: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #6565488b68ce745] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #65655d5641acccf] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #65656cde19de6f1] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494221f4d5d37] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542f40e994d24] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542b25de1e47c] - diagnostics_channel: lazily create tracing context (Romain Lanz) #6551398ce82a93e] - doc: replacenode:modulesdocumentation header (René) #6580090fccc4cbf] - doc: clarify node:bench significance policy (James M Snell) #65631b6224d374f] - doc: clarify isolation modes for node:bench (James M Snell) #65631e1ce4bcb21] - doc: clarify measurement integrity details of node:bench (James M Snell) #656319fd38db97b] - doc: clarify return type offs.mkdtemp*(Antoine du Hamel) #657431905d1f27e] - doc: updatechangelog-makerinstructions for releasing (Juan José) #657074fc60f4283] - doc: add stability status tocrypto.setEngine(Antoine du Hamel) #6574671b953786d] - doc: remove outdated TLS authorized warning (Tim Perry) #65597bcd6da7d1f] - doc: fix brokenusinglink in ffi.md (Soul Lee) #656326aedc56a82] - doc: fix some broken links (Antoine du Hamel) #655831c981284a7] - doc: fix stale TOC in maintaining-dependencies (greenhead) #65523b353cd6d90] - doc: refactor the AI guidelines (Joyee Cheung) #65269922d4c4c37] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #645835b4521f4c8] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #64605ba1b44016b] - doc: clarify stream direction in options.stdio note (Avocado) #65236c98bb5210d] - doc: clarify signal listener behavior (Som Samantray) #6524391132e3eab] - doc: add test reporter event lifecycle diagram (sangwook) #6378023f26eecb2] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436037d651caa] - (SEMVER-MINOR) doc: move histogram.burnRate to correct location in doc (James M Snell) #65434a4d1801fa3] - doc: fix default limit of maxHeadersCount (Aryn H) #65472286cfd6ef0] - doc: fix return types for sync methods (Chiang Fong Lee) #585753b96fd8b33] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342cd0350fa65] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #64993616bd3fa26] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #65593992c5f6b4b] - errors: validate constructor name (Christian Aurich) #656074b7abe8652] - events: fix weak listener retention overwrite (Aryan) #64024bfbc810698] - ffi: throw on missing memory helper arguments (Soul Lee) #655008b9d2bd9c3] - ffi: include SharedArrayBuffer in error message (Donghoon Kang) #657354e69bef69a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475de27fd7fd3] - ffi: validate DynamicLibrary getter receivers (Trivikram Kamat) #6541536f0fd92fb] - fs: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) #65488b19703450c] - fs: give directories created by cpSync the source directory's mode (Shelley Vohr) #65488bb4d42cfac] - fs: write files in one thread pool round trip (Shelley Vohr) #65489e1de66d3f1] - fs: handle recursive watch setup races (Filip Skokan) #65699187b299842] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #64817f2f6420a79] - fs: improve performance of recursive directory read (Aviv Keller) #655241609883139] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435a6d4389438] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486fb1c62fed2] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #655406be311eb68] - fs: fix recursive watch error handling (Filip Skokan) #656351918001482] - fs: cancel in-flight stat on abort (Mert Can Altin) #631421c4c3ed083] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #61233a7856ab8bc] - fs: add maxDepth option to glob (Alexander Lichter) #640037c9e2f5e7a] - http: fast-forward teardown of unread messages (Matteo Collina) #657326ead515f7f] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987d52e9bcea9] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #63814fee97e10e4] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440c6733257f5] - https: limit proxy CONNECT response headers (Matteo Collina) #64545f19dd1b23a] - lib: fixup node:bench handling of --require option (James M Snell) #65631468ca1b218] - lib: improve diagnostic message support (James M Snell) #6563136092932d3] - lib: have runFile honor permissions and accept URL/Buffer paths (James M Snell) #65631c71d7eb625] - lib: add runFile api to node:bench (James M Snell) #656316252e4c141] - lib: add context.diagnostic api to node:bench (James M Snell) #6563110922e867a] - lib: addbench:planevent tonode:bench(James M Snell) #6563100d1beac8e] - lib: clarify mean in node:bench docs (James M Snell) #6563151056b1238] - lib: improve node:bench stream handling (James M Snell) #6563184cad252f7] - lib: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) #656318aab969310] - (SEMVER-MINOR) lib: addnode:benchexplicit createRunner (James M Snell) #65606f2c71ef63a] - (SEMVER-MINOR) lib: complete the implementation of node:bench and cli (James M Snell) #65606295c6ff719] - (SEMVER-MINOR) lib: implement bench/reporters (James M Snell) #65606815971b646] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606d34c3af68e] - lib: useFloat16Arrayfrom primordials (Antoine du Hamel) #6570276239139a6] - lib: defer source map payload decoding until first use (Shelley Vohr) #6549086c0a7f1a5] - lib: optimize async context frame activation (Tim Perry) #655195196a5610d] - lib: use validateArray for array arguments (JunHwan Choi) #65344aa9df8134b] - lib: apply minor dtls cleanups (James M Snell) #635397323695969] - lib,benchmark: address multiple review issues (James M Snell) #65631884e123059] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738a580c7ea20] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714843d2a453b] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #6571756b96e95c7] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #6571878e634a3ab] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #65719418d4ffa22] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720555696f1b1] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #657219a999cc581] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #6572255f7ac136f] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723b091d933bf] - meta: document collaborator automation (Filip Skokan) #65671db036ea65e] - meta: refine the security vuln posture for experimental features (James M Snell) #654381f57046f1c] - module: derive builtinModules from enabled builtin set (Jungwon Sohn) #65418d4a624a7d4] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125f1f6d17e84] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #63619027d5285ee] - net: improve dtls cert verification (James M Snell) #6431475fcb1b6ec] - node-api: make object property arrays const (Yilong Li) #6562100add61659] - node-api: enter env context for async callbacks (Shelley Vohr) #65406962c3f5451] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #656069ff86e471d] - perf_hooks: add missing resource timing attributes (greenhead) #65017587b9219e3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #6543407d004cf22] - permission: do not enforce fs and addons in audit mode (Issac) #65659e46f5e1781] - permission: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) #65492f78b2477ee] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431ade523a3e2] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688310505e38a] - quic: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) #655221db96e7c30] - quic: remove unused fin flag from blob reader wakeup (trivenay) #6531502e0f3a41e] - quic: apply multiple fixes to flow control signaling (James M Snell) #65309c6789e89dc] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410b880395a37] - sea: mount bundled assets as a virtual file system (Matteo Collina) #65675aeb78a5015] - sea: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) #655649cc829a9ce] - sqlite: re-validate database state after reading options (Trevor Burnham) #65595113180ad3f] - sqlite: run backup completion in callback scope (Filip Skokan) #656669bf28b5e90] - sqlite: copy changeset before applying it (Matteo Collina) #6528621f18aafe7] - sqlite: reject closing a session from a callback (Trevor Burnham) #65454035a9b8bfd] - sqlite: keep sessions alive across SQLite callbacks (Trevor Burnham) #6546509202e8a6b] - sqlite: throw on disposal of an in-use session (Guilherme Araújo) #654498cfe7ae316] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #65630b2eb582785] - (SEMVER-MINOR) src: fixup histogram and options linting issues (James M Snell) #6560662a0e088f7] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #6568490871a34bb] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #653520dfd6910f7] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520a2548a08b4] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #6540775e93e9980] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327e7c28635d8] - src: reuse cached strings in CompileSerializeMain (agape1225) #65453527f148556] - src: add missing vector include (Filip Skokan) #656228909c749f3] - src: disable V8 external memory reasonable size check (Paul Bouchon) #65589d2bc30f865] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517f4908cc50d] - src: list scripts when--runhas no command (James Ross) #646066d7428a7e2] - src: fixup manual new/delete usages (James M Snell) #65348caf49636dc] - src: make the options structs smaller with packed bits (James M Snell) #65145faa7bb1e67] - (SEMVER-MINOR) src, lib: add stats to dtls (James M Snell) #6318264920aecd6] - (SEMVER-MINOR) src,lib: add dtls interop tests (James M Snell) #63182d86d7467e4] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #631828ef4099968] - stream: use webidl validation semantics for args (James M Snell) #6565862864329cd] - stream: ensure that stateful transforms preserve this (James M Snell) #656584010e69bce] - stream: fix nested async flushing with infinite sources (James M Snell) #6565857b6aa43dd] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #656580acd81b05f] - stream: apply source normalization once at call time (James M Snell) #65658203ce337fc] - stream: make consumer signals on longer alter source precedence (James M Snell) #656580895ba3a35] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658088841e10a] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #656588fdf23efef] - stream: ensure pre-existing writes drain before EOF and end() waits (James M Snell) #656585b67a2e8f5] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #6565829ce7076d2] - stream: ensure factory signals remain active through closing (James M Snell) #65658c4a1726ea2] - stream: canWrite and ondrain now reflect physical capacity (James M Snell) #656582c3091649d] - stream: skip unobserved 'readable' emission at EOF (Matteo Collina) #657496c0fb9a31c] - stream: avoid per-chunk promises in webstream adapters (Matteo Collina) #655487a1fc2bae4] - stream: address stream/iter review feedback (James M Snell) #65652ba9144aee4] - stream: replace object sentinel with symbol (James M Snell) #65652217a5de4d1] - stream: ensure pipeToSync requires synchronous close (James M Snell) #65652ab1f40d2e3] - stream: cancel active stream/iter pulls (James M Snell) #6565221cc4b7ee6] - stream: fix merge settlement tagging and falsy error tracking (James M Snell) #656521ba8787e07] - stream: ensure full-close semantics when closed (James M Snell) #656529a9246a108] - stream: defend against re-entrancy in writev (James M Snell) #656522b5e062d1d] - stream: ensure stability of stored metadata (James M Snell) #656524f7b87e91b] - stream: fixup writer to terminate on consumer return/throw (James M Snell) #656520ae81818b4] - stream: ensure iterator cleanup on done, reject, etc (James M Snell) #6565216451fcee1] - stream: fixup cancelation handling in pull() (James M Snell) #6565281abe3b61f] - stream: fix early drain after Utf8Stream reopen (Matteo Collina) #65633004fb74ce4] - test: make node:bench test samples survive a coarse clock (Shelley Vohr) #657804d0a496223] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #65780c05754826e] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #657808a1049848c] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #6578092be49ecc4] - test: do not dump core in external memory limit test (Shelley Vohr) #6578075fd2be86b] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780afa67db61e] - test: handle EPIPE in closed channel test (Christian Aurich) #65770f02dcb1fe3] - test: deflake test-permission-net-udp-handle (Christian Aurich) #65767f7973c59dc] - test: zero-fill buffers before the string length limit check (Christian Aurich) #65755f8cad072ea] - test: expand test coverage of node:bench (James M Snell) #656319d50f9d445] - test: deflake test-runner-coverage (Christian Aurich) #657287279329120] - (SEMVER-MINOR) test: fix node:bench test timing (James M Snell) #65606e00a51a228] - (SEMVER-MINOR) test: improve node:bench test coverage (James M Snell) #65606d3cd1c8425] - (SEMVER-MINOR) test: update bench tests to not fail on no-crypto (James M Snell) #65606b570e180e2] - test: fix flaky cleanup in http2 test (Tim Perry) #657018c90fa8d87] - test: set type=none on IBM i for empty source (Abdirahim Musse) #655458095849aaf] - test: bump WPT webidl and interfaces (Filip Skokan) #656791311e08e02] - test: deflake WASI poll timing checks (Filip Skokan) #656721304474083] - test: skipfs-watch-recursive-delete-raceon AIX (Antoine du Hamel) #656985173d2ecb9] - test: update WPT for url to c23755a144 (Node.js GitHub Bot) #65651b84e0d7ab8] - test: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) #655848916332504] - test: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) #656239966aa0722] - test: fix recursive fs.watch error fixture (Filip Skokan) #6568347dc433038] - test: avoid orphaned child on Windows abort test (Kirill Saied) #6545106ecd220e2] - test: update streams WPT (Jeong SeokChan) #65638cadab22284] - test: removeconsole.logcall innode_run_list(Antoine du Hamel) #655726438c5b218] - test: expect node:ffi to be enabled by default (Matteo Collina) #6563696fc61a151] - test: fix link-local dgram scope assertion (Filip Skokan) #65629fe95256225] - (SEMVER-MINOR) test: use native builder for legacy SEA tests (Filip Skokan) #65553f01ddafe07] - test: riscv64: skip node-api sea test (Stewart X Addison) #65569aa51e43121] - test: mark platform-specific tests as flaky (Filip Skokan) #655628507c27bf6] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #655423e908d12d3] - test: use common spawnSync helpers in more tests (greenhead) #65552b925c8f694] - test: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) #6524506ef4e98a7] - test: deflake fastutf8stream destroy and reopen tests (Christian Aurich) #65554566f819f8b] - test: cover Readable.from() sync iterator errors (jakecastelli) #6551575096a61d9] - test: support inspecting WPTs in child processes (Filip Skokan) #65510b351c90309] - test: document WPT runner workflows (Filip Skokan) #65510dd8c8c9982] - test: simplify test-worker-heap-profile.js (Donghoon Kang) #653729dc9ac3c7e] - test: keep WPT backend checks alive (Filip Skokan) #653205e4c04c134] - (SEMVER-MINOR) test: enable multi-global WPTs (Filip Skokan) #648948c924691dd] - (SEMVER-MINOR) test: add opt-in process WPT runner (Filip Skokan) #64894553d94e21d] - (SEMVER-MINOR) test: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) #64894a62dd97b70] - test: fix lint in dtls tests (Matteo Collina) #64902714a7875eb] - tls: read the peer certificate chain without consuming it (Tony Gies) #656021347b738f6] - tls,quic: commonize TLS cert handling between tls, dtls & quic (Tim Perry) #64711b4f5d35463] - tools: add GHA workflow to test vendored Perfetto (Antoine du Hamel) #65614b7c6d9a958] - tools: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot[bot]) #65757cbb2a044a8] - tools: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot[bot]) #657587904e13923] - tools: do not hardcodeyamllintpath (Antoine du Hamel) #657475ee2c12305] - tools: refine contributor guidance workflow (Filip Skokan) #657456b22649dbf] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #65716af67dc717d] - tools: do not flag force push as invalid message (Antoine du Hamel) #65700aa0fc9e0a6] - tools: do not hardcode path to Ruff (Antoine du Hamel) #656813abe134a11] - tools: retry first-time contributor query (Filip Skokan) #65648033e7272d0] - tools: query first-time contributor status (Filip Skokan) #655925814d60e7b] - tools: offset GitHub crons by 3 minutes (Michaël Zasso) #65612655a8cd1d9] - tools: label PRs lacking second approval (Filip Skokan) #655388823a5c27a] - tools: welcome first-time contributors (Filip Skokan) #6553336aaae885e] - tools: enable concurrency for eslint (Huáng Jùnliàng) #62352cd933a0f89] - tools: fix the list of globals in ESLint config files (Antoine du Hamel) #65281c7237fe400] - typings: fix fs_event_wrap start filename type (leah-1ee) #65661733a010527] - typings: add fs_event_wrap internal binding types (leah-1ee) #65661257820c8ae] - typings: add stream_pipe internal binding types (Seongeun Lee) #656645ac3370e32] - typings: add profiler internal binding types (Seongeun Lee) #6566015bba9898e] - typings: add ffi internal binding types (Donghoon Kang) #657341c36206c60] - typings: add types for performance binding (Jungwon Sohn) #655740aef8ceb6b] - typings: update zlib binding declarations (이혜미) #65639f4aa1a6b7f] - typings: add encodeIntoResults to EncodingBinding (greenhead) #653508d8dca006a] - typings: add typing for permission binding (Seungmin Nam) #65385ed80eef48d] - url: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) #65498c3d0976242] - util: canonicalize namespaced tags in inspect() (René) #632577254bc1217] - v8: add setHeapProfileNearHeapLimit (Ilyas Shabi) #64676fb8ed6bd88] - vfs: load native addons from a mounted file system (Philipp Dunkel) #656805c869646be] - vfs: fix rename over non-empty directory (Christian Aurich) #6561301f2e2ee3a] - vfs: add ZipProvider (Philipp Dunkel) #64915e1c807a029] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #6365343d0442e08] - worker: start worker threads from the built-in snapshot (Shelley Vohr) #653362aafc4cb89] - worker: add ref/unref to web workers (Aviv Keller) #65507257c712bb2] - (SEMVER-MINOR) worker: add wpt tests for Web Workers (Aviv Keller) #648940efd1f20b5] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894211ec5ac4c] - zlib: avoid waiting for paused ZIP iterators (Trivikram Kamat) #65278