src: use std::sort in node_metadata for libc++13 compatibility#61787
Closed
rebroad wants to merge 3400 commits intonodejs:mainfrom
Closed
src: use std::sort in node_metadata for libc++13 compatibility#61787rebroad wants to merge 3400 commits intonodejs:mainfrom
rebroad wants to merge 3400 commits intonodejs:mainfrom
Conversation
PR-URL: nodejs#59497 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com>
PR-URL: nodejs#59312 Fixes: nodejs#59290 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#59511 Fixes: nodejs#59508 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#59466 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
This is a gcc-only option, do not pass to clang. PR-URL: nodejs#59484 Refs: nodejs/build#4091 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com>
The race can not only happen when the ESM is loaded by the CommonJS loader, but can also happen to inner module jobs in the dependency graph. PR-URL: nodejs#59519 Fixes: nodejs#59366 Refs: https://github.com/abejfehr/node-22.18-issue-repro Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
When no async loader hooks are registered, perform the linking as synchronously as possible to reduce the chance of races from the the shared module loading cache. PR-URL: nodejs#59519 Fixes: nodejs#59366 Refs: https://github.com/abejfehr/node-22.18-issue-repro Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: nodejs#59470 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: nodejs#59523 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#59526 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: nodejs#59517 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Refs: whatwg/compression#34 PR-URL: nodejs#59464 Reviewed-By: Mattias Buelens <mattias@buelens.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: nodejs#59455 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
PR-URL: nodejs#59536 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#59532 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: nodejs#59468 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#59226 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com> Reviewed-By: Qingyu Deng <i@ayase-lab.com>
PR-URL: nodejs#59516 Refs: nodejs#59498 Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#59473 Refs: nodejs#59288 Reviewed-By: Daniel Lemire <daniel@lemire.me>
PR-URL: nodejs#59350 Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Theses tests are failing when compiled with clang. Skip for now to avoid breaking the CI when we switch over to building with clang. PR-URL: nodejs#59563 Refs: nodejs#59561 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Refactor test/parallel/test-repl-tab-complete-import.js to use mustSucceed in places where no error is expected in the callback. This clarifies the intent of the tests and improves assertion accuracy. Refs: nodejs#59204 PR-URL: nodejs#59368 Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#54347 Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59377 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
PR-URL: nodejs#59405 Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
These functions are both meant to be used with a null-terminated and thus non-empty sequence of `char`s. However, there is nothing stopping call sites from passing zero-length sequences, which would certainly not be null-terminated and also would cause an underflow in `N - 1`. Therefore, this commit - changes the size `N` of the array from `int` to `std::size_t`, - ensures that compilation will fail if `N = 0`, and - adds a runtime assertion that fails if the `N`-th `char` is not `\0`. Note that the runtime assertion should be eliminated by any optimizing compiler when given a string literal, which is how these functions are used for the most part (though not exclusively). PR-URL: nodejs#58155 Reviewed-By: Daniel Lemire <daniel@lemire.me> Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
500 + 1000 already cover the curve. 2000 doesn’t add new qualitative insight — it just extends the same curve further down (another ~3–4× slowdown). According to nodejs/performance#186 this benchmark takes one minute to conclude a single run. This should fix it. PR-URL: nodejs#59588 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
There's no need to test all readfile config as permission model won't impact based on size. PR-URL: nodejs#59589 Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Adds a new section to the threat model specifying that security vulnerabilities affecting only experimental platforms will not be accepted as valid security issues and will be treated as normal bugs. This clarifies that experimental OS/hardware combinations do not qualify for CVEs or bug bounty rewards, aligning with their limited testing and support infrastructure. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs#59591 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Jordan Harband <ljharb@gmail.com>
When --use-system-ca is enabled, load the system CA certificates eagerly off the main thread to avoid blocking the main thread when the first TLS connection is made. PR-URL: nodejs#59550 Refs: nodejs#58990 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59996 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Abdirahim Musse <abdirahim.musse@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
The `env` parameter for `process.execve` is documented to default to `process.env`. PR-URL: nodejs#60029 Refs: nodejs/build#4156 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs#60047 Reviewed-By: theanarkh <theratliter@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: nodejs#60024 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Fixes: nodejs#60034 PR-URL: nodejs#60103 Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Implements the WHATWG DOM specification for passive event listeners, ensuring that calls to `preventDefault()` are correctly ignored within a passive listener context. An internal `kInPassiveListener` state is added to the Event object to track when a passive listener is executing. The `preventDefault()` method and the `returnValue` setter are modified to check this state, as well as the event's `cancelable` property. This state is reliably cleaned up within a `finally` block to prevent state pollution in case a listener throws an error. This resolves previously failing Web Platform Tests (WPT) in `AddEventListenerOptions-passive.any.js`. Refs: https://dom.spec.whatwg.org/#dom-event-preventdefault PR-URL: nodejs#59995 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: Mattias Buelens <mattias@buelens.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: nodejs#60039 Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#60113 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Use `common.mustCallAtLeast()` to verify that the `'message'` event is fired. PR-URL: nodejs#59952 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
PR-URL: nodejs#59128 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#59958 Refs: https://github.com/nodejs/node/blob/main/doc/contributing/primordials.md#unsafe-array-iteration Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#60008 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Specifically, avoid the hazard of unintentionally evaluating an argument multiple times during macro expansion, and do not assume the available of particular namespaces in the current scope. PR-URL: nodejs#60053 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: nodejs#60375
Refs: https://hackerone.com/reports/3390084 PR-URL: nodejs-private/node-private#748 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> CVE-ID: CVE-2025-55132
Refs: https://hackerone.com/reports/3417819 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#760 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2025-55130
When a stack overflow exception occurs during async_hooks callbacks (which use TryCatchScope::kFatal), detect the specific "Maximum call stack size exceeded" RangeError and re-throw it instead of immediately calling FatalException. This allows user code to catch the exception with try-catch blocks instead of requiring uncaughtException handlers. The implementation adds IsStackOverflowError() helper to detect stack overflow RangeErrors and re-throws them in TryCatchScope destructor instead of calling FatalException. This fixes the issue where async_hooks would cause stack overflow exceptions to exit with code 7 (kExceptionInFatalExceptionHandler) instead of being catchable. Fixes: nodejs#37989 Ref: https://hackerone.com/reports/3456295 PR-URL: nodejs-private/node-private#773 Refs: https://hackerone.com/reports/3456295 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> CVE-ID: CVE-2025-59466
PR-URL: nodejs-private/node-private#791 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through owner.destroy() instead of letting them become uncaught exceptions. This prevents remote attackers from crashing TLS servers or causing resource exhaustion. Fixes: https://hackerone.com/reports/3473882 PR-URL: nodejs-private/node-private#782 PR-URL: nodejs-private/node-private#796 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-21637
This prevents the server from crashing due to an unhandled rejection
when a TLSSocket connection is abruptly destroyed during initialization
and the user has not attached an error handler to the socket.
e.g:
```js
const server = http2.createSecureServer({ ... })
server.on('secureConnection', socket => {
socket.on('error', err => {
console.log(err)
})
})
```
PR-URL: nodejs-private/node-private#797
Fixes: nodejs#44751
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=3262404
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-59465
PR-URL: nodejs#60997 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
This removes the zero-fill toggle mechanism that allowed JavaScript to control ArrayBuffer initialization via shared memory. Instead, unsafe buffer creation now uses a dedicated C++ API. Refs: https://hackerone.com/reports/3405778 Co-Authored-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs-private/node-private#759 Backport-PR-URL: nodejs-private/node-private#798 CVE-ID: CVE-2025-55131
This is a security release. Notable changes: lib: * (CVE-2025-59465) add TLSSocket default error handler * (CVE-2025-55132) disable futimes when permission model is enabled lib,permission: * (CVE-2025-55130) require full read and write to symlink APIs src: * (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks src,lib: * (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle tls: * (CVE-2026-21637) route callback exceptions through error handlers PR-URL: nodejs-private/node-private#801
Collaborator
|
Review requested:
|
nodejs-github-bot
added
meta
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces std::ranges::sort with std::sort in src/node_metadata.cc to build on armhf toolchains using older libc++ (e.g., clang-13/libc++13).