Merge branch 'main' into v8-wasm-compile-options

Author: guybedford

.github/label-pr-config.yml

@@ -15,6 +15,7 @@ subSystemLabels:
   /^src\/uv\./: c++, libuv
   /^src\/(?:connect(?:ion)?|pipe|tcp)_/: c++, net
   /^src\/node_os/: c++, os
+  /^src\/permission\//: c++, permission
   /^src\/(?:node_main|signal_)/: c++, process
   /^src\/timer[_s]/: c++, timers
   /^src\/node_root_certs/: c++, tls
@@ -102,6 +103,7 @@ subSystemLabels:
   /^lib\/test.js$/: test_runner
   /^lib\/v8.js$/: v8 module
   /^lib\/internal\/url\.js$/: whatwg-url
+  /^lib\/internal\/process\/permission\.js$/: permission
   /^lib\/internal\/modules\/esm/: esm
   /^lib\/internal\/modules/: module
   /^lib\/internal\/source_map/: source maps
@@ -116,6 +118,13 @@ subSystemLabels:
 
 exlusiveLabels:
   # More specific tests
+  /^test\/(?:parallel|sequential)\/test-(?:[^/]+-)?permission(?:-|\.)/: test, permission
+  /^test\/ffi\/test-ffi-permissions?(?:-|\.)/: test, permission
+  /^test\/addons\/no-addons\/permission\.js$/: test, addons, permission
+  /^test\/es-module\/test-[^/]*-permission(?:-|\.)/: test, esm, permission
+  /^test\/module-hooks\/test-[^/]*-permission(?:-|\.)/: test, module, loaders, permission
+  /^test\/fixtures\/permission\//: test, permission
+  /^test\/fixtures\/rc\/permission-namespace\.json$/: test, permission
   /^test\/addons\//: test, addons
   /^test\/debugger/: test, debugger
   /^test\/doctool\//: test, doc, tools
@@ -150,6 +159,7 @@ exlusiveLabels:
   # test_runner documentation
   /^doc\/api\/test.md$/: doc, test_runner
   # Automatically tag JS subsystem-specific API doc changes
+  /^doc\/api\/permissions\.md$/: doc, permission
   /^doc\/api\/(\w+)\.md$/: doc, $1
   # Add deprecations label to PRs that affect doc/api/deprecations.md
   /^doc\/api\/deprecations.md$/: doc, deprecations
@@ -162,6 +172,7 @@ exlusiveLabels:
   /^doc\//: doc
 
   # More specific benchmarks
+  /^benchmark\/fs\/readfile-permission-enabled\.js$/: benchmark, fs, permission
   /^benchmark\/buffers\//: benchmark, buffer
   /^benchmark\/es\//: benchmark, v8 engine
   /^benchmark\/_http/: benchmark, http
@@ -198,6 +209,7 @@ allJsSubSystems:
   - os
   - path
   - perf_hooks
+  - permission
   - process
   - punycode
   - querystring

.github/workflows/auto-start-ci.yml

@@ -1,6 +1,9 @@
 # This action uses the following secrets:
 #   JENKINS_USER: GitHub user whose Jenkins token is defined below
-#   JENKINS_TOKEN: Jenkins token, to be used to start CI
+#   JENKINS_TOKEN: Jenkins token, to be used to start or resume CI
+# Optional repository variables:
+#   AUTO_START_CI_BATCH_SIZE: maximum PRs to process per run (default: 5)
+#   AUTO_START_CI_MAX_WORKLOAD: pause at this many running or queued PR jobs (default: 15)
 name: Auto Start CI
 
 on:
@@ -30,16 +33,25 @@ jobs:
     steps:
       - name: Get Pull Requests
         id: get_prs_for_ci
-        run: >
-          echo "numbers=$(gh pr list \
+        # Explicit bash enables pipefail so jq cannot hide a failed gh query.
+        shell: bash
+        run: |
+          if ! [[ "$BATCH_SIZE" =~ ^[1-9][0-9]*$ ]]; then
+            echo '::error::AUTO_START_CI_BATCH_SIZE must be a strictly positive integer'
+            exit 1
+          fi
+          # Filter before selecting the batch; UNKNOWN mergeability is retried later.
+          numbers=$(gh pr list \
                   --repo "$GITHUB_REPOSITORY" \
-                  --label 'request-ci' \
-                  --json 'number' \
-                  --search 'review:approved' \
-                  -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 5)" >> "$GITHUB_OUTPUT"
+                  --json 'number,mergeable' \
+                  --search 'review:approved label:request-ci,resume-ci' \
+                  --limit 100 \
+                  | jq --argjson limit "$BATCH_SIZE" \
+                    '[.[] | select(.mergeable == "MERGEABLE") | .number] | .[:$limit] | map(tostring) | join(" ")' -r)
+          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
+          BATCH_SIZE: ${{ vars.AUTO_START_CI_BATCH_SIZE || '5' }}
   start-ci:
     permissions:
       checks: read
@@ -70,11 +82,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
-      - name: Start the CI
+      - name: Start or resume the CI
         run: |
           read -r -a numbers <<< "$PULL_REQUESTS"
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- "${numbers[@]}"
         env:
           GH_TOKEN: ${{ github.token }}
           PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}
+          MAX_WORKLOAD: ${{ vars.AUTO_START_CI_MAX_WORKLOAD || '15' }}

.github/workflows/build-tarball.yml

@@ -94,7 +94,7 @@ jobs:
           export DISTTYPE=nightly
           export DATESTRING=$(date "+%Y-%m-%d")
           export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
-          ./configure && make tar -j4 SKIP_XZ=1
+          ./configure && make tar -j4 SKIP_XZ=1 GZIP_COMPRESSION=6
       - name: Upload tarball artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:

.github/workflows/test-linux-perfetto.yml

@@ -62,6 +62,9 @@ jobs:
       - name: Build
         working-directory: node
         run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --with-perfetto"
+      - name: Get trace_processor
+        working-directory: node
+        run: make tools/perfetto/trace_processor_shell
       - name: Test
         working-directory: node
         run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"

.github/workflows/test-shared.yml

@@ -133,7 +133,7 @@ jobs:
         run: |
           export DATESTRING=$(date "+%Y-%m-%d")
           export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
-          ./configure && make tar -j4 SKIP_XZ=1 SKIP_SHARED_DEPS=1
+          ./configure && make tar -j4 SKIP_XZ=1 SKIP_SHARED_DEPS=1 GZIP_COMPRESSION=6
         env:
           DISTTYPE: nightly
 
@@ -168,7 +168,16 @@ jobs:
       extra-nix-flags: |
         --arg useSeparateDerivationForV8 true \
         ${{ matrix.perfetto && '--arg withPerfetto true \' || '\' }}
-        ${{ endsWith(matrix.system, '-darwin') && '--arg withAmaro false --arg withLief false --arg withSQLite false --arg withFFI false --arg extraConfigFlags ''["--without-inspector" "--without-node-options"]'' \' || '\' }}
+        ${{ endsWith(matrix.system, '-darwin') && '\
+          --arg withAmaro false \
+          --arg withFFI false \
+          --arg withLief false \
+          --arg withSQLite false \
+          --arg withTemporal false \
+          --arg extraConfigFlags ''[
+            "--without-inspector"
+            "--without-node-options"
+          ]'' \' || '\' }}
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
 

.github/workflows/tools.yml

@@ -28,6 +28,7 @@ on:
           - inspector_protocol
           - libffi
           - libuv
+          - lief
           - llhttp
           - nbytes
           - nixpkgs-unstable
@@ -149,6 +150,7 @@ jobs:
           - id: icu
             subsystem: deps
             label: dependencies, test, icu
+            requires-python: true
             run: |
               ./tools/dep_updaters/update-icu.sh > temp-output
               cat temp-output
@@ -157,6 +159,7 @@ jobs:
           - id: inspector_protocol
             subsystem: deps
             label: dependencies, inspector
+            requires-python: true
             run: |
               ./tools/dep_updaters/update-inspector-protocol.sh > temp-output
               cat temp-output
@@ -178,6 +181,15 @@ jobs:
               cat temp-output
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
+          - id: lief
+            subsystem: deps
+            label: dependencies, dont-land-on-v22.x
+            requires-python: true
+            run: |
+              ./tools/dep_updaters/update-lief.sh > temp-output
+              cat temp-output
+              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
+              rm temp-output
           - id: llhttp
             subsystem: deps
             label: dependencies
@@ -312,9 +324,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        if: |
-          (matrix.id == 'icu' || matrix.id == 'inspector_protocol') &&
-          (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
+        if: matrix.requires-python && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}

.gitignore

@@ -103,6 +103,11 @@ _UpgradeReport_Files/
 tools/*/*.i
 tools/*/*.i.tmp
 
+# === Rules for pgo artifacts ===
+*.profdata
+*.profraw
+*.gcda
+
 # === Rules for release artifacts ===
 /*.tar.*
 /*.pkg
@@ -116,6 +121,9 @@ tools/*/*.i.tmp
 /tools/eslint/node_modules
 /tools/lint-md/node_modules
 
+# === Rules for tools/perfetto ===
+/tools/perfetto/trace_processor_shell
+
 # === Rules for test artifacts ===
 /*.tap
 /*.xml

BUILDING.md

@@ -104,25 +104,25 @@ Node.js does not support a platform version if a vendor has expired support
 for it. In other words, Node.js does not support running on End-of-Life (EoL)
 platforms. This is true regardless of entries in the table below.
 
-| Operating System | Architectures    | Versions                          | Support Type | Notes                                                      |
-| ---------------- | ---------------- | --------------------------------- | ------------ | ---------------------------------------------------------- |
-| GNU/Linux        | x64              | kernel >= 4.18[^1], glibc >= 2.28 | Tier 1       | e.g. Ubuntu 20.04, Debian 10, RHEL 8                       |
-| GNU/Linux        | x64              | kernel >= 3.10, musl >= 1.1.19    | Experimental | e.g. Alpine 3.8                                            |
-| GNU/Linux        | x86              | kernel >= 3.10, glibc >= 2.17     | Experimental | Downgraded as of Node.js 10                                |
-| GNU/Linux        | arm64            | kernel >= 4.18[^1], glibc >= 2.28 | Tier 1       | e.g. Ubuntu 20.04, Debian 10, RHEL 8                       |
-| GNU/Linux        | armv7            | kernel >= 4.18[^1], glibc >= 2.28 | Experimental | Downgraded as of Node.js 24                                |
-| GNU/Linux        | ppc64le >=power9 | kernel >= 4.18[^1], glibc >= 2.28 | Tier 2       | e.g. Ubuntu 20.04, RHEL 8                                  |
-| GNU/Linux        | s390x >=z14      | kernel >= 4.18[^1], glibc >= 2.28 | Tier 2       | e.g. RHEL 8                                                |
-| GNU/Linux        | loong64          | kernel >= 5.19, glibc >= 2.36     | Experimental |                                                            |
-| GNU/Linux        | riscv64          | kernel >= 5.19, glibc >= 2.36     | Experimental | GCC >= 14 or Clang >= 19 for native builds[^5]             |
-| Windows          | x64              | >= Windows 10/Server 2016         | Tier 1       | [^2],[^3]                                                  |
-| Windows          | arm64            | >= Windows 10                     | Tier 2       |                                                            |
-| macOS            | x64              | >= 13.5                           | Tier 2       | Until early 2028[^8]. For notes about compilation see [^4] |
-| macOS            | arm64            | >= 13.5                           | Tier 1       |                                                            |
-| SmartOS          | x64              | >= 18                             | Tier 2       |                                                            |
-| AIX              | ppc64be >=power9 | >= 7.2 TL04                       | Tier 2       |                                                            |
-| FreeBSD          | x64              | >= 13.2                           | Experimental |                                                            |
-| OpenHarmony      | arm64            | >= 5.0                            | Experimental |                                                            |
+| Operating System | Architectures    | Versions                          | Support Type | Notes                                          |
+| ---------------- | ---------------- | --------------------------------- | ------------ | ---------------------------------------------- |
+| GNU/Linux        | x64              | kernel >= 4.18[^1], glibc >= 2.28 | Tier 1       | e.g. Ubuntu 20.04, Debian 10, RHEL 8           |
+| GNU/Linux        | x64              | kernel >= 6.12, musl >= 1.2.5     | Tier 2       | e.g. Alpine 3.22                               |
+| GNU/Linux        | x86              | kernel >= 3.10, glibc >= 2.17     | Experimental | Downgraded as of Node.js 10                    |
+| GNU/Linux        | arm64            | kernel >= 4.18[^1], glibc >= 2.28 | Tier 1       | e.g. Ubuntu 20.04, Debian 10, RHEL 8           |
+| GNU/Linux        | armv7            | kernel >= 4.18[^1], glibc >= 2.28 | Experimental | Downgraded as of Node.js 24                    |
+| GNU/Linux        | ppc64le >=power9 | kernel >= 4.18[^1], glibc >= 2.28 | Tier 2       | e.g. Ubuntu 20.04, RHEL 8                      |
+| GNU/Linux        | s390x >=z14      | kernel >= 4.18[^1], glibc >= 2.28 | Tier 2       | e.g. RHEL 8                                    |
+| GNU/Linux        | loong64          | kernel >= 5.19, glibc >= 2.36     | Experimental |                                                |
+| GNU/Linux        | riscv64          | kernel >= 5.19, glibc >= 2.36     | Experimental | GCC >= 14 or Clang >= 19 for native builds[^5] |
+| Windows          | x64              | >= Windows 10/Server 2016         | Tier 1       | [^2],[^3]                                      |
+| Windows          | arm64            | >= Windows 10                     | Tier 2       |                                                |
+| macOS            | x64              | >= 13.5                           | Experimental | For notes about compilation see [^4]           |
+| macOS            | arm64            | >= 13.5                           | Tier 1       |                                                |
+| SmartOS          | x64              | >= 18                             | Tier 2       |                                                |
+| AIX              | ppc64be >=power9 | >= 7.2 TL04                       | Tier 2       |                                                |
+| FreeBSD          | x64              | >= 13.2                           | Experimental |                                                |
+| OpenHarmony      | arm64            | >= 5.0                            | Experimental |                                                |
 
 <!--lint disable final-definition-->
 
@@ -154,14 +154,6 @@ platforms. This is true regardless of entries in the table below.
     Cross-compilation from x64 is unaffected (the code is behind
     `V8_HOST_ARCH_RISCV64`).
 
-[^8]: Our macOS testing infrastructure provider has announced end of support for
-    Intel-based architecture for early 2028 at which time that platform will move to
-    experimental status as the Node.js project will no longer be able to test changes on any
-    Intel-based macOS version. When this change occurs the project intends to continue
-    creating universal binaries for versions of Node.js which are still in support which will
-    be compatible with both Apple Silicon-based and Intel-based macOS versions but
-    they will be untested.
-
 <!--lint enable final-definition-->
 
 ### Supported toolchains

CHANGELOG.md

@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.9.0">26.9.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.10.0">26.10.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.9.0">26.9.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.2">26.8.2</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a><br/>
@@ -88,7 +89,8 @@ release.
 <a href="doc/changelogs/CHANGELOG_V24.md#24.0.0">24.0.0</a><br/>
   </td>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V22.md#22.23.2">22.23.2</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V22.md#22.23.3">22.23.3</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V22.md#22.23.2">22.23.2</a><br/>
 <a href="doc/changelogs/CHANGELOG_V22.md#22.23.1">22.23.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V22.md#22.23.0">22.23.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V22.md#22.22.3">22.22.3</a><br/>