2026-10-14, Version 26.12.0 (Current) - #66684

Backport the Maglev HeapNumber materialization fix to V8 14.6.
Use the existing offset constants and virtual-object slot traversal.

Original commit message:

    [maglev] Materialize a fresh HeapNumber per deoptimization

    This matches what Turbolev graph builder already does to Maglev.

    Fixed: 547819997
    Change-Id: Iafc1185ef96db8816db36b295a3a4b7e528f9863
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8255554
    Reviewed-by: Leszek Swirski <[email protected]>
    Commit-Queue: Victor Gomes <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#109347}

Refs: v8/v8@7d5eb1d
Refs: #66457
Refs: https://www.cve.org/CVERecord?id=CVE-2026-85045
Signed-off-by: inoway46 <[email protected]>
Assisted-by: Codex
PR-URL: #66566
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

The typed array Blob constructor tests expect little-endian byte order.
Mark them as expected failures only on big-endian platforms, so failures
on little-endian platforms remain visible.

Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Claude, Codex
PR-URL: #66322
Reviewed-By: Daeyeon Jeong <[email protected]>

Honor allow_uncaught_exception for unhandled promise rejections in both
WPT worker paths. Apply setup settings before nested callbacks, preserve
settings after results start, and apply promise_setup settings when its
callback runs. Keep rejection failures in single_test mode.

Cover both runner backends and Web Workers, and remove the flaky
expectation for the Web Locks test that deliberately rejects.

Refs: #59142
Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Claude, Codex
PR-URL: #66322
Reviewed-By: Daeyeon Jeong <[email protected]>

This test was skipped after hangs with V8 11.2. The associated compiler
shutdown deadlock involved NodePlatform::DrainTasks waiting for worker
tasks that needed garbage collection on the blocked main thread.

Since 5fb879c, DrainTasks only waits for user-blocking tasks, which
excludes ordinary background compilation. Remove the obsolete skip.

Refs: #47297
Signed-off-by: Filip Skokan <[email protected]>
Assisted-by: Claude, Codex
PR-URL: #66322
Reviewed-By: Daeyeon Jeong <[email protected]>

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 7.1.0 to 7.1.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@0b35c9e...303a32d)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #66448
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Bumps the eslint group in /tools/eslint with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `8.0.5` | `8.0.6` |
| [@babel/eslint-parser](https://github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser) | `8.0.5` | `8.0.6` |
| [eslint](https://github.com/eslint/eslint) | `10.10.0` | `10.11.0` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `64.3.10` | `64.5.4` |
| [eslint-plugin-regexp](https://github.com/ota-meshi/eslint-plugin-regexp) | `3.3.0` | `3.3.1` |

Updates `@babel/core` from 8.0.5 to 8.0.6
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.6/packages/babel-core)

Updates `@babel/eslint-parser` from 8.0.5 to 8.0.6
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.6/eslint/babel-eslint-parser)

Updates `eslint` from 10.10.0 to 10.11.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.10.0...v10.11.0)

Updates `eslint-plugin-jsdoc` from 64.3.10 to 64.5.4
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v64.3.10...v64.5.4)

Updates `eslint-plugin-regexp` from 3.3.0 to 3.3.1
- [Release notes](https://github.com/ota-meshi/eslint-plugin-regexp/releases)
- [Changelog](https://github.com/ota-meshi/eslint-plugin-regexp/blob/master/CHANGELOG.md)
- [Commits](ota-meshi/eslint-plugin-regexp@v3.3.0...v3.3.1)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 8.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: "@babel/eslint-parser"
  dependency-version: 8.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: eslint
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: eslint-plugin-regexp
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #66445
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

The fs.createReadStream(blockedFile) and fs.lstatSync(bufferBlockedFile)
assertions were each present twice in the same block with identical
arguments and expectations, so the second copy added no coverage.

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: #66450
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

`worker.isConnected()` and `worker.isDead()` described their boolean
result only in prose, so the documentation tooling had no return type
for them.

Signed-off-by: Daniel Pinto <[email protected]>
Assisted-by: a frontier reasoning model
PR-URL: #66453
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Use isArrayBuffer() instead of comparing Object.prototype.toString()
output. The old check depended on Symbol.toStringTag, so a real
ArrayBuffer with a custom tag was rejected, and a plain object tagged
'ArrayBuffer' passed and failed later in native code with a misleading
error.

Signed-off-by: Trivikram Kamat <[email protected]>
Assisted-by: claude:opus-5.5
PR-URL: #66455
Fixes: #66454
Reviewed-By: René <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

The test and its benchmark subprocesses allocate large histograms.
Run it sequentially to reduce memory pressure on constrained CI hosts.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #66338
Reviewed-By: Chemi Atlow <[email protected]>

Remove ExperimentalWarning from algorithms and methods that are on their
way to an unflagged browser implementation.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #66312
Reviewed-By: James M Snell <[email protected]>

Port the SonicBoom tests that could not be imported directly because
they depend on the third-party proxyquire module, along with the
maxWriteRetries option they exercise, into the Utf8Stream module.

Adds maxWriteRetries support, which bounds consecutive EAGAIN/EBUSY
retry attempts and resets the counter on forward progress, plus
drop-event and flush-callback edge-case coverage.

Fixes: #58955
Signed-off-by: Matteo Collina <[email protected]>
Assisted-by: pi
PR-URL: #66275
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Allow providers to be layered at one mount point. Reads search layers
in priority order, while writes copy lower-layer files to the first
provider and deletions hide lower copies without changing them.

Assisted-by: pi
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #66235
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>

Signed-off-by: Marco Ippolito <[email protected]>
PR-URL: #66431
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Edy Silva <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>

Signed-off-by: Marco Ippolito <[email protected]>
PR-URL: #66431
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Edy Silva <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>

Add t.assert.called(), t.assert.callCount(), t.assert.nthCalledWith()
and t.assert.lastCalledWith() for asserting on mock function calls.

Assisted-by: Claude
Signed-off-by: Guilherme Araújo <[email protected]>
PR-URL: #66476
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Add websocketMask(source, mask, output[, offset[, length]]) and
websocketUnmask(buffer, mask), which XOR data with a repeating 4-byte
key. This is the masking that WebSocket clients apply to every frame
they send (RFC 6455, Section 5.3), and that servers undo on every frame
they receive.

Userland WebSocket implementations do this either with a byte-by-byte
JS loop (undici, and ws without optional dependencies) or with the
bufferutil native addon. bufferutil is installed for only about 3% of
ws downloads and has no linux-arm64 prebuild, so almost all users run
the JS loop. The signature matches bufferutil, so existing users can
switch with a feature check, as ws did for buffer.isUtf8().

The implementation uses a V8 fast API call and processes 8-byte words,
which the compiler vectorizes. It handles overlapping source and output
views, and treats every view type as raw bytes. It is about 20x faster
than the JS loop at 1 KiB and 40x faster at 64 KiB, and faster than
bufferutil at every size from 32 bytes up.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode
PR-URL: #66335
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matthew Aitken <[email protected]>
Reviewed-By: Robert Nagy <[email protected]>

The C++ option parser treats `_` and `-` as the same character in
option names, so `--watch_path` is the same as `--watch-path`.

Watch mode compared spellings literally when it removed its own flags
from `process.execArgv` and `NODE_OPTIONS` before spawning the child.
The underscore spellings got through, so each child went back into
watch mode and spawned another child, and the application never ran.

Normalize option names before comparing them. Forward the original
arguments to the child unchanged.

Signed-off-by: Trivikram Kamat <[email protected]>
Assisted-by: claude:opus-5.5
PR-URL: #66365
Fixes: #66364
Reviewed-By: Moshe Atlow <[email protected]>

When `setBody()` receives a promise that resolves to an unsupported
body type, `configureOutbound()` throws inside the fulfillment
handler. The rejection handler only covered the original promise, so
the error rejected a discarded promise and crashed the process as an
unhandled rejection.

Catch errors thrown by `configureOutbound()` in the fulfillment
handler and destroy the stream with them, as the rejection handler
already does. For an unsupported resolved value, `stream.closed` now
rejects with the same `ERR_INVALID_ARG_TYPE` that `setBody()` throws
synchronously.

Signed-off-by: Christian Aurich Zanettini Martins <[email protected]>
PR-URL: #66260
Reviewed-By: Tim Perry <[email protected]>

`session.close()` and `session.destroy()` only checked that
`options.code` was a bigint or a number. Numbers were then converted
to `uint64_t` unchecked, so fractions were truncated and negative,
non-finite or too large values were undefined behavior. Bigints were
only checked to fit in 64 bits, but QUIC error codes are
variable-length integers limited to 62 bits, so larger codes cannot
be encoded in the `CONNECTION_CLOSE` frame.

Reject codes that are not integers between `0` and `2n ** 62n - 1n`,
the range `QuicError` already enforces, before any close or destroy
side effects.

Signed-off-by: Christian Aurich Zanettini Martins <[email protected]>
PR-URL: #66302
Reviewed-By: Tim Perry <[email protected]>

Signed-off-by: Geoffrey Booth <[email protected]>
PR-URL: #62530
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

PR-URL: #66517
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Several conversions from SQLite text to V8 strings passed a length of
-1 to String::NewFromUtf8(). With that length, V8 skips its length
check and aborts the process when the UTF-8 text exceeds
String::kMaxLength.

SQLite error messages embed the offending identifier or token, so
CreateSQLiteErrorImpl() could hit this. NullableSQLiteStringToValue(),
used for setAuthorizer() callback arguments and statement.columns()
metadata, had the same problem, and the authorizer also called
ToLocalChecked() on each argument.

Convert error messages with Utf8StringMaybeOneByte(), and check the
length up front in NullableSQLiteStringToValue(), so oversized strings
throw ERR_STRING_TOO_LONG as column values already do. In the
authorizer, deny the action and let the pending error reach the caller.

Signed-off-by: Trivikram Kamat <[email protected]>
Assisted-by: claude:opus-5.5
PR-URL: #66521
Fixes: #66520
Fixes: #66522
Reviewed-By: Guilherme Araújo <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Add the build platform and compiler for official musl binaries.

Signed-off-by: Ji Hoon Kang <[email protected]>
Assisted-by: Codex
PR-URL: #66523
Fixes: #66506
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: James M Snell <[email protected]>

`enableDefensive()` updated only the live connection, so after
`close()` and `open()` the defensive flag went back to the value
passed to the constructor. Store the new value in the open
configuration so that `open()` applies it again.

Signed-off-by: Trivikram Kamat <[email protected]>
Assisted-by: claude:opus-5.5
PR-URL: #66404
Fixes: #66403
Reviewed-By: Guilherme Araújo <[email protected]>

HdrHistogram_c 0.12.0 added a private header,
src/hdr_histogram_internal.h, which src/hdr_tests.h now includes.
update-histogram.sh copies a fixed list of files, so the automated
update to 0.12.0 would leave deps/histogram without it and fail to
compile. Add the header to the list.

Signed-off-by: fcostaoliveira <[email protected]>
PR-URL: #66528
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>

The root cert store and the certificates set through
tls.setDefaultCACertificates() were thread_local, with a cleanup hook on
whichever Environment used TLS first. When several Environments share a
thread, setting the default CA certificates in one of them replaced the
trusted CAs of the others. Keep both on the Environment, next to its
other OpenSSL state.

Signed-off-by: Shelley Vohr <[email protected]>
PR-URL: #66411
Refs: #66239
Reviewed-By: Anna Henningsen <[email protected]>

The ngtcp2 and nghttp3 allocators shared one thread_local state whose
BindingData pointer was set by the last BindingData that handed out an
allocator. With several Environments on a thread, memory allocated for
a session in one Environment was accounted against another's
BindingData and failed a CHECK when freed.

Give each BindingData its own heap-allocated state. nghttp3 buffers
backing external strings can be freed after the BindingData is gone,
so the state counts live allocations and is deleted once the
BindingData has been destroyed and the last of them is freed.

Signed-off-by: Shelley Vohr <[email protected]>
PR-URL: #66411
Refs: #66239
Reviewed-By: Anna Henningsen <[email protected]>

Several Environments can share a thread, so state in src/ that belongs
to one of them cannot be kept in a thread_local. Add a cpplint rule
that rejects thread_local in src/ unless the declaration is marked with
NOLINTNEXTLINE(runtime/thread_local), and mark the existing uses, which
are per-thread by design.

Signed-off-by: Shelley Vohr <[email protected]>
PR-URL: #66411
Refs: #66239
Reviewed-By: Anna Henningsen <[email protected]>

bytes(), text(), arrayBuffer(), array() and their sync variants kept a
snapshot object for every collected chunk, plus a batch entry and its
views array, so they can detect chunks that were resized or detached
before the result is assembled. For streams of many small chunks this
dominated memory use: collecting 1,000,000 one-byte chunks peaked at
about 490 MB of heap for 1 MB of data.

A non-empty view of a fixed-length, non-shared ArrayBuffer can only
change by its buffer being detached, which makes its byteLength 0, so
recording its byteLength is enough. Keep a full snapshot only for
empty views and views of resizable or shared buffers. The same input
now peaks at about 60 MB and is collected about five times faster.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

push(), duplex(), broadcast(), share() and shareSync() rejected an
explicit budget below 16384 bytes with ERR_OUT_OF_RANGE. The spec
(push() step 3, broadcast() step 1 and share() step 2) only requires
the implementation-defined default to be at least 16384 bytes; an
explicit budget is used as given. Small budgets are also useful in
tests and in memory-constrained code.

Accept any explicit budget of at least 1 byte, and validate it in one
place. Defaults are unchanged. The validation tests are updated to the
new lower bound; note that WebIDL conversion truncates fractions, so
1.5 is now a valid budget of 1 and 0.5 is used to exercise the
rejection instead.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

The spec (Writer write(), step 2) requires writes to a closed writer to
reject with a TypeError. The fromWritable() adapter rejected write()
and writev() with ERR_STREAM_WRITE_AFTER_END, which is a plain Error,
unlike the other stream/iter writers.

Add a TypeError variant of ERR_STREAM_WRITE_AFTER_END and use it, so
the error code is unchanged.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

The spec for stream/iter Writers (write(), step 2) requires writes to
a closed writer to reject with a TypeError, as the push(), broadcast()
and FileHandle writers do. The QUIC stream writer rejected write() and
writev() with a plain ERR_INVALID_STATE Error. Use its TypeError
variant; the error code is unchanged.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

The ERR_INVALID_ARG_TYPE messages for async iterable and promise inputs
read "must be an a synchronous input (not AsyncIterable)", because the
error formatter adds "an" to expected-type strings that contain
uppercase letters. Rephrase them in lowercase.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

Document behaviors that were previously only visible in the code:

- the writer "closing" state after end()/endSync(),
- writes made from argument conversion being ordered first,
- zero-length push() writes not being buffered,
- broadcast.cancel() also closing the paired writer,
- merge() not waiting for the other sources' cleanup on error,
- the options argument passed to the tap() callback,
- FileHandle writer() ordering of un-awaited writes, and the lazy
  locking of FileHandle pull() and pullSync().

Also link the WinterTC Iterable Streams API draft and list the exports
that are Node.js extensions to it.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

After writing every chunk, pipeToSync() treated endSync() returning -1
like any other error: it threw ERR_INVALID_STATE and, unless
preventFail was set, called writer.fail() with it. -1 only means that
the writer cannot close synchronously, e.g. a push() writer whose
consumer has not drained it yet. All of the data had been accepted,
but failing the writer discarded it, so the consumer saw an error
instead of the end of the stream, and the caller could not recover.

pipeToSync() still throws ERR_INVALID_STATE in that case, since it
never falls back to the async end(), but it no longer fails the
writer. The caller can still close it, e.g. with `await writer.end()`.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

pipeToSync() does not fail the writer when endSync() returns -1, so
that a caller can still close it asynchronously. A caller that cannot,
e.g. because the writer is sync-only and has no end(), would be left
with a writer that is neither closed nor failed.

Add a failOnIncompleteClose option (a Node.js extension) that fails
the writer with the thrown ERR_INVALID_STATE error in that case.
preventFail takes precedence over it.

Assisted-by: OpenCode
Signed-off-by: James M Snell <[email protected]>
PR-URL: #66483
Reviewed-By: Trivikram Kamat <[email protected]>

PR-URL: #66620
Refs: simdjson/simdjson#2913
Refs: #66495
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

env.h includes inspector_profiler.h, which included simdjson.h for
the types of two virtual methods and a parser member. As a result,
about 155 files in src/ parsed the amalgamated simdjson header,
which is over 10 MB.

Keep simdjson out of inspector_profiler.h: the profile connections
now say which field of `result` holds the profile, and
WriteProfile() takes the profile as raw JSON. The parser becomes a
local variable, so its buffers are no longer kept alive for the
lifetime of the Environment.

Also drop the unused include from node_task_runner.h, and let the
config file reader rewind its document instead of parsing the whole
file a second time with a second parser.

Now only the eight files that use simdjson include it. On an Apple
M-series machine, a clean rebuild of the src/ objects takes about
15% less CPU time (376 s to 320 s) and 19% less wall time at -j14.

Signed-off-by: Daniel Lemire <[email protected]>
PR-URL: #66620
Refs: simdjson/simdjson#2913
Refs: #66495
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

traceCallback() defaults to a frozen context but writes the callback's
result or error to it. Allocate a fresh context when undefined is passed
and subscribers are present, matching traceSync() and tracePromise().
Set the prototype after allocation to avoid dictionary-mode properties.

Assisted-by: pi
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #66481
Reviewed-By: Bryan English <[email protected]>

The GHA benchmark never built the addons of benchmark/napi, and its
--debug-node build made benchmark/common.js look for them in
build/Debug. Build them when the napi category runs, and pick the
build type as test/common does.

Refs: #66395
Signed-off-by: Nigro Simone <[email protected]>
PR-URL: #66423
Reviewed-By: Antoine du Hamel <[email protected]>

Original commit message:

    fix compilation with GCC 16 on arm64

    Change-Id: I2cbe5f2a68d4a69bac48eea876ff0ed0cb589171
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8500805
    Reviewed-by: Joyee Cheung <[email protected]>
    Commit-Queue: Joyee Cheung <[email protected]>
    Reviewed-by: Anton Bikineev <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#110517}

Refs: v8/v8@8d14d49
PR-URL: #66627
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Mike McCready <[email protected]>
PR-URL: #65750
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

Signed-off-by: lazerg <[email protected]>
Assisted-by: Claude Code
PR-URL: #66565
Fixes: #66562
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

AbortSignal.any() copies the source WeakRefs of a composite input into
the new composite, so nested composites share them. Those WeakRefs were
also used as the unregister tokens for the registrations that prune a
composite's sources once they are collected. When an inner composite
was collected first, its cleanup therefore also unregistered the outer
composite from the same sources. An observed outer composite then
stayed in gcPersistentSignals, together with its listeners, even after
all of its sources were gone and nothing could abort it anymore.

Use each composite's own WeakRef as the unregister token instead, so
collecting one composite only removes its own registrations.

Fixes: #66612
Refs: #62367
Assisted-by: Claude Code
Signed-off-by: journaltraces <[email protected]>
PR-URL: #66617
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Pulls in nodejs/node-pr-labeler#20, which counts each subsystem once
before applying the four-subsystem limit that collapses labels into
`lib / src`. Until now any PR touching three or more files under a
two-label rule (e.g. `src/quic/`, `src/crypto/`) was collapsed even
though it only touched one subsystem.

Signed-off-by: Soul Lee <[email protected]>
PR-URL: #66606
Refs: nodejs/node-pr-labeler@dfe5eb3
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

Add deps/v8/** to the QUIC workflow's pull request path filter so
V8 updates trigger its build and tests.

Assisted-by: Codex
Signed-off-by: inoway46 <[email protected]>
PR-URL: #66602
Refs: #66537
Refs: https://github.com/nodejs/node/actions/runs/37675498427/job/112978479932
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

Signed-off-by: Vas Sudanagunta <[email protected]>
PR-URL: #66563
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Reuse the values array instead of allocating a second result array.

Signed-off-by: Roberto Bianchi <[email protected]>
PR-URL: #66488
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

PR-URL: #66663
Reviewed-By: Jiawen Geng <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>

PR-URL: #66655
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>

Notable changes:

doc,lib,src:
  * (SEMVER-MINOR) throw on missing WebAssembly or RX support (Paolo Insogna) #66533
http:
  * (SEMVER-MINOR) add websocketMask() and websocketUnmask() (James M Snell) #66335

PR-URL: #66684
Signed-off-by: Richard Lau <[email protected]>