Merge branch 'main' into npm_--msvs-version__and_--python

cclauss · web-flow · commit 1a17da7a96f1 · 2026-01-30T10:43:07.000+01:00
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-    ".": "12.1.0"
+    ".": "12.2.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,39 @@
 # Changelog
 
+## [12.2.0](https://github.com/nodejs/node-gyp/compare/v12.1.0...v12.2.0) (2026-01-26)
+
+
+### Features
+
+* include built package version in error logs ([#3254](https://github.com/nodejs/node-gyp/issues/3254)) ([ee9cbdd](https://github.com/nodejs/node-gyp/commit/ee9cbdd6e1d40dc7c1cdc5ed6a75432c716eaf3f))
+* update gyp-next to v0.21.1 ([#3273](https://github.com/nodejs/node-gyp/issues/3273)) ([888ff2c](https://github.com/nodejs/node-gyp/commit/888ff2c48a4cf5602013b96b52c6670906976f63))
+
+
+### Bug Fixes
+
+* cpu concurrency detection on some platforms ([#3255](https://github.com/nodejs/node-gyp/issues/3255)) ([f15b79a](https://github.com/nodejs/node-gyp/commit/f15b79a03c54cea0f66d940a0d6d839df867a319)), closes [#3191](https://github.com/nodejs/node-gyp/issues/3191)
+* python is no longer a valid npm config setting ([#3258](https://github.com/nodejs/node-gyp/issues/3258)) ([c7c678f](https://github.com/nodejs/node-gyp/commit/c7c678f89837d956194f326b01c5a8eb1d745db3))
+* Switch to URL instead of url.parse ([#3256](https://github.com/nodejs/node-gyp/issues/3256)) ([3f81949](https://github.com/nodejs/node-gyp/commit/3f819499d8ce6d46c646466de7b9492bf7bde663))
+* Test Windows on Python 3.14, not 3.13 ([#3262](https://github.com/nodejs/node-gyp/issues/3262)) ([7b4f315](https://github.com/nodejs/node-gyp/commit/7b4f315e4dad880c841d21df641d6dd9b68bf36b))
+
+
+### Core
+
+* **deps:** bump actions/checkout from 5 to 6 ([#3248](https://github.com/nodejs/node-gyp/issues/3248)) ([db5385c](https://github.com/nodejs/node-gyp/commit/db5385c5467e5bfb914b9954f0313c46f1f4e10d))
+
+
+### Doc
+
+* add a note about changes in gyp folder ([#3259](https://github.com/nodejs/node-gyp/issues/3259)) ([a52bc81](https://github.com/nodejs/node-gyp/commit/a52bc819f44b881854ff798865ad416430e3dce2))
+* correct typos ([#3269](https://github.com/nodejs/node-gyp/issues/3269)) ([0f2bc7d](https://github.com/nodejs/node-gyp/commit/0f2bc7d2e0665b1c7bb03e1cd8653ea330277a70))
+* remove obsolete Microsoft Node.js Guidelines link ([#3268](https://github.com/nodejs/node-gyp/issues/3268)) ([30cda26](https://github.com/nodejs/node-gyp/commit/30cda268730798dc0f67182c8c568d8b8069964e))
+* update Python manual install instructions for Windows ([#3265](https://github.com/nodejs/node-gyp/issues/3265)) ([0407877](https://github.com/nodejs/node-gyp/commit/0407877e3e26d3201f74cf1a9deabbbfc40bdbb7))
+
+
+### Miscellaneous
+
+* **deps:** upgrade tar to 7.5.4 to address CVE-2026-23950 ([#3271](https://github.com/nodejs/node-gyp/issues/3271)) ([7bf371c](https://github.com/nodejs/node-gyp/commit/7bf371c4dd7c694232ab3169d02fe8197e1ecc6d))
+
 ## [12.1.0](https://github.com/nodejs/node-gyp/compare/v12.0.0...v12.1.0) (2025-11-12)
 
 
diff --git a/README.md b/README.md
@@ -55,19 +55,17 @@ choco install python visualstudio2022-workload-vctools -y
 
 Or install and configure Python and Visual Studio tools manually:
 
-  * Install the current [version of Python](https://devguide.python.org/versions/) from the
-  [Microsoft Store](https://apps.microsoft.com/store/search?publisher=Python+Software+Foundation).
+  * Follow the instructions in [Using Python on Windows](https://docs.python.org/3/using/windows.html) to install
+    the current [version of Python](https://www.python.org/downloads/).
 
    * Install Visual C++ Build Environment: For Visual Studio 2019 or later, use the `Desktop development with C++` workload from [Visual Studio Community](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=Community).  For a version older than Visual Studio 2019, install [Visual Studio Build Tools](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools) with the `Visual C++ build tools` option.
 
-   If the above steps didn't work for you, please visit [Microsoft's Node.js Guidelines for Windows](https://github.com/Microsoft/nodejs-guidelines/blob/master/windows-environment.md#compiling-native-addon-modules) for additional tips.
-
    To target native ARM64 Node.js on Windows on ARM, add the components "Visual C++ compilers and libraries for ARM64" and "Visual C++ ATL for ARM64".
 
    To use the native ARM64 C++ compiler on Windows on ARM, ensure that you have Visual Studio 2022 [17.4 or later](https://devblogs.microsoft.com/visualstudio/arm64-visual-studio-is-officially-here/) installed.
 
-It's advised to install following Powershell module: [VSSetup](https://github.com/microsoft/vssetup.powershell) using `Install-Module VSSetup -Scope CurrentUser`.
-This will make Visual Studio detection logic to use more flexible and accessible method, avoiding Powershell's `ConstrainedLanguage` mode.
+It's advised to install the following PowerShell module: [VSSetup](https://github.com/microsoft/vssetup.powershell) using `Install-Module VSSetup -Scope CurrentUser`.
+This will make Visual Studio detection logic use a more flexible and accessible method, avoiding PowerShell's `ConstrainedLanguage` mode.
 
 ### Configuring Python Dependency
 
@@ -270,8 +268,8 @@ set npm_package_config_node_gyp_devdir=c:\temp\.gyp
 ```
 
 Note that in versions of npm before v11 it was possible to use the prefix `npm_config_` for
-environement variables. This was deprecated in npm@11 and will be removed in npm@12 so it
-is recommened to convert your environment variables to the above format.
+environment variables. This was deprecated in npm@11 and will be removed in npm@12 so it
+is recommended to convert your environment variables to the above format.
 
 ### `npm` configuration for npm versions before v9
 
diff --git a/gyp/.github/workflows/node-gyp.yml b/gyp/.github/workflows/node-gyp.yml
@@ -11,13 +11,7 @@ jobs:
       matrix:
         os: [macos-latest, ubuntu-latest, windows-latest]
         python-version: ["3.10", "3.12", "3.14"]
-        #exclude:
-        #  # Windows on Python 3.14 is blocked by nodejs/node#59983
-        #  - os: windows-latest
-        #    python-version: "3.14"
         include:
-          - os: windows-latest
-            python-version: "3.14"
           - os: macos-15-intel  # macOS on Intel
             python-version: "3.14"
           - os: ubuntu-24.04-arm  # Ubuntu on ARM
diff --git a/gyp/.github/workflows/nodejs.yml b/gyp/.github/workflows/nodejs.yml
@@ -11,28 +11,22 @@ jobs:
       matrix:
         os: [macos-latest, ubuntu-latest, windows-latest]
         python-version: ["3.10", "3.12", "3.14"]
-        exclude:
-          # Windows on Python 3.14 is blocked by nodejs/node#59983
-          - os: windows-latest
-            python-version: "3.14"
         include:
-          - os: windows-latest  # Windows on Python 3.13 instead of 3.14
-            python-version: "3.13"
           - os: macos-15-intel  # macOS on Intel
             python-version: "3.14"
           - os: ubuntu-24.04-arm  # Ubuntu on ARM
             python-version: "3.14"
           - os: windows-11-arm  # Windows on ARM
-            python-version: "3.13"  # Windows on Python 3.13 instead of 3.14
+            python-version: "3.14"
 
     runs-on: ${{ matrix.os }}
     steps:
       - name: Clone gyp-next
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: gyp-next
       - name: Clone nodejs/node
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           repository: nodejs/node
           path: node
diff --git a/gyp/.github/workflows/python_tests.yml b/gyp/.github/workflows/python_tests.yml
@@ -20,7 +20,7 @@ jobs:
           - os: macos-26
             python-version: 3.x
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/gyp/.github/workflows/release-please.yml b/gyp/.github/workflows/release-please.yml
@@ -24,11 +24,11 @@ jobs:
     if: ${{ needs.release-please.outputs.release_created }}  # only publish on release
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
     - name: Build a binary wheel and a source tarball
       run: pipx run build
     - name: Store the distribution packages
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: python-package-distributions
         path: dist/
@@ -48,7 +48,7 @@ jobs:
       id-token: write # IMPORTANT: mandatory for trusted publishing
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       with:
         name: python-package-distributions
         path: dist/
@@ -68,12 +68,12 @@ jobs:
       id-token: write # IMPORTANT: mandatory for sigstore
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       with:
         name: python-package-distributions
         path: dist/
     - name: Sign the dists with Sigstore
-      uses: sigstore/gh-action-sigstore-python@v3.1.0
+      uses: sigstore/gh-action-sigstore-python@v3.2.0
       with:
         inputs: >-
           ./dist/*.tar.gz
diff --git a/gyp/.release-please-manifest.json b/gyp/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-    ".": "0.21.0"
+    ".": "0.21.1"
 }
diff --git a/gyp/CHANGELOG.md b/gyp/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.21.1](https://github.com/nodejs/gyp-next/compare/v0.21.0...v0.21.1) (2026-01-24)
+
+
+### Bug Fixes
+
+* replace weak hash functions with SHA-256 ([#329](https://github.com/nodejs/gyp-next/issues/329)) ([958029e](https://github.com/nodejs/gyp-next/commit/958029e6e4969a871d15e78cd083bb102bebb381))
+
 ## [0.21.0](https://github.com/nodejs/gyp-next/compare/v0.20.5...v0.21.0) (2025-11-04)
 
 
diff --git a/gyp/pylib/gyp/MSVSNew.py b/gyp/pylib/gyp/MSVSNew.py
@@ -34,7 +34,7 @@ def MakeGuid(name, seed="msvs_new"):
 
     Args:
       name: Target name.
-      seed: Seed for MD5 hash.
+      seed: Seed for SHA-256 hash.
     Returns:
       A GUID-line string calculated from the name and seed.
 
@@ -44,8 +44,8 @@ def MakeGuid(name, seed="msvs_new"):
     determine the GUID to refer to explicitly.  It also means that the GUID will
     not change when the project for a target is rebuilt.
     """
-    # Calculate a MD5 signature for the seed and name.
-    d = hashlib.md5((str(seed) + str(name)).encode("utf-8")).hexdigest().upper()
+    # Calculate a SHA-256 signature for the seed and name.
+    d = hashlib.sha256((str(seed) + str(name)).encode("utf-8")).hexdigest().upper()
     # Convert most of the signature to GUID form (discard the rest)
     guid = (
         "{"
diff --git a/gyp/pylib/gyp/generator/make.py b/gyp/pylib/gyp/generator/make.py
@@ -2169,7 +2169,7 @@ def WriteMakeRule(
             # - The multi-output rule will have an do-nothing recipe.
 
             # Hash the target name to avoid generating overlong filenames.
-            cmddigest = hashlib.sha1(
+            cmddigest = hashlib.sha256(
                 (command or self.target).encode("utf-8")
             ).hexdigest()
             intermediate = "%s.intermediate" % cmddigest
diff --git a/gyp/pylib/gyp/generator/ninja.py b/gyp/pylib/gyp/generator/ninja.py
@@ -809,9 +809,8 @@ def cygwin_munge(path):
                 outputs = [self.GypPathToNinja(o, env) for o in outputs]
                 if self.flavor == "win":
                     # WriteNewNinjaRule uses unique_name to create a rsp file on win.
-                    extra_bindings.append(
-                        ("unique_name", hashlib.md5(outputs[0]).hexdigest())
-                    )
+                    unique_name = hashlib.sha256(outputs[0].encode("utf-8")).hexdigest()
+                    extra_bindings.append(("unique_name", unique_name))
 
                 self.ninja.build(
                     outputs,
@@ -2803,7 +2802,7 @@ def GenerateOutputForConfig(target_list, target_dicts, data, params, config_name
             build_file, name, toolset
         )
         qualified_target_for_hash = qualified_target_for_hash.encode("utf-8")
-        hash_for_rules = hashlib.md5(qualified_target_for_hash).hexdigest()
+        hash_for_rules = hashlib.sha256(qualified_target_for_hash).hexdigest()
 
         base_path = os.path.dirname(build_file)
         obj = "obj"
diff --git a/gyp/pylib/gyp/xcodeproj_file.py b/gyp/pylib/gyp/xcodeproj_file.py
@@ -429,7 +429,7 @@ def _HashUpdate(hash, data):
             hash.update(data)
 
         if seed_hash is None:
-            seed_hash = hashlib.sha1()
+            seed_hash = hashlib.sha256()
 
         hash = seed_hash.copy()
 
diff --git a/gyp/pyproject.toml b/gyp/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gyp-next"
-version = "0.21.0"
+version = "0.21.1"
 authors = [
   { name="Node.js contributors", email="ryzokuken@disroot.org" },
 ]
diff --git a/lib/process-release.js b/lib/process-release.js
@@ -1,9 +1,6 @@
-/* eslint-disable n/no-deprecated-api */
-
 'use strict'
 
 const semver = require('semver')
-const url = require('url')
 const path = require('path')
 const log = require('./log')
 
@@ -74,11 +71,11 @@ function processRelease (argv, gyp, defaultVersion, defaultRelease) {
   } else {
     distBaseUrl = 'https://nodejs.org/dist'
   }
-  distBaseUrl += '/v' + version + '/'
+  distBaseUrl = new URL(distBaseUrl + '/v' + version + '/')
 
   // new style, based on process.release so we have a lot of the data we need
   if (defaultRelease && defaultRelease.headersUrl && !overrideDistUrl) {
-    baseUrl = url.resolve(defaultRelease.headersUrl, './')
+    baseUrl = new URL('./', defaultRelease.headersUrl)
     libUrl32 = resolveLibUrl(name, defaultRelease.libUrl || baseUrl || distBaseUrl, 'x86', versionSemver.major)
     libUrl64 = resolveLibUrl(name, defaultRelease.libUrl || baseUrl || distBaseUrl, 'x64', versionSemver.major)
     libUrlArm64 = resolveLibUrl(name, defaultRelease.libUrl || baseUrl || distBaseUrl, 'arm64', versionSemver.major)
@@ -96,28 +93,28 @@ function processRelease (argv, gyp, defaultVersion, defaultRelease) {
     // have a *-headers.tar.gz file in its dist location, even some frankenstein
     // custom version
     canGetHeaders = semver.satisfies(versionSemver, headersTarballRange)
-    tarballUrl = url.resolve(baseUrl, name + '-v' + version + (canGetHeaders ? '-headers' : '') + '.tar.gz')
+    tarballUrl = new URL(name + '-v' + version + (canGetHeaders ? '-headers' : '') + '.tar.gz', baseUrl).href
   }
 
   return {
     version,
     semver: versionSemver,
     name,
-    baseUrl,
+    baseUrl: baseUrl.href,
     tarballUrl,
-    shasumsUrl: url.resolve(baseUrl, 'SHASUMS256.txt'),
+    shasumsUrl: new URL('SHASUMS256.txt', baseUrl).href,
     versionDir: (name !== 'node' ? name + '-' : '') + version,
     ia32: {
-      libUrl: libUrl32,
-      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrl32).pathname))
+      libUrl: libUrl32.href,
+      libPath: normalizePath(path.relative(baseUrl.pathname, libUrl32.pathname))
     },
     x64: {
-      libUrl: libUrl64,
-      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrl64).pathname))
+      libUrl: libUrl64.href,
+      libPath: normalizePath(path.relative(baseUrl.pathname, libUrl64.pathname))
     },
     arm64: {
-      libUrl: libUrlArm64,
-      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrlArm64).pathname))
+      libUrl: libUrlArm64.href,
+      libPath: normalizePath(path.relative(baseUrl.pathname, libUrlArm64.pathname))
     }
   }
 }
@@ -127,20 +124,21 @@ function normalizePath (p) {
 }
 
 function resolveLibUrl (name, defaultUrl, arch, versionMajor) {
-  const base = url.resolve(defaultUrl, './')
-  const hasLibUrl = bitsre.test(defaultUrl) || (versionMajor === 3 && bitsreV3.test(defaultUrl))
+  if (!defaultUrl.pathname) defaultUrl = new URL(defaultUrl)
+  const base = new URL('./', defaultUrl)
+  const hasLibUrl = bitsre.test(defaultUrl.pathname) || (versionMajor === 3 && bitsreV3.test(defaultUrl.pathname))
 
   if (!hasLibUrl) {
     // let's assume it's a baseUrl then
     if (versionMajor >= 1) {
-      return url.resolve(base, 'win-' + arch + '/' + name + '.lib')
+      return new URL('win-' + arch + '/' + name + '.lib', base)
     }
     // prior to io.js@1.0.0 32-bit node.lib lives in /, 64-bit lives in /x64/
-    return url.resolve(base, (arch === 'x86' ? '' : arch + '/') + name + '.lib')
+    return new URL((arch === 'x86' ? '' : arch + '/') + name + '.lib', base)
   }
 
   // else we have a proper url to a .lib, just make sure it's the right arch
-  return defaultUrl.replace(versionMajor === 3 ? bitsreV3 : bitsre, '/win-' + arch + '/')
+  return new URL(defaultUrl.pathname.replace(versionMajor === 3 ? bitsreV3 : bitsre, '/win-' + arch + '/'), defaultUrl)
 }
 
 module.exports = processRelease
diff --git a/package.json b/package.json
@@ -11,7 +11,7 @@
     "bindings",
     "gyp"
   ],
-  "version": "12.1.0",
+  "version": "12.2.0",
   "installVersion": 11,
   "author": "Nathan Rajlich <nathan@tootallnate.net> (http://tootallnate.net)",
   "repository": {
@@ -29,7 +29,7 @@
     "nopt": "^9.0.0",
     "proc-log": "^6.0.0",
     "semver": "^7.3.5",
-    "tar": "^7.5.2",
+    "tar": "^7.5.4",
     "tinyglobby": "^0.2.12",
     "which": "^6.0.0"
   },

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,3 @@`
`1`	`1`	`{`
`2`		`- ".": "12.1.0"`
	`2`	`+ ".": "12.2.0"`
`3`	`3`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,3 @@`
`1`	`1`	`{`
`2`		`- ".": "0.21.0"`
	`2`	`+ ".": "0.21.1"`
`3`	`3`	`}`