v21.6.0 proposal

.devcontainer/.devcontainer.json → .devcontainer/devcontainer.json

@@ -1,12 +1,12 @@
 {
   "name": "Node.js Core Developer Environment",
   "extensions": [
-      "github.vscode-pull-request-github",
-      "ms-vsliveshare.vsliveshare",
-      "vscode-icons-team.vscode-icons",
-      "visualstudioexptteam.vscodeintellicode"
+    "github.vscode-pull-request-github",
+    "ms-vsliveshare.vsliveshare",
+    "vscode-icons-team.vscode-icons",
+    "visualstudioexptteam.vscodeintellicode"
   ],
-  "dockerFile": "Dockerfile",
+  "image": "nodejs/devcontainer:nightly",
   "initializeCommand": "docker system prune -f -a",
   "settings": {
     "terminal.integrated.profiles.linux": {

.github/CODEOWNERS

@@ -17,6 +17,7 @@
 /CONTRIBUTING.md @nodejs/tsc
 /doc/contributing/*.md @nodejs/tsc
 /GOVERNANCE.md @nodejs/tsc
+/SECURITY.md @nodejs/tsc
 /LICENSE @nodejs/tsc
 /onboarding.md @nodejs/tsc
 

.github/workflows/build-tarball.yml

@@ -57,7 +57,7 @@ jobs:
           mkdir tarballs
           mv *.tar.gz tarballs
       - name: Upload tarball artifact
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32  # v3.1.3
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392  # v4.0.0
         with:
           name: tarballs
           path: tarballs
@@ -75,7 +75,7 @@ jobs:
       - name: Environment Information
         run: npx envinfo
       - name: Download tarball
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3.0.2
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110  # v4.1.0
         with:
           name: tarballs
           path: tarballs

.github/workflows/daily-wpt-fyi.yml

@@ -121,10 +121,10 @@ jobs:
         run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32  # v3.1.3
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392  # v4.0.0
         with:
           path: out/wpt/wptreport-*.json
-          name: WPT Reports
+          name: WPT Report for ${{ steps.setup-node.outputs.node-version }}
           if-no-files-found: error
       - name: Upload WPT Report to wpt.fyi API
         if: ${{ env.WPT_REPORT != '' }}

.github/workflows/doc.yml

@@ -35,7 +35,7 @@ jobs:
         run: npx envinfo
       - name: Build
         run: NODE=$(command -v node) make doc-only
-      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32  # v3.1.3
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392  # v4.0.0
         with:
           name: docs
           path: out/doc

.github/workflows/scorecard.yml

@@ -65,7 +65,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: Upload artifact
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32  # v3.1.3
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392  # v4.0.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/timezone-update.yml

@@ -34,12 +34,22 @@ jobs:
       - name: Record new version
         run: echo "new_version=$(ls icu-data/tzdata/icunew | tail -1)" >> $GITHUB_ENV
 
+      - name: Record current version
+        run: echo "current_version=$(cat ./test/fixtures/tz-version.txt)" >> $GITHUB_ENV
+
+      - name: Compare versions
+        run: |
+          echo "Comparing current version ${{ env.current_version }} to new version ${{ env.new_version }}"
+
       - run: ./tools/update-timezone.mjs
+        if: ${{ env.new_version != env.current_version }}
 
       - name: Update the expected timezone version in test
+        if: ${{ env.new_version != env.current_version }}
         run: echo "${{ env.new_version }}" > test/fixtures/tz-version.txt
 
       - name: Open Pull Request
+        if: ${{ env.new_version != env.current_version }}
         uses: gr2m/create-or-update-pull-request-action@77596e3166f328b24613f7082ab30bf2d93079d5  # Create a PR or update the Action's existing PR
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}

CHANGELOG.md

@@ -36,7 +36,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V21.md#21.5.0">21.5.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V21.md#21.6.0">21.6.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V21.md#21.5.0">21.5.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V21.md#21.4.0">21.4.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V21.md#21.3.0">21.3.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V21.md#21.2.0">21.2.0</a><br/>

LICENSE

@@ -1285,7 +1285,7 @@ The externally maintained libraries used by Node.js are:
 - zlib, located at deps/zlib, is licensed as follows:
   """
     zlib.h -- interface of the 'zlib' general purpose compression library
-    version 1.3, August 18th, 2023
+    version 1.3.0.1, August xxth, 2023
 
     Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
 
@@ -1972,6 +1972,35 @@ The externally maintained libraries used by Node.js are:
     OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   """
 
+- gypi_to_gn.py, located at tools/gypi_to_gn.py, is licensed as follows:
+  """
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are
+    met:
+
+       * Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+       * Redistributions in binary form must reproduce the above
+    copyright notice, this list of conditions and the following disclaimer
+    in the documentation and/or other materials provided with the
+    distribution.
+       * Neither the name of Google LLC nor the names of its
+    contributors may be used to endorse or promote products derived from
+    this software without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+    "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+    LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+    A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+    OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+    SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+    LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+    THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+    (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+    OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  """
+
 - ESLint, located at tools/node_modules/eslint, is licensed as follows:
   """
     Copyright OpenJS Foundation and other contributors, <www.openjsf.org>

SECURITY.md

@@ -124,6 +124,8 @@ lead to a loss of confidentiality, integrity, or availability.
    end being on the local machine or remote.
 6. The file system when requiring a module.
    See <https://nodejs.org/api/modules.html#all-together>.
+7. The `node:wasi` module does not currently provide the comprehensive file
+   system security properties provided by some WASI runtimes.
 
 Any unexpected behavior from the data manipulation from Node.js Internal
 functions may be considered a vulnerability if they are exploitable via

benchmark/buffers/buffer-bytelength-string.js

@@ -2,7 +2,8 @@
 const common = require('../common');
 
 const bench = common.createBenchmark(main, {
-  type: ['one_byte', 'two_bytes', 'three_bytes', 'four_bytes'],
+  type: ['one_byte', 'two_bytes', 'three_bytes',
+         'four_bytes', 'latin1'],
   encoding: ['utf8', 'base64'],
   repeat: [1, 2, 16, 256], // x16
   n: [4e6],
@@ -14,6 +15,8 @@ const chars = {
   two_bytes: 'ΰαβγδεζηθικλμνξο',
   three_bytes: '挰挱挲挳挴挵挶挷挸挹挺挻挼挽挾挿',
   four_bytes: '𠜎𠜱𠝹𠱓𠱸𠲖𠳏𠳕𠴕𠵼𠵿𠸎𠸏𠹷𠺝𠺢',
+  latin1: 'Un homme sage est supérieur à toutes ' +
+    'les insultes qui peuvent lui être adressées, et la meilleure réponse est la patience et la modération.',
 };
 
 function getInput(type, repeat, encoding) {

benchmark/error/system-error-instantiation.js

@@ -0,0 +1,64 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const bench = common.createBenchmark(main, {
+  n: [1e6],
+  code: [
+    'built-in',
+    'ERR_FS_CP_DIR_TO_NON_DIR',
+  ],
+  stackTraceLimit: [0, 10],
+}, {
+  flags: ['--expose-internals'],
+});
+
+function getErrorFactory(code) {
+  const {
+    ERR_FS_CP_DIR_TO_NON_DIR,
+  } = require('internal/errors').codes;
+
+  switch (code) {
+    case 'built-in':
+      return (n) => new Error();
+    case 'ERR_FS_CP_DIR_TO_NON_DIR':
+      return (n) => new ERR_FS_CP_DIR_TO_NON_DIR({
+        message: 'cannot overwrite directory',
+        path: 'dest',
+        syscall: 'cp',
+        errno: 21,
+        code: 'EISDIR',
+      });
+    default:
+      throw new Error(`${code} not supported`);
+  }
+}
+
+function main({ n, code, stackTraceLimit }) {
+  const getError = getErrorFactory(code);
+
+  Error.stackTraceLimit = stackTraceLimit;
+
+  // Warm up.
+  const length = 1024;
+  const array = [];
+  for (let i = 0; i < length; ++i) {
+    array.push(getError(i));
+  }
+
+  bench.start();
+
+  for (let i = 0; i < n; ++i) {
+    const index = i % length;
+    array[index] = getError(index);
+  }
+
+  bench.end(n);
+
+  // Verify the entries to prevent dead code elimination from making
+  // the benchmark invalid.
+  for (let i = 0; i < length; ++i) {
+    assert.strictEqual(typeof array[i], 'object');
+  }
+}

benchmark/fs/bench-mkdtempSync.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const common = require('../common');
+const fs = require('fs');
+const assert = require('assert');
+const tmpdir = require('../../test/common/tmpdir');
+
+const bench = common.createBenchmark(main, {
+  type: ['valid-string', 'valid-buffer', 'invalid'],
+  n: [1e4],
+});
+
+function main({ n, type }) {
+  tmpdir.refresh();
+  const options = { encoding: 'utf8' };
+  let prefix;
+  let out = true;
+
+  switch (type) {
+    case 'valid-string':
+      prefix = tmpdir.resolve(`${Date.now()}`);
+      break;
+    case 'valid-buffer':
+      prefix = Buffer.from(tmpdir.resolve(`${Date.now()}`));
+      break;
+    case 'invalid':
+      prefix = tmpdir.resolve('non-existent', 'foo', 'bar');
+      break;
+    default:
+      new Error('Invalid type');
+  }
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    try {
+      out = fs.mkdtempSync(prefix, options);
+    } catch {
+      // do nothing
+    }
+  }
+  bench.end(n);
+  assert.ok(out);
+}

benchmark/misc/startup-cli-version.js

@@ -1,6 +1,7 @@
 'use strict';
 const common = require('../common.js');
 const { spawnSync } = require('child_process');
+const { existsSync } = require('fs');
 const path = require('path');
 
 // This benchmarks the startup of various CLI tools that are already
@@ -11,6 +12,7 @@ const path = require('path');
 const bench = common.createBenchmark(main, {
   cli: [
     'tools/node_modules/eslint/bin/eslint.js',
+    'deps/npm/bin/npx-cli.js',
     'deps/npm/bin/npm-cli.js',
     'deps/corepack/dist/corepack.js',
   ],
@@ -45,6 +47,10 @@ function spawnProcess(cli, bench, state) {
 
 function main({ count, cli }) {
   cli = path.resolve(__dirname, '../../', cli);
+  if (!existsSync(cli)) {
+    return;
+  }
+
   const warmup = 3;
   const state = { count, finished: -warmup };
   spawnProcess(cli, bench, state);

benchmark/perf_hooks/histogram-record.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const assert = require('assert');
+const common = require('../common.js');
+
+const { createHistogram } = require('perf_hooks');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+});
+
+function main({ n }) {
+  const histogram = createHistogram();
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    histogram.record(i + 1);
+    /* eslint-disable no-unused-expressions */
+    histogram.max;
+    histogram.mean;
+    /* eslint-enable no-unused-expressions */
+  }
+  bench.end(n);
+
+  // Avoid V8 deadcode (elimination)
+  assert.ok(histogram);
+}

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.18',
+    'v8_embedder_string': '-node.19',
 
     ##### V8 defaults for Node.js #####
 

configure.py

@@ -1273,9 +1273,7 @@ def configure_node(o):
 
   o['variables']['want_separate_host_toolset'] = int(cross_compiling)
 
-  # Enable branch protection for arm64
   if target_arch == 'arm64':
-    o['cflags']+=['-msign-return-address=all']
     o['variables']['arm_fpu'] = options.arm_fpu or 'neon'
 
   if options.node_snapshot_main is not None:

deps/acorn/acorn-walk/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 8.3.1 (2023-12-06)
+
+### Bug fixes
+
+Add `Function` and `Class` to the `AggregateType` type, so that they can be used in walkers without raising a type error.
+
+Visitor functions are now called in such a way that their `this` refers to the object they are part of.
+
+## 8.3.0 (2023-10-26)
+
+### New features
+
+Use a set of new, much more precise, TypeScript types.
+
 ## 8.2.0 (2021-09-06)
 
 ### New features