PR-URL: https://github.com/nodejs/node/pull/40420


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

This is a security release.

Notable Changes:

* CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  * The http parser accepts requests with a space (SP) right after the
  header name before the colon. This can lead to HTTP Request Smuggling
  (HRS). More details are available at:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
* CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  * The parse ignores chunk extensions when parsing the body of chunked
  requests. This leads to HTTP Request Smuggling (HRS) under certain
  conditions. More details are available at:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960

PR-URL: https://github.com/nodejs-private/node-private/pull/293

This is a security release.

Notable Changes:

* CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  * The http parser accepts requests with a space (SP) right after the
  header name before the colon. This can lead to HTTP Request Smuggling
  (HRS). More details are available at:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
* CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  * The parse ignores chunk extensions when parsing the body of chunked requests.
  requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
  More details are available at:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960

PR-URL: https://github.com/nodejs-private/node-private/pull/294

This is a security release.

Notable changes:

* CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  * The http parser accepts requests with a space (SP) right after the
  header name before the colon. This can lead to HTTP Request Smuggling
  (HRS). More details are available at:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
* CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  * The parse ignores chunk extensions when parsing the body of chunked
  requests. This leads to HTTP Request Smuggling (HRS) under certain
  conditions. More details are available at:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960

PR-URL: https://github.com/nodejs-private/node-private/pull/295

PR-URL: https://github.com/nodejs-private/node-private/pull/284


Reviewed-By: Akshay K <iit.akshay@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/284


Reviewed-By: Akshay K <iit.akshay@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>

Refs: https://hackerone.com/reports/1238099
Refs: https://hackerone.com/reports/1238709
Refs: https://github.com/nodejs-private/llhttp-private/pull/6
Refs: https://github.com/nodejs-private/llhttp-private/pull/5
CVE-ID: CVE-2021-22959
CVE-ID: CVE-2021-22960

PR-URL: https://github.com/nodejs-private/node-private/pull/284


Reviewed-By: Akshay K <iit.akshay@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>

Syntax errors for RegExp literals now show hint to error location.

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Untrusted code mitigations have now been removed from V8.

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Original commit message:

    [parser] Fix the MSVC build

    MSVC seems to instantiate the Parser::PreParserIdentifierToAstRawString
    method despite it being unused. This CL adds an (unreachable)
    definition for it.

    Bug: v8:12266
    Change-Id: I355ca82a9d6b7bc8cd16768a8df93e40f8bfc638
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3199856


Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#77313}

Refs: https://github.com/v8/v8/commit/2a0bc36dec121c9f30e3c18e8ed1f0d0b4f2ed7c

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Original commit message:

    [baseline] Skip deoptimization data size

    Sparkplug code does not contain deoptimization data.

    Bug: v8:12258
    Change-Id: Ieb9f7f1469e00677d9533c6f05b17c80ef06b9d6
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3175820


    Commit-Queue: Victor Gomes <victorgomes@chromium.org>
    Commit-Queue: Camillo Bruni <cbruni@chromium.org>
    Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#76997}

Refs: https://github.com/v8/v8/commit/cf21eb36b975d0c4a1d739aa9675a14beca2d392

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40296
Fixes: https://github.com/nodejs/node/issues/40294


Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Christian Clauss <cclauss@me.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

PR-URL: https://github.com/nodejs/node/pull/38990


Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/37587


Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/35415


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

deps: patch for v8 on windows

PR-URL: https://github.com/nodejs/node/pull/40010


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

deps: patch v8 for vs2019 in std17

PR-URL: https://github.com/nodejs/node/pull/40060


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

There is a bug in the most recent version of VS2015 that affects v8.h
and therefore prevents compilation of addons.

Refs: https://stackoverflow.com/q/38378693

PR-URL: https://github.com/nodejs/node/pull/32116


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

This should be semver-patch since actual invocation is version
conditional.

PR-URL: https://github.com/nodejs/node/pull/32116


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Fixes a compilation issue on some platforms

PR-URL: https://github.com/nodejs/node/pull/32116


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Original commit message:

    [testrunner] delete ancient junit compatible format support

    Testrunner has ancient support for JUnit compatible XML output.

    This CL removes this old feature.

    R=mstarzinger@chromium.org,jgruber@chromium.org,jkummerow@chromium.org
    CC=​machenbach@chromium.org

    Bug: v8:8728
    Change-Id: I7e1beb011dbaec3aa1a27398a5c52abdd778eaf0
    Reviewed-on: https://chromium-review.googlesource.com/c/1430065


Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
    Commit-Queue: Tamer Tas <tmrts@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#59045}

Refs: https://github.com/v8/v8/commit/bd019bdb725cebaa34327634d73936cd7003d17c

PR-URL: https://github.com/nodejs/node/pull/32116


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Major V8 updates are usually API/ABI incompatible with previous
versions. This commit adapts NODE_MODULE_VERSION for V8 9.5.

Refs: https://github.com/nodejs/CTC/blob/master/meetings/2016-09-28.md

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40178


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: https://github.com/nodejs/node/pull/40293


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

PR-URL: https://github.com/nodejs/node/pull/40408


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40412


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

Use a .mailmap entry to consolidate the two entries for gierha in
AUTHORS into a single entry.

PR-URL: https://github.com/nodejs/node/pull/40406


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

update-authors.js will print if there are duplicates in the new entries
so we can remove the (not working) duplication check in the authors.yml
file. It would still be nice to get the information about duplicates
into the body of the GitHub PR so no one has to manually check for
duplicates (by either examining the file or looking at the Actions
output), but that can be a future improvement.

PR-URL: https://github.com/nodejs/node/pull/40393


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

Remove unused plugins and update @babel/eslint-parser

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

As of ESLint 8.0.0 at least, this plugin is unnecessary.

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

ESLint 8.0.0 makes the plugin unnecessary.

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

ESLint 8.0.0 introduced support for top level await, so
@babel/plugin-syntax-top-level-await is no longer necessary.

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Changes to the npm dependency in the core repo require changes to
update-eslint.sh and update-bable-eslint.sh.

PR-URL: https://github.com/nodejs/node/pull/40394


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Use the format-md task to format changelogs.

PR-URL: https://github.com/nodejs/node/pull/40388


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40396


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

Currently, there are a number of compilation warnings from zlib like the
following one:

../deps/zlib/infback.c: In function ‘inflateBack’:
../deps/zlib/infback.c:479:25: warning:
this statement may fall through [-Wimplicit-fallthrough=]
  479 |             state->mode = LEN;
      |             ~~~~~~~~~~~~^~~~~
../deps/zlib/infback.c:481:9: note: here
  481 |         case LEN:
      |         ^~~~

In this case there is no break statement and the intention is to fall
through:

           Tracev((stderr, "inflate:       codes ok\n"));
           state->mode = LEN;

        case LEN:

This commit adds -Wno-implicit-fallthrough' to zlib.gyp to suppress
these warnings.

PR-URL: https://github.com/nodejs/node/pull/40343


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/40374


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

This missing initialization was reported by the coverity scans
we are in the process of re-enabling.

PR-URL: https://github.com/nodejs/node/pull/40370


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>