Merge branch 'nodejs:main' into main

Tseian · web-flow · commit 554052ddb20a · 2026-03-24T11:44:08.000+08:00
diff --git a/deps/icu-small/source/common/unicode/utfiterator.h b/deps/icu-small/source/common/unicode/utfiterator.h
@@ -557,9 +557,11 @@ class UTFImpl<
 public:
     // Handle ill-formed UTF-8
     U_FORCE_INLINE static CP32 sub() {
-        switch (behavior) {
-            case UTF_BEHAVIOR_NEGATIVE: return U_SENTINEL;
-            case UTF_BEHAVIOR_FFFD: return 0xfffd;
+        if constexpr (behavior == UTF_BEHAVIOR_NEGATIVE) {
+            return U_SENTINEL;
+        } else {
+            static_assert(behavior == UTF_BEHAVIOR_FFFD);
+            return 0xfffd;
         }
     }
 
@@ -736,10 +738,13 @@ class UTFImpl<
 public:
     // Handle ill-formed UTF-16: One unpaired surrogate.
     U_FORCE_INLINE static CP32 sub(CP32 surrogate) {
-        switch (behavior) {
-            case UTF_BEHAVIOR_NEGATIVE: return U_SENTINEL;
-            case UTF_BEHAVIOR_FFFD: return 0xfffd;
-            case UTF_BEHAVIOR_SURROGATE: return surrogate;
+        if constexpr (behavior == UTF_BEHAVIOR_NEGATIVE) {
+            return U_SENTINEL;
+        } else if constexpr (behavior == UTF_BEHAVIOR_FFFD) {
+            return 0xfffd;
+        } else {
+            static_assert(behavior == UTF_BEHAVIOR_SURROGATE);
+            return surrogate;
         }
     }
 
@@ -822,10 +827,13 @@ class UTFImpl<
 public:
     // Handle ill-formed UTF-32
     U_FORCE_INLINE static CP32 sub(bool forSurrogate, CP32 surrogate) {
-        switch (behavior) {
-            case UTF_BEHAVIOR_NEGATIVE: return U_SENTINEL;
-            case UTF_BEHAVIOR_FFFD: return 0xfffd;
-            case UTF_BEHAVIOR_SURROGATE: return forSurrogate ? surrogate : 0xfffd;
+        if constexpr (behavior == UTF_BEHAVIOR_NEGATIVE) {
+            return U_SENTINEL;
+        } else if constexpr (behavior == UTF_BEHAVIOR_FFFD) {
+            return 0xfffd;
+        } else {
+            static_assert(behavior == UTF_BEHAVIOR_SURROGATE);
+            return forSurrogate ? surrogate : 0xfffd;
         }
     }
 
diff --git a/deps/icu-small/source/common/unicode/uvernum.h b/deps/icu-small/source/common/unicode/uvernum.h
@@ -59,7 +59,7 @@
  *  This value will change in the subsequent releases of ICU
  *  @stable ICU 2.6
  */
-#define U_ICU_VERSION_MINOR_NUM 2
+#define U_ICU_VERSION_MINOR_NUM 3
 
 /** The current ICU patchlevel version as an integer.
  *  This value will change in the subsequent releases of ICU
@@ -132,7 +132,7 @@
  *  This value will change in the subsequent releases of ICU
  *  @stable ICU 2.4
  */
-#define U_ICU_VERSION "78.2"
+#define U_ICU_VERSION "78.3"
 
 /**
  * The current ICU library major version number as a string, for library name suffixes.
@@ -151,7 +151,7 @@
 /** Data version in ICU4C.
  * @internal ICU 4.4 Internal Use Only
  **/
-#define U_ICU_DATA_VERSION "78.2"
+#define U_ICU_DATA_VERSION "78.3"
 #endif  /* U_HIDE_INTERNAL_API */
 
 /*===========================================================================
diff --git a/deps/icu-small/source/data/in/icudt78l.dat.bz2 b/deps/icu-small/source/data/in/icudt78l.dat.bz2
diff --git a/deps/icu-small/source/i18n/nfrule.cpp b/deps/icu-small/source/i18n/nfrule.cpp
@@ -158,12 +158,17 @@ NFRule::makeRules(UnicodeString& description,
         UnicodeString sbuf;
         int32_t orElseOp = description.indexOf(gVerticalLine);
 
+        uint64_t mod = util64_pow(rule1->radix, rule1->exponent);
         // we'll actually only split the rule into two rules if its
         // base value is an even multiple of its divisor (or it's one
         // of the special rules)
+        if (rule1->baseValue > 0 && rule1->radix != 0 && mod == 0) {
+            status = U_NUMBER_ARG_OUTOFBOUNDS_ERROR;
+            return;
+        }
         if ((rule1->baseValue > 0
             && (rule1->radix != 0) // ICU-23109 Ensure next line won't "% 0"
-            && (rule1->baseValue % util64_pow(rule1->radix, rule1->exponent)) == 0)
+            && (rule1->baseValue % mod == 0))
             || rule1->getType() == kImproperFractionRule
             || rule1->getType() == kDefaultRule) {
 
diff --git a/doc/api/child_process.md b/doc/api/child_process.md
@@ -120,23 +120,19 @@ however, `.bat` and `.cmd` files are not executable on their own without a
 terminal, and therefore cannot be launched using [`child_process.execFile()`][].
 When running on Windows, `.bat` and `.cmd` files can be invoked by:
 
-* using [`child_process.spawn()`][] with the `shell` option set, or
+* using [`child_process.spawn()`][] with the `shell` option set (not recommended, see [DEP0190][]), or
 * using [`child_process.exec()`][], or
 * spawning `cmd.exe` and passing the `.bat` or `.cmd` file as an argument
-  (which is what the `shell` option and [`child_process.exec()`][] do).
+  (which is what [`child_process.exec()`][] does internally).
 
 In any case, if the script filename contains spaces, it needs to be quoted.
 
 ```cjs
 const { exec, spawn } = require('node:child_process');
 
-// 1. child_process.spawn() with the shell option set
-const myBat = spawn('my.bat', { shell: true });
-
-// 2. child_process.exec()
 exec('my.bat', (err, stdout, stderr) => { /* ... */ });
 
-// 3. spawning cmd.exe and passing the .bat or .cmd file as an argument
+// Or, spawning cmd.exe directly:
 const bat = spawn('cmd.exe', ['/c', 'my.bat']);
 
 // If the script filename contains spaces, it needs to be quoted
@@ -146,13 +142,9 @@ exec('"my script.cmd" a b', (err, stdout, stderr) => { /* ... */ });
 ```mjs
 import { exec, spawn } from 'node:child_process';
 
-// 1. child_process.spawn() with the shell option set
-const myBat = spawn('my.bat', { shell: true });
-
-// 2. child_process.exec()
 exec('my.bat', (err, stdout, stderr) => { /* ... */ });
 
-// 3. spawning cmd.exe and passing the .bat or .cmd file as an argument
+// Or, spawning cmd.exe directly:
 const bat = spawn('cmd.exe', ['/c', 'my.bat']);
 
 // If the script filename contains spaces, it needs to be quoted
@@ -2369,6 +2361,7 @@ Therefore, this feature requires opting in by setting the
 or [`child_process.fork()`][].
 
 [Advanced serialization]: #advanced-serialization
+[DEP0190]: deprecations.md#DEP0190
 [Default Windows shell]: #default-windows-shell
 [HTML structured clone algorithm]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm
 [Shell requirements]: #shell-requirements
diff --git a/doc/api/cli.md b/doc/api/cli.md
@@ -4074,7 +4074,7 @@ that run in libuv's threadpool will experience degraded performance. In order to
 mitigate this issue, one potential solution is to increase the size of libuv's
 threadpool by setting the `'UV_THREADPOOL_SIZE'` environment variable to a value
 greater than `4` (its current default value). However, setting this from inside
-the process using `process.env.UV_THREADPOOL_SIZE=size` is not guranteed to work
+the process using `process.env.UV_THREADPOOL_SIZE=size` is not guaranteed to work
 as the threadpool would have been created as part of the runtime initialisation
 much before user code is run. For more information, see the [libuv threadpool documentation][].
 
diff --git a/doc/api/packages.md b/doc/api/packages.md
@@ -1012,7 +1012,7 @@ added: v0.4.0
 The `"main"` field defines the entry point of a package when imported by name
 via a `node_modules` lookup.  Its value is a path.
 
-The [`"exports"`][] field, if it exists, takes precedence over the
+The [`"exports"`][] field, if it exists, takes precedence over the
 `"main"` field when importing the package by name.
 
 It also defines the script that is used when the [package directory is loaded
diff --git a/doc/api/vm.md b/doc/api/vm.md
@@ -1835,10 +1835,10 @@ It does several things at once:
 
 1. Creates a new context.
 2. If `contextObject` is an object, [contextifies][contextified] it with the new context.
-   If  `contextObject` is undefined, creates a new object and [contextifies][contextified] it.
+   If `contextObject` is undefined, creates a new object and [contextifies][contextified] it.
    If `contextObject` is [`vm.constants.DONT_CONTEXTIFY`][], don't [contextify][contextified] anything.
-3. Compiles the code as a`vm.Script`
-4. Runs the compield code within the created context. The code does not have access to the scope in
+3. Compiles the code as a `vm.Script`
+4. Runs the compiled code within the created context. The code does not have access to the scope in
    which this method is called.
 5. Returns the result.
 
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
@@ -314,22 +314,22 @@ git checkout -b v1.2.3-proposal upstream/v1.x-staging
 You can also run:
 
 ```bash
-git node release -S --prepare --security --filterLabel vX.x
+git node release -S --prepare --security=../vulnerabilities.json --filterLabel vX.x
 ```
 
 Example:
 
 ```bash
 git checkout v20.x
-git node release -S --prepare --security --filterLabel v20.x
+git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x
 ```
 
 to automate the remaining steps until step 6 or you can perform it manually
 following the below steps. For semver-minors, you can pass the new version
 explicitly with `--newVersion` arg:
 
 ```bash
-git node release -S --prepare --security --filterLabel v20.x --newVersion 20.20.0
+git node release -S --prepare --security=../vulnerabilities.json --filterLabel v20.x --newVersion 20.20.0
 ```
 
 <details>
diff --git a/doc/node.1 b/doc/node.1
@@ -2287,7 +2287,7 @@ that run in libuv's threadpool will experience degraded performance. In order to
 mitigate this issue, one potential solution is to increase the size of libuv's
 threadpool by setting the \fB'UV_THREADPOOL_SIZE'\fR environment variable to a value
 greater than \fB4\fR (its current default value). However, setting this from inside
-the process using \fBprocess.env.UV_THREADPOOL_SIZE=size\fR is not guranteed to work
+the process using \fBprocess.env.UV_THREADPOOL_SIZE=size\fR is not guaranteed to work
 as the threadpool would have been created as part of the runtime initialisation
 much before user code is run. For more information, see the libuv threadpool documentation.
 .
diff --git a/lib/internal/test_runner/test.js b/lib/internal/test_runner/test.js
@@ -149,7 +149,7 @@ function stopTest(timeout, signal) {
 
     disposeFunction = () => {
       abortListener[SymbolDispose]();
-      timer[SymbolDispose]();
+      clearTimeout(timer);
     };
   }
 
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
@@ -2443,5 +2443,30 @@ void UseExtraCaCerts(std::string_view file) {
   extra_root_certs_file = file;
 }
 
+NODE_EXTERN SSL_CTX* GetSSLCtx(Local<Context> context, Local<Value> value) {
+  Environment* env = Environment::GetCurrent(context);
+  if (env == nullptr) return nullptr;
+
+  // TryCatchto swallow any exceptions from Get() (e.g. failing getters)
+  v8::TryCatch try_catch(env->isolate());
+
+  // Unwrap the .context property from the JS SecureContext wrapper
+  // (as returned by tls.createSecureContext()).
+  if (value->IsObject()) {
+    Local<Value> inner;
+    if (!value.As<v8::Object>()
+             ->Get(context, FIXED_ONE_BYTE_STRING(env->isolate(), "context"))
+             .ToLocal(&inner)) {
+      return nullptr;
+    }
+    value = inner;
+  }
+
+  if (!SecureContext::HasInstance(env, value)) return nullptr;
+  SecureContext* sc = BaseObject::FromJSObject<SecureContext>(value);
+  if (sc == nullptr) return nullptr;
+  return sc->ctx().get();
+}
+
 }  // namespace crypto
 }  // namespace node
diff --git a/src/node.h b/src/node.h
@@ -125,6 +125,7 @@
 // Forward-declare libuv loop
 struct uv_loop_s;
 struct napi_module;
+struct ssl_ctx_st;  // Forward declaration of SSL_CTX for OpenSSL.
 
 // Forward-declare these functions now to stop MSVS from becoming
 // terminally confused when it's done in node_internals.h
@@ -1657,6 +1658,20 @@ NODE_DEPRECATED(
                                        v8::Local<v8::Object> object,
                                        v8::Object::Wrappable* wrappable));
 
+namespace crypto {
+
+// Returns the SSL_CTX* from a SecureContext JS object, as returned by
+// tls.createSecureContext().
+// Returns nullptr if the value is not a SecureContext instance,
+// or if Node.js was built without OpenSSL.
+//
+// The returned pointer is not owned by the caller and must not be freed.
+// It is valid only while the SecureContext JS object remains alive.
+NODE_EXTERN struct ssl_ctx_st* GetSSLCtx(v8::Local<v8::Context> context,
+                                         v8::Local<v8::Value> secure_context);
+
+}  // namespace crypto
+
 }  // namespace node
 
 #endif  // SRC_NODE_H_
diff --git a/test/addons/addons.status b/test/addons/addons.status
@@ -12,6 +12,7 @@ openssl-binding/test: PASS,FLAKY
 
 [$system==ibmi]
 openssl-binding/test: SKIP
+openssl-get-ssl-ctx/test: SKIP
 openssl-providers/test-default-only-config: SKIP
 openssl-providers/test-legacy-provider-config: SKIP
 openssl-providers/test-legacy-provider-inactive-config: SKIP
diff --git a/test/addons/openssl-get-ssl-ctx/binding.cc b/test/addons/openssl-get-ssl-ctx/binding.cc
@@ -0,0 +1,52 @@
+#include <node.h>
+#include <openssl/ssl.h>
+
+namespace {
+
+// Test: extract SSL_CTX* from a SecureContext object via
+// node::crypto::GetSSLCtx.
+void GetSSLCtx(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  v8::Isolate* isolate = args.GetIsolate();
+  v8::Local<v8::Context> context = isolate->GetCurrentContext();
+
+  SSL_CTX* ctx = node::crypto::GetSSLCtx(context, args[0]);
+  if (ctx == nullptr) {
+    isolate->ThrowException(v8::Exception::Error(
+        v8::String::NewFromUtf8(
+            isolate, "GetSSLCtx returned nullptr for a valid SecureContext")
+            .ToLocalChecked()));
+    return;
+  }
+
+  // Verify the pointer is a valid SSL_CTX by calling an OpenSSL function.
+  const SSL_METHOD* method = SSL_CTX_get_ssl_method(ctx);
+  if (method == nullptr) {
+    isolate->ThrowException(v8::Exception::Error(
+        v8::String::NewFromUtf8(isolate,
+                                "SSL_CTX_get_ssl_method returned nullptr")
+            .ToLocalChecked()));
+    return;
+  }
+
+  args.GetReturnValue().Set(true);
+}
+
+// Test: passing a non-SecureContext value returns nullptr.
+void GetSSLCtxInvalid(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  v8::Isolate* isolate = args.GetIsolate();
+  v8::Local<v8::Context> context = isolate->GetCurrentContext();
+
+  SSL_CTX* ctx = node::crypto::GetSSLCtx(context, args[0]);
+  args.GetReturnValue().Set(ctx == nullptr);
+}
+
+void Initialize(v8::Local<v8::Object> exports,
+                v8::Local<v8::Value> module,
+                v8::Local<v8::Context> context) {
+  NODE_SET_METHOD(exports, "getSSLCtx", GetSSLCtx);
+  NODE_SET_METHOD(exports, "getSSLCtxInvalid", GetSSLCtxInvalid);
+}
+
+}  // anonymous namespace
+
+NODE_MODULE_CONTEXT_AWARE(NODE_GYP_MODULE_NAME, Initialize)
diff --git a/test/addons/openssl-get-ssl-ctx/binding.gyp b/test/addons/openssl-get-ssl-ctx/binding.gyp
@@ -0,0 +1,29 @@
+{
+  'targets': [
+    {
+      'target_name': 'binding',
+      'includes': ['../common.gypi'],
+      'conditions': [
+        ['node_use_openssl=="true"', {
+          'conditions': [
+            ['OS in "aix os400"', {
+              'variables': {
+                # Used to differentiate `AIX` and `OS400`(IBM i).
+                'aix_variant_name': '<!(uname -s)',
+              },
+              'conditions': [
+                [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
+                  'sources': ['binding.cc'],
+                  'include_dirs': ['../../../deps/openssl/openssl/include'],
+                }],
+              ],
+            }, {
+              'sources': ['binding.cc'],
+              'include_dirs': ['../../../deps/openssl/openssl/include'],
+            }],
+          ],
+        }],
+      ],
+    },
+  ],
+}
diff --git a/test/addons/openssl-get-ssl-ctx/test.js b/test/addons/openssl-get-ssl-ctx/test.js
diff --git a/test/fixtures/test-runner/mock-timers-with-timeout.js b/test/fixtures/test-runner/mock-timers-with-timeout.js
diff --git a/test/parallel/test-runner-mock-timers-with-timeout.js b/test/parallel/test-runner-mock-timers-with-timeout.js
diff --git a/tools/icu/current_ver.dep b/tools/icu/current_ver.dep
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
diff --git a/tools/v8/fetch_deps.py b/tools/v8/fetch_deps.py

Original file line number	Diff line number	Diff line change
`@@ -2287,7 +2287,7 @@ that run in libuv's threadpool will experience degraded performance. In order to`
`2287`	`2287`	`mitigate this issue, one potential solution is to increase the size of libuv's`
`2288`	`2288`	`threadpool by setting the \fB'UV_THREADPOOL_SIZE'\fR environment variable to a value`
`2289`	`2289`	`greater than \fB4\fR (its current default value). However, setting this from inside`
`2290`		`-the process using \fBprocess.env.UV_THREADPOOL_SIZE=size\fR is not guranteed to work`
	`2290`	`+the process using \fBprocess.env.UV_THREADPOOL_SIZE=size\fR is not guaranteed to work`
`2291`	`2291`	`as the threadpool would have been created as part of the runtime initialisation`
`2292`	`2292`	`much before user code is run. For more information, see the libuv threadpool documentation.`
`2293`	`2293`	`.`