Skip to content

Fix dependabot cooldown#13

Merged
RafaelGSS merged 104 commits intomainfrom
fix-dependabot-cooldown
Oct 3, 2025
Merged

Fix dependabot cooldown#13
RafaelGSS merged 104 commits intomainfrom
fix-dependabot-cooldown

Conversation

@RafaelGSS
Copy link
Copy Markdown
Owner

No description provided.

mertcanaltin and others added 30 commits September 16, 2025 09:57
PR-URL: nodejs#59071
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Adds the `signatureAlgorithm` property to a X509Certificate allowing
users to retrieve a string representing the algorithm used to sign the
certificate. This string is defined by the OpenSSL library.

Fixes: nodejs#59103
PR-URL: nodejs#59235
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
The bind method uses ObjectDefineProperty that shows up
in flamegraphs. This changes it to avoid the utility.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#59867
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
PR-URL: nodejs#59891
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
PR-URL: nodejs#59888
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Do not add a trailing slash if it was not removed by resolve in
ToNamespacedPath.

PR-URL: nodejs#59847
Fixes: nodejs#58223
Refs: nodejs#56110
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
This reduces the impact of
https://redirect.github.com/nodejs/node/pull/59679
by delaying the require.cache population of ESM until they
are directly required. After that, it's necessary for them
to be in the cache to maintain correctness.

PR-URL: nodejs#59874
Refs: nodejs#59868
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
In the testing proxy server for proxy client tests, the proxy
client might have already closed the connection when the upstream
connection fails. In that case, there's no need for the proxy
server to inform the proxy client about the error.

PR-URL: nodejs#59742
Fixes: nodejs#59741
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59892
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Update `tools/make-v8.sh` so that it can work with either `gcc` or
`clang`.

Adds:
- clang settings when CC/CXX environment variables set to clang/clang++.
- Turns off warnings as errors.

Removes:
- goma settings.
- Machine specific settings (moved to Jenkins job configuration).

Refs: https://chromium-review.googlesource.com/c/v8/v8/+/5541431
PR-URL: nodejs#59893
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Previously, you could either add no 'upgrade' event handler, in which
case all upgrades were ignored, or add an 'upgrade' handler and all
upgrade attempts would effectively succeed and skip normal request
handling. This change adds a new shouldUpgradeCallback option to HTTP
servers, which receives the request details and returns a boolean that
controls whether the request should be upgraded.

PR-URL: nodejs#59824
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This pr introduces the support for tagged templates
And an LRU to cache the templates. We introduced a
new object called SqlTagStore that holds the ref
to Lru. This acts as the main object that allows
us to use tagged templates.

PR-URL: nodejs#58748
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
If any depdencies actually need to run the scripts, the corresponding
script can add --no-ignore-scripts.

PR-URL: nodejs#59914
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#59901
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: nodejs#59901
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
This patch makes the off-thread loading lazy and only done when the
`tls` builtin is actually loaded by the application. Thus if the
application never uses tls, it would not get hit by the extra
off-thread loading overhead. paving the way to enable --use-system-ca
by default.

PR-URL: nodejs#59856
Reviewed-By: James M Snell <jasnell@gmail.com>
This patch makes the certificate pre-loading thread load the bundled
and extra certificates from the other thread as well.

PR-URL: nodejs#59856
Reviewed-By: James M Snell <jasnell@gmail.com>
Otherwise the debug() calls would attempt to display it and throws
an error.

PR-URL: nodejs#59905
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#59910
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Expose `hasTopLevelAwait` and `hasAsyncGraph` on
`vm.SourceTextModule`.

`hasAsyncGraph` requires the module to be instantiated first.

PR-URL: nodejs#59865
Fixes: nodejs#59656
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: nodejs#59884
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
This is required to use HTTP/1 websockets on an HTTP/2 server, which is
fairly common as websockets over HTTP/2 is much less widely supported.

This was broken by the recent shouldUpgradeCallback HTTP/1 addition,
which wasn't correctly added to the corresponding allowHttp1 part of
the HTTP/2 implementation.

PR-URL: nodejs#59924
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: nodejs#59923
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Using a C++20 `concept` here makes `is_callable` much simpler
than relying on SFINAE. It is equivalent for function types,
`std::function`, lambdas, and classes with `operator()`,
regardless of argument or return types.

PR-URL: nodejs#58169
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
This refactors internal validation helpers in `child_process` to use
the common validators in `lib/internal/validators.js` where possible.

This improves code consistency and maintainability.

PR-URL: nodejs#59416
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#59687
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Check that we lose the execution flow in the outer context, upon
resolving a promise created in in the inner context.

PR-URL: nodejs#59801
Fixes: nodejs#59541
Refs: https://issues.chromium.org/issues/441679231
Refs: https://groups.google.com/g/v8-dev/c/YIeRg8CUNS8/m/rEQdFuNZAAAJ
Refs: https://tc39.es/ecma262/#sec-newpromiseresolvethenablejob
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Consider the default context A with a microtask queue QA, and a
context B with its own microtask queue QB.

Context B is constructed with vm.createContext(..., {microtaskMode:
"afterEvaluate"}). The evaluation in context B can be performed via
vm.Script or vm.SourceTextModule.

The standard (https://tc39.es/ecma262/#sec-newpromiseresolvethenablejob)
dictates that, when resolving a {promise} with {resolution}, from any
context, the {then} method on {promise} should be called within a task
enqueued on the microtask queue from the context associated with {then}.

Specifically, after evaluating a script or module in context B, any
promises created within B, if later resolved within A, will result in a
task to be enqueued back onto QB, even long after we are done evaluating
any code within B.

This creates a challenge for users of node:vm in "afterEvaluate" mode.
In ContextifyScript::EvalMachine() and in ModuleWrap::Evaluate(), we
only drain the microtask queue QB a single time after running the script
or evaluating the module. After that point, the queue will not be
drained unless another script or module is evaluated in the same
context.

In the following scenario, prior to this patch, the log statement will
not be printed:

	const microtaskMode = "afterEvaluate";
	const context = vm.createContext({}, {microtaskMode});
	const source = "";
	const module = new vm.SourceTextModule(source, {context});
	await module.link(() => null);
	await module.evaluate();
	console.log("NOT PRINTED");

Within `evaluate()`, there is this `await` statement:

	await this[kWrap].evaluate(timeout, breakOnSigint)

Since the promise returned by ModuleWrap::Evaluate() is the top-level
capability for {module}, a promise created within B, V8 will enqueue a
task on QB. But since this is after the PerformCheckpoint() call in
ModuleWrap::Evaluate(), the task in QB is never run. In the meantime,
since QA is empty, the Node process simply exits (with a warning about
the unsettled promise, if it happened to be a top-level await).

While being unable to do `await module.evaluate()` is clearly a problem,
more generally, it is intended that in "afterEvaluate" mode, promises
created in the inner context cannot make progress if, and until, the
microtask queue of the inner context is checkpointed.

Therefore, to address this issue, the fix is narrow:

When the module has its own microtask queue, i.e. in "afterEvaluate"
mode, the inner-context promise returned by
v8::SourceTextModule::Evaluate() is first resolved to an outer-context
promise, then we checkpoint the microtask queue of the inner context,
then we return the outer-context promise we just built.

This ensures that in the statement `await this[kWrap].evaluate(...)`,
the promise returned can be resolved within the outer context, without
involving the microtask queue in the inner context.

Fixes: nodejs#59541
Refs: https://issues.chromium.org/issues/441679231
Refs: https://groups.google.com/g/v8-dev/c/YIeRg8CUNS8/m/rEQdFuNZAAAJ
PR-URL: nodejs#59801
Refs: https://tc39.es/ecma262/#sec-newpromiseresolvethenablejob
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Restore the Buffer.isBuffer() check to avoid unnecessary Buffer.from()
calls when the input is already a Buffer. This improves performance
by 30-50% for buffer-heavy UDP operations.

Includes benchmark test for fixBufferList function to verify the
performance improvements across different data types and chunk sizes.

PR-URL: nodejs#59934
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
addaleax and others added 29 commits September 30, 2025 15:37
In these places we can just generate `std::string` directly, so
there's no need to convert to an intermediate C string.

PR-URL: nodejs#60055
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Both of these are already implemented on the superclass.

PR-URL: nodejs#60056
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
If we can just use the classic `THROW_...()` methods directly,
without needing to allocate an `std::string` for the message/format
parameter, let's just do so.

PR-URL: nodejs#60057
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Modernize the code so there is no need to work with raw C strings
anymore.

PR-URL: nodejs#60058
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Refs: nodejs#59911
PR-URL: nodejs#59978
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: nodejs#60068
Refs: nodejs#59553
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
In particular, this enables passing `std::string_view` instead.

PR-URL: nodejs#60052
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
If we can use a `std::string_view` instead of a `std::string`, let's
just do that instead.

PR-URL: nodejs#60052
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: nodejs#59928
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
PR-URL: nodejs#60067
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Add assertion to verify that the MessagePort's message event is
actually emitted in test-worker-message-port-infinite-message-loop.js.
Previously, the test could pass even if the event was not fired.

PR-URL: nodejs#59885
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
PR-URL: nodejs#59996
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Abdirahim Musse <abdirahim.musse@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
The `env` parameter for `process.execve` is documented to default
to `process.env`.

PR-URL: nodejs#60029
Refs: nodejs/build#4156
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
I won't have enough time to contribute to Node.js to stay as a TSC
member for a while so moving myself to emeritus.

Signed-off-by: Michael Dawson <midawson@redhat.com>
PR-URL: nodejs#60070
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Abdirahim Musse <abdirahim.musse@ibm.com>
PR-URL: nodejs#60014
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#60072
Fixes: nodejs#59963
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
PR-URL: nodejs#60045
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: nodejs#60073
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Abdirahim Musse <abdirahim.musse@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs#60012
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: nodejs#60047
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Refs: nodejs/build#4083
Closes: nodejs#58069
PR-URL: nodejs#60079
Fixes: nodejs#58069
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Refs: nodejs/build#4083
PR-URL: nodejs#60080
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
As discussed in the referenced issue the feature should be ready to be
marked as stable.

Refs: nodejs#49148 (comment)
PR-URL: nodejs#59925
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
We (correctly) allow different streams to be specified for `stdout`
and `stderr`, so we should also allow different inspect options for
these streams.

PR-URL: nodejs#60082
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.0 to 3.30.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2d92b76...3599b3b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: nodejs#60089
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.0 to 5.5.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fdcc847...5a10915)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: nodejs#60091
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#60101
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs#60101
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
@RafaelGSS RafaelGSS merged commit 3d5cf5b into main Oct 3, 2025
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.