From 9446caf9f195e46070117ab13f52f2e55469e3ba Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Sat, 30 May 2026 17:29:15 +0200 Subject: [PATCH 1/5] meta: flip mcollina emails in .mailmap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matteo Collina PR-URL: https://github.com/nodejs/node/pull/63621 Reviewed-By: Juan José Arboleda Reviewed-By: Trivikram Kamat Reviewed-By: Antoine du Hamel Reviewed-By: Paolo Insogna Reviewed-By: Moshe Atlow Reviewed-By: Luigi Pinca --- .mailmap | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mailmap b/.mailmap index 0422fba4472601..0860e8e0147889 100644 --- a/.mailmap +++ b/.mailmap @@ -350,7 +350,7 @@ Mathias Buus Mathias Pettersson Matt Lang Matt Reed -Matteo Collina +Matteo Collina Matthew Lye Matthew Turner Matthias Bastian From 17e41962a7ec0d0af105936e9655545377c39e18 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 30 May 2026 17:40:34 +0200 Subject: [PATCH 2/5] src: remove TOCTOU race condition when encoding SAB-backed `Buffer`s Signed-off-by: Antoine du Hamel PR-URL: https://github.com/nodejs/node/pull/63517 Refs: https://hackerone.com/reports/3752489 Reviewed-By: James M Snell --- src/encoding_binding.cc | 16 ++++++++++++++-- src/node_buffer.cc | 24 ++++++++++++++++++------ 2 files changed, 32 insertions(+), 8 deletions(-) diff --git a/src/encoding_binding.cc b/src/encoding_binding.cc index 9c84d24c84576d..f7bd93a98d05b5 100644 --- a/src/encoding_binding.cc +++ b/src/encoding_binding.cc @@ -418,15 +418,20 @@ void BindingData::DecodeUTF8(const FunctionCallbackInfo& args) { Environment* env = Environment::GetCurrent(args); // list, flags CHECK_GE(args.Length(), 1); + auto isShared = args[0]->IsSharedArrayBuffer(); - if (!(args[0]->IsArrayBuffer() || args[0]->IsSharedArrayBuffer() || - args[0]->IsArrayBufferView())) { + if (!(args[0]->IsArrayBuffer() || isShared || args[0]->IsArrayBufferView())) { return node::THROW_ERR_INVALID_ARG_TYPE( env->isolate(), "The \"list\" argument must be an instance of SharedArrayBuffer, " "ArrayBuffer or ArrayBufferView."); } + if (args[0]->IsArrayBufferView()) { + Local view = args[0].As(); + isShared = view->Buffer()->IsSharedArrayBuffer(); + } + ArrayBufferViewContents buffer(args[0]); bool ignore_bom = args[1]->IsTrue(); @@ -435,6 +440,13 @@ void BindingData::DecodeUTF8(const FunctionCallbackInfo& args) { const char* data = buffer.data(); size_t length = buffer.length(); + std::unique_ptr data_copy; + if (isShared && length != 0) { + data_copy = std::make_unique_for_overwrite(length); + memcpy(data_copy.get(), data, length); + data = data_copy.get(); + } + if (!ignore_bom && length >= 3) { if (memcmp(data, "\xEF\xBB\xBF", 3) == 0) { data += 3; diff --git a/src/node_buffer.cc b/src/node_buffer.cc index 2778422ea4e7b7..b3b12e85988ad6 100644 --- a/src/node_buffer.cc +++ b/src/node_buffer.cc @@ -567,19 +567,31 @@ void StringSlice(const FunctionCallbackInfo& args) { THROW_AND_RETURN_UNLESS_BUFFER(env, args[0]); ArrayBufferViewContents buffer(args[0]); - if (buffer.length() == 0) - return args.GetReturnValue().SetEmptyString(); + auto buffer_length = buffer.length(); + const char* data_ptr = buffer.data(); + + Local view = args[0].As(); + + if (buffer_length == 0) return args.GetReturnValue().SetEmptyString(); size_t start = 0; size_t end = 0; THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[1], 0, &start)); - THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[2], buffer.length(), &end)); - if (end < start) end = start; - THROW_AND_RETURN_IF_OOB(Just(end <= buffer.length())); + THROW_AND_RETURN_IF_OOB(ParseArrayIndex(env, args[2], buffer_length, &end)); + if (end <= start) return args.GetReturnValue().SetEmptyString(); + THROW_AND_RETURN_IF_OOB(Just(end <= buffer_length)); size_t length = end - start; + std::unique_ptr data_copy; + if (view->Buffer()->IsSharedArrayBuffer()) { + data_copy = std::make_unique_for_overwrite(length); + memcpy(data_copy.get(), data_ptr + start, length); + data_ptr = data_copy.get(); + start = 0; + } + Local ret; - if (StringBytes::Encode(isolate, buffer.data() + start, length, encoding) + if (StringBytes::Encode(isolate, data_ptr + start, length, encoding) .ToLocal(&ret)) { args.GetReturnValue().Set(ret); } From 80e517456732e53ba627bce530cc354946d0d2e8 Mon Sep 17 00:00:00 2001 From: Joyee Cheung Date: Sat, 30 May 2026 18:20:00 +0200 Subject: [PATCH 3/5] doc: remove duplicated sentences in large-pull-requests.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Joyee Cheung PR-URL: https://github.com/nodejs/node/pull/63650 Reviewed-By: Filip Skokan Reviewed-By: Rafael Gonzaga Reviewed-By: Matteo Collina Reviewed-By: Tobias Nießen Reviewed-By: Trivikram Kamat --- doc/contributing/large-pull-requests.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/doc/contributing/large-pull-requests.md b/doc/contributing/large-pull-requests.md index 00ceb8452e2abc..8920ffdcbb3785 100644 --- a/doc/contributing/large-pull-requests.md +++ b/doc/contributing/large-pull-requests.md @@ -14,10 +14,6 @@ ## Overview -Large pull requests are difficult to review or sometimes impossible to review in the GitHub UI. They are likely to sit -for a long time without receiving adequate review, and when they do get reviewed, -the quality of that review is often lower due to reviewer fatigue. Contributors -should avoid creating large pull requests except in those cases where it is Large pull requests are difficult to review or sometimes impossible to review in the GitHub UI. They are likely to sit for a long time without receiving adequate review, and when they do get reviewed, the quality of that review is From b9e2346a1d9e4b820aa2a722940e57cd53bbdd28 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 30 May 2026 18:39:48 +0200 Subject: [PATCH 4/5] tools: refine `v8.nix` source definition Signed-off-by: Antoine du Hamel PR-URL: https://github.com/nodejs/node/pull/63625 Reviewed-By: Filip Skokan Reviewed-By: Colin Ihrig --- tools/nix/v8.nix | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix index fa931092a83f08..3f050b9a8f5e75 100644 --- a/tools/nix/v8.nix +++ b/tools/nix/v8.nix @@ -57,10 +57,24 @@ let ../../tools/icu/icutrim.py ../../tools/icu/no-op.cc ]; + potentiallyAlreadyRemovedFiles = + # Files that are removed in the release tarball (see Makefile $(TARBALL) target) + [ (fileset.difference ../../deps/v8/test ../../deps/v8/test/torque) ] + ++ (builtins.filter builtins.pathExists [ + ../../deps/v8/samples + ../../deps/v8/tools/profviz + ../../deps/v8/tools/run-tests.py + ../../deps/v8/third_party/ittapi + ]); + trackedFiles = + ({ + # This line is being modified by Makefile $(TARBALL) target, any change to it should be sync + fileset = fileset.intersection (fileset.gitTracked root) (fileset.unions files); + }).fileset; in fileset.toSource { inherit root; - fileset = fileset.intersection (fileset.gitTracked root) (fileset.unions files); + fileset = fileset.difference trackedFiles (fileset.unions potentiallyAlreadyRemovedFiles); }; v8Dir = "${src}/deps/v8"; in From 8b88e2c841368887ba650478008d14df5cac324f Mon Sep 17 00:00:00 2001 From: Chengzhong Wu Date: Sat, 30 May 2026 16:35:21 -0400 Subject: [PATCH 5/5] build: remove duplicated node_use_sqlite and node_use_ffi conditions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Chengzhong Wu PR-URL: https://github.com/nodejs/node/pull/63629 Reviewed-By: Michaël Zasso Reviewed-By: Colin Ihrig Reviewed-By: Luigi Pinca --- node.gyp | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/node.gyp b/node.gyp index 28db2a955b74d6..80896554b16d4b 100644 --- a/node.gyp +++ b/node.gyp @@ -1071,23 +1071,6 @@ [ 'node_use_lief=="true" and node_shared_lief=="true"', { 'defines': [ 'HAVE_LIEF=1' ], }], - [ 'node_use_sqlite=="true"', { - 'sources': [ - '<@(node_sqlite_sources)', - ], - }], - [ 'node_use_ffi=="true"', { - 'sources': [ - '<@(node_ffi_sources)', - ], - 'conditions': [ - [ 'node_shared_ffi=="false"', { - 'dependencies': [ - 'deps/libffi/libffi.gyp:libffi', - ], - }], - ], - }], [ 'node_use_quic=="true"', { 'sources': [ '<@(node_quic_sources)',