Merge upstream Node.js v24.18.1 into dotnet/main - #375

The `node_protocol_generated_sources` action
was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja
to skip regeneration when PDL domain files changed.

PR-URL: nodejs#62888
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>

Without pinning Node.js, the runner defaults to Node 20 and npx falls
back to core-validate-commit@5.0.1 instead of 6.0.0 (requires
Node 22+). Version 5 does not recognise the ffi subsystem, causing
false invalid-commit alerts.

Signed-off-by: Nenad Spasenic <40522817+nsinfoPRO@users.noreply.github.com>
PR-URL: nodejs#63084
Fixes: nodejs#63070
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

PR-URL: nodejs#63090
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: nodejs#63097
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

Signed-off-by: David Thornton <david.m.thornton@gmail.com>
PR-URL: nodejs#63093
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

Start working on re-enabling QUIC support with the availability
of OpenSSL 3.5. This will be a multi-step process.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Since we need to be able to use the openssl adapter provided
by the ngtcp2 library, and because that adapter does not include
any compile guards to ensure that OpenSSL 3.5 is being used and
that the APIs are actually available, we need to add a compile
time check for the openssl version in order to conditionally
include the adapter to avoid build errors when using a shared
openssl library that is not OpenSSL 3.5.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

PR-URL: nodejs#59381
Fixes: nodejs#59369
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

PR-URL: nodejs#59381
Fixes: nodejs#59369
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

While I get that macros aren't the most loved thing in
the world, they do help reduce boilerplate, and there's
a lot of boilerplate in the QUIC code. This commit cleans
up some of that boilerplate, particularly around the
use of v8 APIs.

PR-URL: nodejs#59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

PR-URL: nodejs#59884
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

Fixes: nodejs#60110
PR-URL: nodejs#60118
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

PR-URL: nodejs#60046
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

PR-URL: nodejs#61187
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: nodejs#61403
Refs: nodejs#61372
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: nodejs#62387
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: nodejs#62387
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: nodejs#62387
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

Previously Packets were ReqWrap objects with a shared
free-list. This commit changes to a per-Endpoint arena
with no v8 involvement. This is the design I originally
had in mind but I initially went with the simpler
freelist approach to get something working. There's
too much overhead in the reqrap/freelist approach and
individual packets do not really need to be observable
via async hooks.

This design should eliminate the risk of memory fragmentation
and eliminate a significant bottleneck in the hot path.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: nodejs#62589
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

Move node:quic behind a compile-time flag, disabled by default.
Use --experimental-quic at configure time to enable.

- Add --experimental-quic flag to configure.py
- Add node_use_quic variable and HAVE_QUIC define
- Make QUIC sources conditional in node.gyp
- Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi
- Update C++ guards to check HAVE_QUIC
- Update process.features.quic to check node_use_quic

PR-URL: nodejs#61444
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: nodejs#62620
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

PR-URL: nodejs#60746
Backport-PR-URL: nodejs#62760
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>

Refs: nodejs#60746 (review)
PR-URL: nodejs#60929
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: nodejs#58680
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#63752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
CVE-ID: CVE-2026-56846

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#927
CVE-ID: CVE-2026-56847

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs-private/node-private#921
Refs: https://hackerone.com/reports/3833629
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-56848

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#930
Refs: https://hackerone.com/reports/3816840
CVE-ID: CVE-2026-56850

Refs: https://hackerone.com/reports/3815767
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#926
CVE-ID: CVE-2026-58039

PR-URL: nodejs-private/node-private#904
Refs: https://hackerone.com/reports/3811980
CVE-ID: CVE-2026-58040

SQLTagStore Run/Iterate/Get/All reset the shared cached statement via
raw sqlite3_reset(), bypassing ResetStatement() and its reset_generation_
bump, so live iterators were never invalidated. Also mark the iterator
done on SQLITE_DONE so it cannot restart the statement.

PR-URL: nodejs-private/node-private#896
Refs: https://hackerone.com/reports/3564941
Reviewed-By: Robert Nagy <ronagy@icloud.com>
CVE-ID: CVE-2026-58041

Refs: https://hackerone.com/reports/3795657
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#929
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-58042

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#911
Refs: https://hackerone.com/reports/3761342
CVE-ID: CVE-2026-58043

PR-URL: nodejs-private/node-private#922
Refs: https://hackerone.com/reports/3564941
CVE-ID: CVE-2026-58044

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#931
Refs: https://hackerone.com/reports/3857258
CVE-ID: CVE-2026-58045

PR-URL: nodejs#64713
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Paolo Insogna <paolo@cowtech.it>
PR-URL: nodejs-private/node-private#935
Refs: nodejs-private/llhttp-private#244
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

This is a security release.

Notable changes:

* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 7.29.0 (Node.js GitHub Bot)

PR-URL: nodejs-private/node-private#937
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Advances the fork from v24.7.0 to v24.18.1. This promotes the v24 line to
LTS `Krypton` and updates the bundled npm to 11.16.0.

Conflicts are resolved in `.gitignore`, `.npmrc` and `deps/ncrypto/ncrypto.cc`,
keeping both the new upstream entries and the dotnet-specific ones. The
`<vector>` include in `ncrypto.cc` is retained because `std::vector` is still
used in that file.

The `.npmrc` registry redirects are normalized so that each one sits next to a
`package.json`, which removes the orphans left behind by the npm restructure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1

These directories carry `package.json` and `package-lock.json` files whose
development dependencies are reported as vulnerable, and none of them take
part in building or installing `node`. Removing them clears the alerts for
`js-yaml`, `lodash`, `koa`, `rollup` and the older `minimatch` and
`brace-expansion` entries without affecting the shipped product.

Removed `tools/doc`, `tools/lint-md`, `tools/eslint`, `tools/clang-format`,
`deps/v8/tools/clusterfuzz`, `deps/v8/tools/turbolizer`,
`deps/v8/tools/tracing/proto-converter`, the `deps/v8/tools` manifests, and the
lockfiles under `deps/undici/src` and `deps/minimatch`.

The 11 `deps/v8/tools/*.mjs` files referenced by `node.gyp` for
`--prof-process` are retained.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1

Component Governance resolves the commit recorded in `cgmanifest.json` to
inventory the vendored sources, so the hash has to advance together with the
merge. It is set to `9623d9ad85d37d2f0610ec4a82b48182cf2c6061`, the commit
that upstream tag `v24.18.1` points at. Note that the tag is annotated, so the
tag object hash is a different value and would not resolve.

`LINT_MD_TARGETS` feeds a `find` invocation that is expanded when the makefile
is parsed, so the now removed `tools/doc` caused every `make` invocation to
print a `find` error. It is dropped from the list.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1

npm 11.16.0 bundles `brace-expansion` 5.0.6, which is still affected by
CVE-2026-13149 and CVE-2026-14257. The first fixes them in 5.0.7 and the
second in 5.0.8, and no npm release available today carries 5.0.8 or later,
so the bundled copy is updated in place to 5.0.9.

Both consumers, `deps/minimatch` and `deps/npm/node_modules/minimatch`,
declare `^5.0.5`, and the vendored `balanced-match` 4.0.4 satisfies the
`^4.0.2` requirement. The change is additive on the public surface, adding
`EXPANSION_MAX_LENGTH`, and expansion results are unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5f0907ec-3599-48ee-80b8-f8dda73c59a1