Signed-off-by: haramjeong <04harams77@gmail.com>
PR-URL: nodejs#63261
Fixes: nodejs#63258
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

CreateString() and Parse() in node_cjs_lexer.cc unconditionally called
ToLocalChecked() on the results of String::NewFromOneByte(),
String::NewFromUtf8() and Set::Add(). If string or handle allocation
fails or an exception is pending on the isolate, these return an empty
MaybeLocal and ToLocalChecked() aborts the process with
"FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal".

Since Parse() is on the hot path of every ESM import of a CJS module
(cjsPreparseModuleExports), propagate the failure as a regular pending
JavaScript exception instead so callers can recover.

Fixes: nodejs#63323
Refs: nodejs#61456
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#63885
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#63815
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#63883
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Ensure the debugger CLI waits for post-connect initialization before
resolving the run and restart commands. This prevents tests and users
from observing a prompt before Runtime.runIfWaitingForDebugger() has
released the new debuggee.

Refs: nodejs#61762

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: nodejs#63607
Refs: nodejs#61762
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>

PR-URL: nodejs#63898
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#63823
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#63833
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>

PR-URL: nodejs#63899
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#63909
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

The helper no longer treats every raw alias the
same way and unintended values were accepted for
some algorithms.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#63910
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

When sqlite3_open_v2() fails, SQLite still assigns a database handle
in a "sick" state. Such a handle may only be used to retrieve the
error and must then be released with sqlite3_close(). Keeping it in
connection_ meant that after a failed open():

- isOpen incorrectly reported true,
- every method passed the "database is not open" check and called
  SQLite APIs on the sick handle, which is an API misuse,
- registering a user-defined function leaked its user data in builds
  with SQLITE_ENABLE_API_ARMOR, because SQLite rejects the call
  before taking ownership of the user data,
- open() could not be retried since the database appeared open.

Close and reset the connection handle when open() fails at any point
so that the database remains closed and open() can be retried.

Fixes: nodejs#63831
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#63854
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>

The CJS mock.timers.setTime example asserted the timer ran right after
setTime() with no tick() call, which contradicts the documented behavior
and the ESM example above it. The mock.module example called .fn() on an
export named foo. Both threw if run.

Signed-off-by: Emmanuel Yusufu Kimaswa <kimaswaemma36@gmail.com>
PR-URL: nodejs#63656
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Jacob Smith <jacob@frende.me>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#63924
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Add micro-benchmarks that isolate the hot paths targeted by the
JavaScript-to-C++ migration of child_process:

- child-process-spawn-options.js scales the env vars and args that
  ProcessWrap::Spawn must marshal across the JS/C++ boundary.
- child-process-ipc-roundtrip.js measures IPC throughput for both the
  json and advanced serializers across a range of payload sizes.
- child-process-exec-maxbuffer.js measures stdout accumulation and
  maxBuffer handling in execFile().

These establish the baseline that later migration PRs are compared
against. There is no runtime behavior change.

Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#63929
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#63822
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

Keep the initial --inspect-brk pause held until probe breakpoints are
bound and probe mode explicitly releases the target. This prevents the
generic pause handler from resuming user code before probes are ready.

Refs: https://github.com/nodejs/node/actions/runs/26482141780/job/77981519238

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: nodejs#63608
Refs: https://github.com/nodejs/node/actions/runs/26482141780/job/77981519238
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#63939
Fixes: nodejs/security-wg#1568
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>

The `advanced` IPC serialization codec was implemented in JavaScript
(ChildProcessSerializer / ChildProcessDeserializer in
lib/internal/child_process/serialization.js). It allocated a wrapper
serializer/deserializer per message and crossed the JS/C++ boundary
several times for every message (writeHeader, writeValue, releaseBuffer,
readHeader, readValue and friends).

Move the codec into a native `ipc_serdes` binding that drives the V8
ValueSerializer/ValueDeserializer with a C++ delegate. The wire format
is preserved byte-for-byte: a big-endian uint32 length prefix followed
by the V8 payload, with ArrayBufferViews tagged as host objects so that
Node Buffers round-trip as Buffers rather than plain Uint8Arrays. The
JSON codec is left unchanged.

A cctest (test/cctest/test_node_ipc_serdes.cc) exercises the binding
directly, covering round-trips of primitives, objects, typed arrays and
Buffers (including the Buffer-vs-Uint8Array distinction) and asserting
the big-endian length-prefix framing.

Round-trip throughput
(benchmark/child_process/child-process-ipc-roundtrip):

  payload   before     after      change
  64 B      ~300k/s    ~800k/s    +166%
  1 KiB     ~272k/s    ~616k/s    +126%
  16 KiB    ~91k/s     ~120k/s    +32%
  64 KiB    ~30k/s     ~35k/s     +16%

The gain is largest for small messages, where per-message JavaScript
overhead dominated, and tapers for large messages, where the actual
serialization (already native) dominates.

Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: nodejs#63933
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

Closes: nodejs#59493
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#63942
Fixes: nodejs#59493
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#63819
Reviewed-By: Paolo Insogna <paolo@cowtech.it>

This notable includes stream/iter (since they're closely related and
rapidly evolving together) and ngtcp2, nghttp3 & openssl deps.

Based on test-linux.yml, the main differences are simplifications: PRs
only, filtered to specific paths, just one build (ARM only), no unusual
characters test.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#63875
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

This changes `BignumPointer::GetWord` such that it does not hide errors
from the caller. In the context of RSA keys within X.509 certificates,
we should eventually compute the public exponent correctly regardless of
its size. This patch, however, is designed to be a minimal change that
prevents callers from using erroneous return values of `BN_get_word`.

Signed-off-by: Tobias Nießen <tniessen@tnie.de>
PR-URL: nodejs#63895
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#62217
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

This changes enables compression within OpenSSL *without* enabling
record compression, so this only affects compression of certificates
delivered within the TLS handshake. This certificate compression remains
disabled by default for now, but becomes available via the new
certificateCompression option in TLS context APIs.

Enabling this shrinks handshakes significantly, and also reduces
fingerprintability of Node.js client handshakes, as these are enabled in
all modern browsers by default.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: nodejs#62217
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

The `inspector.close()` forcefully terminates all active connections,
allowing the process to exit cleanly, without waiting for the devtool
client to disconnect.

Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: nodejs#63837
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#64009
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#63964
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: nodejs#63961
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Consolidate the spec's per-chunk predicate chains (CanCloseOrEnqueue,
IsLocked, HasDefaultReader, GetNumReadRequests, GetDesiredSize and the
writable-side equivalents) into single passes over the controller and
stream state, mirror "close queued or in flight" as a boolean flag
maintained at the few close-request transition sites, and materialize
the TransformStream [[backpressureChangePromise]] record lazily on
first observation so backpressure flips nobody is waiting on allocate
nothing.

Assisted-by: Claude Code
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#64252
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#64259
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Signed-off-by: Guy Bedford <guybedford@gmail.com>
PR-URL: nodejs#63951
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Original commit message:

    optimize ascii fast path in WriteUtf8V2

    Change-Id: If28168cb4395b953d0ec642ef4fc618ce963dbcd
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124103
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Erik Corry <erikcorry@chromium.org>
    Reviewed-by: Erik Corry <erikcorry@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#103542}

Refs: v8/v8@64b36b4
(cherry picked from commit ea1f127)
PR-URL: nodejs#61712
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>