When investigating a memory leak in one of our applications,
we discovered that this listener holds on to a `REPLServer`
instance and all heap objects transitively kept alive by it
by capturing as part of its closure.

It's cleaner to declare the listener outside of the `REPLServer`
class and to actually clean it up properly when it is no longer
required or meaningful, which is easily achieved through
keeping a reference count.

PR-URL: #61895
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Bumps [actions/stale](https://github.com/actions/stale) from 10.1.1 to 10.2.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@9971854...b5d41d4)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61908
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.1 to 2.14.2.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@e3f713f...5ef0c07)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61909
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.0 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b20883b...89a39a4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61911
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

PR-URL: #61944
Refs: #61903
Reviewed-By: René <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

PR-URL: #61942
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>

PR-URL: #61830
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

PR-URL: #61833
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #61864
Refs: #61449
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>

This function can return null, which will make the calls to
BIO_meth_set_* trigger a null deref.
Even after fixing this, there is an issue with the
`BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the
`New` method cannot handle a null pointer despite other code already
guarding for this
(e.g. the `NodeBIO::New` function already checks `bio`).
This patch solves the issues by adding more null checks.

PR-URL: #61788
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

Replace native methods with primordials.

PR-URL: #61219
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>

This adds support for identifying which worker is running a test file
when tests execute concurrently, similar to JEST_WORKER_ID in Jest,
VITEST_POOL_ID in Vitest, and MOCHA_WORKER_ID in Mocha.

When running with --test-isolation=process (default), each test file
runs in a separate child process and receives a unique worker ID from
1 to N. When running with --test-isolation=none, all tests run in the
same process and the worker ID is always 1.

This enables users to allocate separate resources (databases, ports,
etc.) for each test worker to avoid conflicts during concurrent
execution.

Changes:
- Add WorkerIdPool class to manage worker ID allocation and reuse
- Set NODE_TEST_WORKER_ID environment variable for child processes
- Add context.workerId getter to TestContext class
- Add tests for worker ID functionality
- Add documentation for context.workerId

Fixes: #55842
PR-URL: #61394
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

Signed-off-by: marcopiraccini <[email protected]>
PR-URL: #61836
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

PR-URL: #61925
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #61928
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #61930
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

The assignment to `bptr` calls `BIO_get_mem_ptr` which can fail and
leave the `bptr` as nullptr. This then later causes a null pointer
deref.
This is inconsistent with uses of the similar function
`BIO_get_mem_data` that do check its return value, e.g.
`node::crypto::X509sToArrayOfStrings()`.
Solve it by checking for a null pointer and handling the `Nothing`
return value at the call sites.

PR-URL: #61885
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

PR-URL: #61986
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Ilyas Shabi <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Add a C++ API for diagnostics channels that allows native code to check
for subscribers and publish messages without unnecessary JS boundary
crossings. Uses a shared AliasedUint32Array buffer between C++ and JS
to track subscriber counts per channel, enabling a fast inline check
(HasSubscribers) that reads the buffer directly.

PR-URL: #61869
Reviewed-By: Stephen Belanger <[email protected]>

Add --permission-audit flag that enables the permission model in
warning-only mode. Instead of throwing ERR_ACCESS_DENIED, it emits
a message via diagnostics channel and allows the operation to
continue.

Publish permission check results to per-scope diagnostics channels
(e.g., node:permission-model:fs) so users can observe permission
decisions at runtime via diagnostics_channel.

Refs: #59935
PR-URL: #61869
Reviewed-By: Stephen Belanger <[email protected]>

The WHATWG Streams spec requires that pipeTo's chunk handling must
queue a microtask before calling the write algorithm. This ensures
that enqueue() does not synchronously trigger writes.

Previously, PipeToReadableStreamReadRequest[kChunk] would synchronously
call writableStreamDefaultWriterWrite(), which violated the spec and
caused the WPT test "enqueue() must not synchronously call write
algorithm" to fail.

Fix by wrapping the write operation in queueMicrotask(), which defers
it to the next microtask as required by the spec.

Refs: whatwg/streams#1243
PR-URL: #61800
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>

This change exposes the expectFailure message in the test runner and
adds edge cases for expectFailure ambiguity.

PR-URL: #61563
Fixes: #61570
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

Not checking this can cause a null deref. Since there is already a
null check at the bottom of the function with `NewRSA()`.

PR-URL: #61888
Reviewed-By: Anna Henningsen <[email protected]>

Signed-off-by: Igor <[email protected]>
PR-URL: #61525
Fixes: #61462
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

PR-URL: #61974
Refs: #38161
Reviewed-By: Kohei Ueno <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61976
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #61773
Refs: #61762
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

As specified in WebIDL (<https://webidl.spec.whatwg.org/#js-dictionary>),
the fields of a dictionary need to be read in lexicographical order.

PR-URL: #61980
Reviewed-By: Jason Zhang <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

`parallel/test-strace-openat-openssl` was added to check explicitly
for a list of known files that would be opened for a set workload
(`require("crypto")`). This is not reliable when Node.js is linked
to an external/shared OpenSSL library (e.g. it might be configured
to load configuration files from a different default location and/or
load more than one configuration file) so skip this test when Node.js
is built in that way.

PR-URL: #61987
Fixes: #61966
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

PR-URL: #62038
Refs: #61987
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #61984
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Signed-off-by: Weixie Cui <[email protected]>
PR-URL: #61948
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Add validateHeaderName/validateHeaderValue checks for non-link
headers and checkInvalidHeaderChar for the Link value in HTTP/1.1
writeEarlyHints, closing a CRLF injection gap where header names
and values were concatenated into the raw response without
validation.

Also tighten linkValueRegExp to reject CR/LF inside the <...>
URL portion of Link header values.

PR-URL: #61897
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

Previously, require.resolve() called Module._resolveFilename() directly,
bypassing any resolve hooks registered via module.registerHooks(). This
patch fixes that.

PR-URL: #62028
Reviewed-By: Geoffrey Booth <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>

The `path` property on `ClientRequest` was only validated at
construction time. Add a getter/setter so that the same
`INVALID_PATH_REGEX` check runs whenever `req.path` is reassigned,
preventing invalid characters from reaching `_implicitHeader()`.

PR-URL: #62030
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

PR-URL: #62077
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Stewart X Addison <[email protected]>

Notable changes:

build, doc:
  * use new api doc tooling (flakey5) #57343
sqlite:
  * (SEMVER-MINOR) add limits property to DatabaseSync (Mert Can Altin) #61298
src:
  * (SEMVER-MINOR) add C++ support for diagnostics channels (RafaelGSS) #61869
src,permission:
  * (SEMVER-MINOR) add --permission-audit (RafaelGSS) #61869
test_runner:
  * (SEMVER-MINOR) expose worker ID for concurrent test execution (Ali Hassan) #61394

PR-URL: #62073