deps: update libuv to 1.53.0 by nodejs-github-bot · Pull Request #66282 · nodejs/node

nodejs-github-bot · 2026-09-25T13:17:17Z

This is an automated update of libuv to 1.53.0.

nodejs-github-bot · 2026-09-25T13:17:23Z

Review requested:

@nodejs/security-wg

panva · 2026-09-25T13:20:52Z

This should also fix the SmartOS test-worker-init-failure flake in the reliability report, introduced by #65796.

Switching V8's entropy source to uv_random() made worker initialization open /dev/urandom on SmartOS. Under the test's deliberate file-descriptor exhaustion, that can abort the entire process instead of reporting a worker initialization error. libuv/libuv#5187 (part of this release) switches to getrandom(2), removing that descriptor dependency.

nodejs-github-bot · 2026-09-25T14:24:08Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77900/

richardlau · 2026-09-25T14:27:27Z

https://github.com/nodejs/node/actions/runs/36140009857/job/108087238784?pr=66282#step:6:4886

lld-link : error : undefined symbol: WaitOnAddress [D:\a\node\node\node_js2c.vcxproj]
  >>> referenced by D:\a\node\node\deps\uv\src\win\pipe.c:1066
  >>>               libuv.lib(pipe.obj):(uv__pipe_cancel_synchronous_io)
  
lld-link : error : undefined symbol: WakeByAddressSingle [D:\a\node\node\node_js2c.vcxproj]
  >>> referenced by D:\a\node\node\deps\uv\src\win\pipe.c:1450
  >>>               libuv.lib(pipe.obj):(uv__pipe_begin_synchronous_io)
  >>> referenced by D:\a\node\node\deps\uv\src\win\pipe.c:1460
  >>>               libuv.lib(pipe.obj):(uv__pipe_begin_synchronous_io)

aduh95 · 2026-09-25T20:12:39Z

---
duration_ms: 221.414
exitcode: 1
severity: fail
stack: |-
  node:internal/assert/utils:146
    throw error;
    ^

  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:

  true !== false

      at Object.<anonymous> (/home/iojs/build/workspace/node/test/parallel/test-blocklist.js:891:10)
      at Module._compile (node:internal/modules/cjs/loader:1956:14)
      at Object..js (node:internal/modules/cjs/loader:2096:10)
      at Module.load (node:internal/modules/cjs/loader:1678:32)
      at Module._load (node:internal/modules/cjs/loader:1470:12)
      at wrapModuleLoad (node:internal/modules/cjs/loader:261:19)
      at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:171:5)
      at node:internal/main/run_main_module:33:47 {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: true,
    expected: false,
    operator: 'strictEqual',
    diff: 'simple'
  }

  Node.js v27.0.0-pre
...

jonathanlindsay · 2026-09-28T08:25:23Z

This release includes libuv/libuv#5181, which fixes spawn with 'pipe'/'ipc' hanging inside a Windows AppContainer. Requesting it for v24.x as well once it lands: #66374.

ywkuno · 2026-10-02T14:03:49Z

Hi, I looked into the two CI failures on this PR and have fixes on a branch, in case they're useful:
actions/tools-update-libuv...ywkuno:node:libuv-1.53-followups

Windows link failure. libuv 1.53's pipe code now calls WaitOnAddress / WakeByAddressSingle, which live in Synchronization.lib. Node's uv.gyp doesn't link that library, so the build fails with LNK2019 for both symbols (from libuv.lib(pipe.obj)), then LNK1120 in node_js2c.exe. I reproduced this at d44f17a with VS 17.14 / MSVC 19.44.
50a0710 deps: link Synchronization.lib in uv.gyp
b559a3a deps: link Synchronization.lib in uv GN build. This is the corresponding change for unofficial.gni; I haven't built with GN yet.
With these, node.exe links and process.versions.uv is 1.53.0.

test-blocklist failure on Linux. libuv 1.53 includes the change from 6179e7af, which replaces the hard-coded IPv6 address buffer size in uv_ip6_addr() with INET6_ADDRSTRLEN. Longer zoned IPv6 address parts are therefore parsed instead of being truncated at the old limit. FastCheckString() still rejects address parts of 40+ characters, so the fast and slow BlockList paths disagree for the same string. That's the test-blocklist.js:891 failure. I reproduced it on Fedora 44 / GCC 16.2.
59eedfa net: align BlockList fast path with uv_ip6_addr. It truncates the address part to INET6_ADDRSTRLEN - 1, matching uv_ip6_addr(), updates the test-blocklist expectation, and adds a fast-API test comparing both paths. It depends on the libuv 1.53 behavior, so it belongs with this update.
test-blocklist.js and test-blocklist-fast-api.js pass; make lint-js, lint-cpp and format-cpp are clean; core-validate-commit passes.

I used a closed-source coding agent to help investigate and draft these. I reviewed the changes, reproduced both failures and verified the fixes myself, and I'm happy to explain or adjust anything. Feel free to cherry-pick or adapt them into this PR, or let me know if you'd rather have a separate PR.

Track the descriptor-dependent V8 entropy failure until the libuv update in #66282 removes the dependency on opening /dev/urandom. Signed-off-by: Filip Skokan <[email protected]> Assisted-by: Codex PR-URL: #66428 Reviewed-By: Stefan Stojanovic <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Yong Wei <[email protected]>

nodejs-github-bot · 2026-10-06T10:05:24Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78202/

codecov · 2026-10-06T10:47:54Z

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.47%. Comparing base (c60762c) to head (7953577).
⚠️ Report is 184 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_sockaddr.cc	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66282      +/-   ##
==========================================
+ Coverage   90.43%   90.47%   +0.04%     
==========================================
  Files         790      791       +1     
  Lines      275435   277088    +1653     
  Branches    52823    53282     +459     
==========================================
+ Hits       249082   250693    +1611     
- Misses      16769    16812      +43     
+ Partials     9584     9583       -1

Files with missing lines	Coverage Δ
src/node_sockaddr.cc	`75.33% <0.00%> (ø)`

... and 93 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-10-09T15:07:52Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78270/

aduh95 · 2026-10-09T15:53:05Z

We're getting a consistent Failed to build addon in /home/iojs/build/workspace/node/test/ffi/fixture_library

According to an LLM, it's a libuv 1.53.0 regression

This is a libuv 1.53.0 regression. On RHEL8's glibc 2.28, child processes lose their stdio, so node-gyp's python and make children can't write anything. That's why the error has no output.

Root cause

libuv 1.53.0 now uses posix_spawn on Linux ("unix: use posix_spawn instead of fork"). An inherited stdio fd that keeps its number (stdio [0,1,2], which node-gyp uses) becomes posix_spawn_file_actions_adddup2(fd, fd). On Apple it's addinherit_np.
Node calls uv_disable_stdio_inheritance() at startup, so fds 0-2 are always FD_CLOEXEC in a node process (I confirmed this with strace).
adddup2(fd, fd) only clears FD_CLOEXEC from glibc 2.29 (BZ doc: inspector security warning for changing host to a public IP #23640). On 2.28 the child's stdout and stderr get closed at exec. The fork path used to clear the flag by hand (uv__cloexec(use_fd, 0)).
test/ffi is just the first addon build-ci builds. Every node-gyp build would fail the same way.

Repro (standalone libuv plus a small spawn program, stdout marked CLOEXEC, inheriting fds 0-2):

rockylinux:8 (glibc 2.28): 1.52.1 works; 1.53.0 gives sh: echo: write error: Bad file descriptor.
rockylinux:9 (glibc 2.34): both versions work.

Proposed fix (for deps/uv, and to send upstream to libuv): on glibc older than 2.29, fall back to fork/exec whenever a stdio fd is inherited at the same number. It's a runtime check, so a binary built on a newer glibc but run on 2.28 is still covered.

--- a/deps/uv/src/unix/process.c
+++ b/deps/uv/src/unix/process.c
@@ -36,6 +36,9 @@
 #include <spawn.h>
 #include <paths.h>
 #include <dlfcn.h>
+#if defined(__GLIBC__)
+#include <gnu/libc-version.h>
+#endif
 
 #if defined(__PASE__)
 #define _PATH_DEFPATH "/QOpenSys/pkgs/bin:/QOpenSys/usr/bin:/usr/bin"
@@ -86,6 +89,7 @@
 
 static uv_once_t posix_spawn_init_once = UV_ONCE_INIT;
 static int posix_spawn_can_use_setsid;
+static int posix_spawn_dup2_clears_cloexec = 1;
 static volatile int posix_spawn_works;
 
 static struct uv__posix_spawn_fncs_s {
@@ -520,6 +524,19 @@
     posix_spawn_fncs.file_actions.addchdir =
       dlsym(RTLD_DEFAULT, "posix_spawn_file_actions_addchdir_np");
 
+#if defined(__GLIBC__)
+  /* posix_spawn_file_actions_adddup2(fd, fd) only clears FD_CLOEXEC since
+   * glibc 2.29 (BZ #23640); with older versions, inheriting a close-on-exec fd
+   * at the same number would close it in the child, so use fork() instead. */
+  {
+    unsigned major;
+    unsigned minor;
+    if (sscanf(gnu_get_libc_version(), "%u.%u", &major, &minor) != 2 ||
+        major < 2 || (major == 2 && minor < 29))
+      posix_spawn_dup2_clears_cloexec = 0;
+  }
+#endif
+
 #ifdef __APPLE__
   /* Init feature detection for POSIX_SPAWN_SETSID flag. */
   uv__spawn_init_can_use_setsid();
@@ -633,6 +650,17 @@
       goto error;
   }
 
+#if defined(__linux__)
+  if (!posix_spawn_dup2_clears_cloexec) {
+    for (fd = 0; fd < stdio_count; fd++) {
+      if (pipes[fd][1] == fd) {
+        err = ENOSYS;
+        goto error;
+      }
+    }
+  }
+#endif
+
   /* Do not return ENOSYS after this point, as we may mutate pipes. */
 
   /* First duplicate low numbered fds, since it's not safe to duplicate them,

With this patch the repro passes on Rocky 8 and is unchanged on Rocky 9. libuv's spawn/process tests pass on both, run as non-root.

Why not the simpler change: dropping || defined(__linux__) so Linux does the "copy up and back" step that other platforms do looks smaller, but I'd avoid it. That path calls uv__nonblock_fcntl(use_fd, 0) in the parent on the temporary fd number, which only exists in the child. It could clear O_NONBLOCK on an unrelated parent fd.

Not verified:

I didn't build a full node or test arm64. The repro ran on x86_64 with the same glibc.
I didn't check older musl versions, which the patch leaves alone.

nodejs-github-bot · 2026-10-11T22:37:54Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78324/

nodejs-github-bot · 2026-10-12T12:42:35Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78336/

nodejs-github-bot · 2026-10-12T14:40:00Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78339/

nodejs-github-bot · 2026-10-12T16:46:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78341/

`npm run test:stress` on Windows died now and then with no output: node exited with 0xC0000409 and jest's RUNS line just stopped. A crash dump taken with procdump and symbolised against node's public PDB shows a stack-cookie failure (__report_gsfailure) in uv__tcp_connect, reached from TCPWrap::Connect. On every loopback connect, libuv passes an uninitialised OSVERSIONINFOW to RtlGetVersion; when the stack garbage reads as the size of the larger OSVERSIONINFOEXW, RtlGetVersion writes 8 bytes past it. This is libuv #5106, fixed in libuv 1.53.0. Every released node, 18 through 26.11.1, ships an older libuv (nodejs/node#66282 is still open), and the NRPE and NSCA floods open millions of loopback connections per run. The floods' connections now come from stress/lib/socket_pump.py, a standard-library Python helper driven over stdin/stdout by socket-pump.ts. It knows no protocol: NrpeClient and NscaClient still build and check every packet in TypeScript, and the pump only connects (with TLS if asked), writes, and reads until the agent closes. For NSCA it hands the IV back to node in the middle of the exchange. Requests are spread over four pump processes (NSCP_STRESS_PUMPS), because one topped out at ~3900 NSCA submissions/s. Once the agent has closed, the pump hangs up with a linger-0 reset, so neither side keeps the connection in TIME_WAIT. Without that, the agent's side held one TIME_WAIT pair per client port after a plain flood, and the TLS flood that followed on the same port had SYNs from reused ports dropped (21 s connect timeouts, WinError 121). The pump uses the selector event loop: the Windows proactor transport sends a FIN before closing, so it never resets. NSCP_STRESS_SOCKETS picks the transport. The stress global setup defaults it to python; it stays node everywhere else, so engine-concurrency.test.ts, which borrows the NRPE client, needs no Python. NrpeClient takes its TLS client certificate as files, which Python's ssl needs. The full suite passed 10/10 on Windows, plain NRPE at 10918 requests/s (node managed 5506) and NSCA at 6234/s. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Michael Medin <[email protected]>

nodejs-github-bot added the dependencies PRs that add, update, or configure Node.js dependencies. label Sep 25, 2026

nodejs-github-bot added libuv Issues and PRs related to the libuv dependency or the uv binding. needs-ci PRs that need a full CI run. labels Sep 25, 2026

cjihrig approved these changes Sep 25, 2026

View reviewed changes

aduh95 added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 25, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 25, 2026

aduh95 removed the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Sep 25, 2026

nodejs-github-bot force-pushed the actions/tools-update-libuv branch from 98c9628 to d44f17a Compare September 27, 2026 01:01

This was referenced Sep 28, 2026

Backport libuv 1.53.0 (Windows AppContainer named-pipe fix) to v24.x #66374

Closed

Raise the Node floor to the first releases carrying libuv 1.53 (Windows AppContainer) openclaw/openclaw#160285

Open

stefanhoelzl mentioned this pull request Sep 29, 2026

test(e2e): give Claude a long-path config dir so the IDE server cannot abort stefanhoelzl/codehydra#718

Merged

panva mentioned this pull request Oct 1, 2026

test: fix Windows report cleanup and mark SmartOS flake #66428

Closed

deps: update libuv to 1.53.0

97d2771

nodejs-github-bot force-pushed the actions/tools-update-libuv branch from d44f17a to 97d2771 Compare October 4, 2026 01:29

marco-ippolito mentioned this pull request Oct 4, 2026

tools: skip dependency update if PR has non-bot commits #66503

Open

hussainph mentioned this pull request Oct 5, 2026

fix(pty): update Node to 24.21 for upstream Linux EOF fix (VC-639) hussainph/volli-code#751

Merged

ywkuno and others added 2 commits October 6, 2026 10:21

fixup! deps: update libuv to 1.53.0

ba8a187

Signed-off-by: Yong Wei <[email protected]>

fixup! fixup! deps: update libuv to 1.53.0

6cf6d6c

PierrunoYT mentioned this pull request Oct 9, 2026

Windows sandbox: npm test fails and node --test hangs inside the AppContainer PierrunoYT/patch#101

Open

aduh95 mentioned this pull request Oct 10, 2026

uv_spawn hangs on Cygwin with libuv 1.53.0 libuv/libuv#5335

Closed

nodejs-github-bot force-pushed the actions/tools-update-libuv branch from 6cf6d6c to 834d87a Compare October 11, 2026 01:04

debug! add rhel8 special code (not reviewed upstream)

7953577

aduh95 force-pushed the actions/tools-update-libuv branch from 834d87a to 7953577 Compare October 11, 2026 22:36

aduh95 mentioned this pull request Oct 12, 2026

nodejs_26: fix build with libuv 1.53 NixOS/nixpkgs#573193

Merged

2 of 13 tasks

Conversation

nodejs-github-bot commented Sep 25, 2026

Uh oh!

nodejs-github-bot commented Sep 25, 2026

Uh oh!

panva commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 25, 2026

Uh oh!

richardlau commented Sep 25, 2026

Uh oh!

aduh95 commented Sep 25, 2026

Uh oh!

jonathanlindsay commented Sep 28, 2026

Uh oh!

ywkuno commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Oct 6, 2026

Uh oh!

codecov Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Oct 9, 2026

Uh oh!

aduh95 commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Oct 11, 2026

Uh oh!

nodejs-github-bot commented Oct 12, 2026

Uh oh!

nodejs-github-bot commented Oct 12, 2026

Uh oh!

nodejs-github-bot commented Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

panva commented Sep 25, 2026 •

edited

Loading

ywkuno commented Oct 2, 2026 •

edited

Loading

codecov Bot commented Oct 6, 2026 •

edited

Loading

aduh95 commented Oct 9, 2026 •

edited

Loading