Merge branch 'nodejs:main' into fix/issue-63473-repl-asm-warning

Author: DivyanshuX9

.github/label-pr-config.yml

@@ -104,6 +104,7 @@ subSystemLabels:
   /^lib\/internal\/url\.js$/: whatwg-url
   /^lib\/internal\/modules\/esm/: esm
   /^lib\/internal\/modules/: module
+  /^lib\/internal\/source_map/: source maps
   /^lib\/internal\/webstreams/: web streams
   /^lib\/internal\/test_runner/: test_runner
   /^lib\/internal\/v8\//: v8 module
@@ -128,6 +129,8 @@ exlusiveLabels:
   /^test\/report\//: test, report
   /^test\/fixtures\/es-module/: test, esm
   /^test\/es-module\//: test, esm
+  /^test\/fixtures\/source-map/: test, source maps
+  /^test\/fixtures\/test-426/: test, source maps
   /^test\/fixtures\/wpt\/streams\//: test, web streams
   /^test\/fixtures\/typescript/: test, strip-types
   /^test\/module-hooks\//: test, module, loaders
@@ -214,6 +217,7 @@ allJsSubSystems:
   - url
   - util
   - v8
+  - vfs
   - vm
   - wasi
   - worker

.github/workflows/codeql.yml

@@ -9,6 +9,7 @@ permissions:
 
 jobs:
   analyze:
+    if: github.repository == 'nodejs/node'
     name: Analyze
     runs-on: ubuntu-slim
     permissions:

.github/workflows/commit-lint.yml

@@ -4,7 +4,6 @@ on:
   pull_request:
     branches:
       - main
-      - v[0-9]+.x-staging
 
 env:
   NODE_VERSION: lts/*

.github/workflows/daily.yml

@@ -13,6 +13,7 @@ permissions:
 
 jobs:
   build-lto:
+    if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

.github/workflows/scorecard.yml

@@ -20,6 +20,7 @@ permissions: read-all
 
 jobs:
   analysis:
+    if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
     name: Scorecard analysis
     # cannot use ubuntu-slim here because ossf/scorecard-action is dockerized
     # cannot use ubuntu-24.04-arm here because the docker image is x86 only

.github/workflows/test-internet.yml

@@ -44,7 +44,7 @@ permissions:
 
 jobs:
   test-internet:
-    if: github.event_name == 'schedule' && github.repository == 'nodejs/node' || github.event.pull_request.draft == false
+    if: (github.event_name == 'schedule' && github.repository == 'nodejs/node') || (github.event.pull_request && github.event.pull_request.draft == false)
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

BUILDING.md

@@ -237,23 +237,11 @@ tarball and/or browse the git repository checked out at the relevant tag.
 ### Prerequisites
 
 * [A supported version of Python][Python versions] for building and testing.
-* A Rust toolchain if [building Node.js with Temporal support](#building-nodejs-with-temporal-support)
-  is required (enabled by default starting in Node.js 26).
+* A Rust toolchain if [building Node.js with Temporal support](#building-nodejs-with-temporal-support).
 * Memory: at least 8GB of RAM is typically required when compiling with 4 parallel jobs (e.g: `make -j4`).
 
 ### Unix and macOS
 
-Consult the official [Install Rust](https://rust-lang.org/tools/install/)
-instructions to install a Rust toolchain, required for Temporal support introduced in Node.js 25.4.0.
-Individual packages such as `rust` and `cargo` in some operating system distributions may be considered
-as an alternative, for example in CI environments.
-Consult with relevant operating system documentation to ensure that packages
-meet the minimum version specified in the
-[Building Node.js with Temporal support](#building-nodejs-with-temporal-support) section,
-as packaged versions may lag behind the `stable` version installed by the official instructions.
-Avoid mixing `rustup` together with `rust` and `cargo` package installations, due to
-potential version conflicts.
-
 #### Unix prerequisites
 
 * `gcc` and `g++` >= 13.2 or `clang` and `clang++` >= 19.1
@@ -1062,14 +1050,19 @@ enable FIPS support in Node.js.
 
 Node.js supports the [Temporal](https://github.com/tc39/proposal-temporal) APIs, when
 linking statically or dynamically with a version of [temporal\_rs](https://github.com/boa-dev/temporal).
-
-Temporal support is enabled by default starting in Node.js 26. Building it
-requires a Rust toolchain:
+Building it requires a Rust toolchain:
 
 * rustc >= 1.82 (with LLVM >= 19)
 * cargo >= 1.82
 
 Refer to [Install Rust](https://rust-lang.org/tools/install/) for instructions.
+Individual packages such as `rust` and `cargo` in some operating system distributions may be considered
+as an alternative, for example in CI environments.
+Consult with relevant operating system documentation to ensure that packages
+meet the minimum version specified above,
+as packaged versions may lag behind the `stable` version installed by the official instructions.
+Avoid mixing `rustup` together with `rust` and `cargo` package installations, due to
+potential version conflicts.
 
 If `--v8-enable-temporal-support` and `--v8-disable-temporal-support` are both
 omitted, `configure.py` probes for `cargo` and `rustc`. If either is missing,

Makefile

@@ -856,7 +856,7 @@ VERSION=v$(RAWVER)
 
 .PHONY: doc-only
 .NOTPARALLEL: doc-only
-doc-only: $(apidoc_dirs) $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json out/doc/apilinks.json  ## Builds the docs with the local or the global Node.js binary.
+doc-only: $(apidoc_dirs) $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json out/doc/llms.txt out/doc/apilinks.json  ## Builds the docs with the local or the global Node.js binary.
 
 .PHONY: doc
 doc: $(NODE_EXE) doc-only ## Build Node.js, and then build the documentation with the new binary.
@@ -901,6 +901,22 @@ $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json &: $(a
 	fi
 endif
 
+out/doc/llms.txt: $(apidoc_sources) tools/doc/node_modules | out/doc
+	@if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \
+		echo "Skipping $@ (no crypto and/or no ICU)"; \
+	else \
+		$(call available-node, \
+			$(DOC_KIT) generate \
+			-t llms-txt \
+			-i doc/api/*.md \
+			--ignore $(skip_apidoc_files) \
+			-o $(@D) \
+			-c ./CHANGELOG.md \
+			-v $(VERSION) \
+			--type-map doc/type-map.json \
+		) \
+	fi
+
 out/doc/apilinks.json: $(wildcard lib/*.js) tools/doc/node_modules | out/doc
 	@if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \
 		echo "Skipping $@ (no crypto and/or no ICU)"; \

SECURITY.md

@@ -85,6 +85,7 @@ When reporting security vulnerabilities, reporters must adhere to the following
 
 4. **Report Quality**
    * Provide clear, detailed steps to reproduce the vulnerability.
+   * Include reproducible code written in JavaScript.
    * Include only the minimum proof of concept required to demonstrate the issue.
    * Remove any malicious payloads or components that could cause harm.
 
@@ -376,7 +377,7 @@ the community they pose.
 #### Permission Model Boundaries (`--permission`)
 
 The Node.js [Permission Model](https://nodejs.org/api/permissions.html)
-(`--experimental-permission`) is an opt-in mechanism that limits which
+(`--permission`) is an opt-in mechanism that limits which
 resources a Node.js process may access. It is designed to reduce the blast
 radius of mistakes in trusted application code, **not** to act as a security
 boundary against intentional misuse or a compromised process.

benchmark/fs/readfile-utf8-fastpath.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common.js');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../../test/common/tmpdir');
+
+const bench = common.createBenchmark(main, {
+  size: [64, 1024, 16384, 262144, 4194304],
+  content: ['ascii', 'latin1', 'utf8_mixed'],
+  source: ['path', 'fd'],
+  n: [3e3],
+});
+
+function buildContent(kind, size) {
+  if (kind === 'ascii') {
+    return Buffer.alloc(size, 0x61); // 'a'
+  }
+  if (kind === 'latin1') {
+    // 'é' in UTF-8 is 0xC3 0xA9 (2 bytes per char)
+    const pair = Buffer.from([0xC3, 0xA9]);
+    const buf = Buffer.alloc(size);
+    for (let i = 0; i + 2 <= size; i += 2) pair.copy(buf, i);
+    return buf;
+  }
+  if (kind === 'utf8_mixed') {
+    // mixed ASCII + 3-byte CJK (U+4E2D 中 = E4 B8 AD)
+    const cjk = Buffer.from([0xE4, 0xB8, 0xAD]);
+    const buf = Buffer.alloc(size);
+    let i = 0;
+    while (i + 4 <= size) {
+      buf[i++] = 0x61;
+      cjk.copy(buf, i);
+      i += 3;
+    }
+    return buf;
+  }
+  throw new Error('unknown content: ' + kind);
+}
+
+function main({ n, size, content, source }) {
+  tmpdir.refresh();
+  const file = path.join(tmpdir.path, `bench-${content}-${size}.bin`);
+  fs.writeFileSync(file, buildContent(content, size));
+
+  let arg;
+  let shouldClose = false;
+  if (source === 'fd') {
+    arg = fs.openSync(file, 'r');
+    shouldClose = true;
+  } else {
+    arg = file;
+  }
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    fs.readFileSync(arg, 'utf8');
+  }
+  bench.end(n);
+
+  if (shouldClose) fs.closeSync(arg);
+}