From 9c041a43c1ba548a1da59c0a8f8dcdb4ce7b398b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:59:01 +0000 Subject: [PATCH 01/12] meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64925 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4bd441153011..df4793114fe3 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -46,7 +46,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif From b328490e9c033cf434e46de9cbc000459f9a62e7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:59:11 +0000 Subject: [PATCH 02/12] meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.19.4 to 2.20.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.20.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64926 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index df4793114fe3..a5cc7b3ffb06 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -36,7 +36,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs From 34a348f2cf4e0b69b2468f709282c50feb1828b3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:59:21 +0000 Subject: [PATCH 03/12] meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64927 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a5cc7b3ffb06..f84c91e1a381 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -76,6 +76,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: sarif_file: results.sarif From a208966bbdaaeef31b92632e38ef9e2ef78b9488 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:59:31 +0000 Subject: [PATCH 04/12] tools: bump the eslint group in /tools/eslint with 4 updates Bumps the eslint group in /tools/eslint with 4 updates: [@eslint/markdown](https://github.com/eslint/markdown), [eslint](https://github.com/eslint/eslint), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [globals](https://github.com/sindresorhus/globals). Updates `@eslint/markdown` from 8.0.2 to 8.0.3 - [Release notes](https://github.com/eslint/markdown/releases) - [Changelog](https://github.com/eslint/markdown/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/markdown/compare/v8.0.2...v8.0.3) Updates `eslint` from 10.5.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.5.0...v10.8.0) Updates `eslint-plugin-jsdoc` from 63.0.9 to 63.3.1 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v63.0.9...v63.3.1) Updates `globals` from 17.7.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0) --- updated-dependencies: - dependency-name: "@eslint/markdown" dependency-version: 8.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: eslint - dependency-name: eslint-plugin-jsdoc dependency-version: 63.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: eslint - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: eslint ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64928 Reviewed-By: Aviv Keller Reviewed-By: Antoine du Hamel Reviewed-By: Colin Ihrig --- tools/eslint/package-lock.json | 84 +++++++++++++++++----------------- tools/eslint/package.json | 8 ++-- 2 files changed, 46 insertions(+), 46 deletions(-) diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json index 6d8503b1ec30..82bdd3efb8c2 100644 --- a/tools/eslint/package-lock.json +++ b/tools/eslint/package-lock.json @@ -13,13 +13,13 @@ "@babel/plugin-syntax-import-defer": "^8.0.1", "@babel/plugin-syntax-import-source": "^8.0.1", "@eslint/js": "^10.0.1", - "@eslint/markdown": "^8.0.2", + "@eslint/markdown": "^8.0.3", "@stylistic/eslint-plugin": "^5.10.0", - "eslint": "^10.5.0", + "eslint": "^10.8.0", "eslint-formatter-tap": "^9.0.1", - "eslint-plugin-jsdoc": "^63.0.9", + "eslint-plugin-jsdoc": "^63.3.1", "eslint-plugin-regexp": "^3.1.1", - "globals": "^17.7.0" + "globals": "^17.8.0" } }, "node_modules/@babel/code-frame": { @@ -278,16 +278,16 @@ } }, "node_modules/@es-joy/jsdoccomment": { - "version": "0.87.0", - "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.87.0.tgz", - "integrity": "sha512-mFXZloZMzuJZXSHUmAFu/pXTk0ZJTJBluuAkrvbzidpTN8W6F2bpRFuedSH+85kbdlRLJqc+gfN+kD3JOLJK5g==", + "version": "0.90.0", + "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.90.0.tgz", + "integrity": "sha512-51x9KxyTAN6guZOCd+lmcDdkhgdMdP/6iMMtg9dyhCWDc3+iSUyoB7f/9WAM/yGHmGFq25Vd6bXRR7CZcB+tog==", "license": "MIT", "dependencies": { "@types/estree": "^1.0.9", - "@typescript-eslint/types": "^8.59.4", + "@typescript-eslint/types": "^8.65.0", "comment-parser": "1.4.7", "esquery": "^1.7.0", - "jsdoc-type-pratt-parser": "~7.2.0" + "jsdoc-type-pratt-parser": "~7.3.0" }, "engines": { "node": "^20.19.0 || ^22.13.0 || >=24" @@ -356,9 +356,9 @@ } }, "node_modules/@eslint/config-helpers": { - "version": "0.6.0", - "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.6.0.tgz", - "integrity": "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==", + "version": "0.7.0", + "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz", + "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==", "license": "Apache-2.0", "dependencies": { "@eslint/core": "^1.2.1" @@ -400,16 +400,16 @@ } }, "node_modules/@eslint/markdown": { - "version": "8.0.2", - "resolved": "https://registry.npmjs.org/@eslint/markdown/-/markdown-8.0.2.tgz", - "integrity": "sha512-W+/0qHp0WbvFEljUvvECNpSWrUHpBWIWwp7F3QqEwQKmaRCmfEWvk6VfUia9pTQ0th6HyBGBsPfg/kG3/aQxLA==", + "version": "8.0.3", + "resolved": "https://registry.npmjs.org/@eslint/markdown/-/markdown-8.0.3.tgz", + "integrity": "sha512-rBTSSShrq7e4O+PWfeE4azH4/CWPNrC+VGxBXiW00o3vYVJnznsZiDayj3KC9JztIMVRZxZHn2nrDIUau/4j7A==", "license": "MIT", "workspaces": [ "examples/*" ], "dependencies": { "@eslint/core": "^1.2.1", - "@eslint/plugin-kit": "^0.7.1", + "@eslint/plugin-kit": "^0.7.2", "github-slugger": "^2.0.0", "mdast-util-from-markdown": "^2.0.2", "mdast-util-frontmatter": "^2.0.1", @@ -649,9 +649,9 @@ "license": "MIT" }, "node_modules/@typescript-eslint/types": { - "version": "8.62.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.1.tgz", - "integrity": "sha512-ooCzJFaf+Hg+uG6fA3NRFGuFjlfNlDhBthbv4ZPU/0elCAFUfnyXUvf/WOpHz/jYwSmvU2GkR2LtyUfy1AxZ1Q==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz", + "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==", "license": "MIT", "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -952,9 +952,9 @@ } }, "node_modules/eslint": { - "version": "10.5.0", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.5.0.tgz", - "integrity": "sha512-1y+7C+vi12bUK1IpZeaV3gsH9fHLBmPvYmPx42pvT/E9yG0IC8g3PUZZgp0+JLJl7ZDK0flc2gc+Aw9dpCvIsQ==", + "version": "10.8.0", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.0.tgz", + "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==", "license": "MIT", "workspaces": [ "packages/*" @@ -963,7 +963,7 @@ "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", - "@eslint/config-helpers": "^0.6.0", + "@eslint/config-helpers": "^0.7.0", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", @@ -987,7 +987,7 @@ "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", - "minimatch": "^10.2.4", + "minimatch": "^10.2.5", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, @@ -1022,12 +1022,12 @@ } }, "node_modules/eslint-plugin-jsdoc": { - "version": "63.0.9", - "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.0.9.tgz", - "integrity": "sha512-SJskF1zzPPRVfsmJyr/PqUXcpjA7o5Y0YnEoLBMDQlQWhELbYMRvK/8Fzlvh5XwEwJW8glAtKGKucaL0WGPMkw==", + "version": "63.3.1", + "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.3.1.tgz", + "integrity": "sha512-yVyTPtOY2tA8EjTwUtaM3pFxj9i/3m4/FSPMv5gMnDHSSleCpzIYQLyV8KnVmEIkkPpNhDlkDQ99mTfjxgqLxA==", "license": "BSD-3-Clause", "dependencies": { - "@es-joy/jsdoccomment": "~0.87.0", + "@es-joy/jsdoccomment": "~0.90.0", "@es-joy/resolve.exports": "1.2.0", "are-docs-informative": "^0.0.2", "comment-parser": "1.4.7", @@ -1038,8 +1038,8 @@ "html-entities": "^2.6.0", "object-deep-merge": "^2.0.1", "parse-imports-exports": "^0.2.4", - "semver": "^7.8.2", - "spdx-expression-parse": "^4.0.0", + "semver": "^7.8.5", + "spdx-expression-parse": "^5.0.0", "to-valid-identifier": "^1.0.0" }, "engines": { @@ -1319,9 +1319,9 @@ } }, "node_modules/globals": { - "version": "17.7.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz", - "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==", + "version": "17.8.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz", + "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==", "license": "MIT", "engines": { "node": ">=18" @@ -1430,9 +1430,9 @@ } }, "node_modules/jsdoc-type-pratt-parser": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.2.0.tgz", - "integrity": "sha512-dh140MMgjyg3JhJZY/+iEzW+NO5xR2gpbDFKHqotCmexElVntw7GjWjt511+C/Ef02RU5TKYrJo/Xlzk+OLaTw==", + "version": "7.3.0", + "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.3.0.tgz", + "integrity": "sha512-DoyJXo7x/n48M3NsGOs9QnEws0ft0tV3YsSgvWMNxz2hZtz+Q6fpqUD96lVYX4a+jcEkzHeFNDJOn68TzXfbdA==", "license": "MIT", "engines": { "node": ">=20.0.0" @@ -2672,9 +2672,9 @@ "license": "CC-BY-3.0" }, "node_modules/spdx-expression-parse": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz", - "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==", + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-5.0.0.tgz", + "integrity": "sha512-vngmw3Rgn+o2arXNbnZaj5UtOEBuWBfvaI+Wc8GFfykIhA5/vdK9/Sp/XkLv63dykz2rxKDvKEHupF5P0FORcQ==", "license": "MIT", "dependencies": { "spdx-exceptions": "^2.1.0", @@ -2682,9 +2682,9 @@ } }, "node_modules/spdx-license-ids": { - "version": "3.0.22", - "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz", - "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ==", + "version": "3.0.23", + "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz", + "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==", "license": "CC0-1.0" }, "node_modules/to-valid-identifier": { diff --git a/tools/eslint/package.json b/tools/eslint/package.json index 3199c2bb7b17..30b0aa50c84c 100644 --- a/tools/eslint/package.json +++ b/tools/eslint/package.json @@ -8,12 +8,12 @@ "@babel/plugin-syntax-import-defer": "^8.0.1", "@babel/plugin-syntax-import-source": "^8.0.1", "@eslint/js": "^10.0.1", - "@eslint/markdown": "^8.0.2", + "@eslint/markdown": "^8.0.3", "@stylistic/eslint-plugin": "^5.10.0", - "eslint": "^10.5.0", + "eslint": "^10.8.0", "eslint-formatter-tap": "^9.0.1", - "eslint-plugin-jsdoc": "^63.0.9", + "eslint-plugin-jsdoc": "^63.3.1", "eslint-plugin-regexp": "^3.1.1", - "globals": "^17.7.0" + "globals": "^17.8.0" } } From b30628c4e079af5975270f47e5c12c8131a226d8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:59:41 +0000 Subject: [PATCH 05/12] meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.6 to 31.11.0. - [Release notes](https://github.com/cachix/install-nix-action/releases) - [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md) - [Commits](https://github.com/cachix/install-nix-action/compare/8aa03977d8d733052d78f4e008a241fd1dbf36b3...630ae543ea3a38a9a4166f03376c02c50f408342) --- updated-dependencies: - dependency-name: cachix/install-nix-action dependency-version: 31.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64929 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/benchmark.yml | 4 ++-- .github/workflows/build-shared.yml | 2 +- .github/workflows/nix-changes.yml | 4 ++-- .github/workflows/test-shared.yml | 2 +- .github/workflows/tools.yml | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 48b3f1d61259..276cf738f8a6 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -92,7 +92,7 @@ jobs: env: EXPECTED_SHA: ${{ inputs.commit }} - - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 with: extra_nix_config: sandbox = true @@ -211,7 +211,7 @@ jobs: merge-multiple: true path: raw-results - - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 with: extra_nix_config: sandbox = true diff --git a/.github/workflows/build-shared.yml b/.github/workflows/build-shared.yml index c858c34cd18b..908116021c27 100644 --- a/.github/workflows/build-shared.yml +++ b/.github/workflows/build-shared.yml @@ -53,7 +53,7 @@ jobs: tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP" echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV" - - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 with: extra_nix_config: sandbox = true diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml index 819199414377..ef05b0bfc8ed 100644 --- a/.github/workflows/nix-changes.yml +++ b/.github/workflows/nix-changes.yml @@ -50,7 +50,7 @@ jobs: sparse-checkout: '*.nix' sparse-checkout-cone-mode: false - - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 with: extra_nix_config: sandbox = true @@ -129,7 +129,7 @@ jobs: persist-credentials: false sparse-checkout: '*.nix' sparse-checkout-cone-mode: false - - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 - name: Lint Nix files run: | nix-shell -I nixpkgs=./tools/nix/pkgs.nix -p 'nixfmt-tree' --run ' diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml index ac76d5b3f32e..a8f2ddc27831 100644 --- a/.github/workflows/test-shared.yml +++ b/.github/workflows/test-shared.yml @@ -182,7 +182,7 @@ jobs: tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP" echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV" - - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 with: extra_nix_config: sandbox = true diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml index e5ea38b755c3..9ee3b8b45e13 100644 --- a/.github/workflows/tools.yml +++ b/.github/workflows/tools.yml @@ -321,7 +321,7 @@ jobs: allow-prereleases: true - name: Set up Nix if: matrix.id == 'nixpkgs-unstable' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 + uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 - run: ${{ matrix.run }} if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id env: From 9c7c88c52cefcbe79082ca7e89767a78b83cea2b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 18:59:51 +0000 Subject: [PATCH 06/12] meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [Mozilla-Actions/sccache-action](https://github.com/mozilla-actions/sccache-action) from 0.0.10 to 0.0.11. - [Release notes](https://github.com/mozilla-actions/sccache-action/releases) - [Commits](https://github.com/mozilla-actions/sccache-action/compare/9e7fa8a12102821edf02ca5dbea1acd0f89a2696...fc920bf0ec8de6ee65d409111f7ec508035751ba) --- updated-dependencies: - dependency-name: Mozilla-Actions/sccache-action dependency-version: 0.0.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64930 Reviewed-By: Aviv Keller Reviewed-By: Michaël Zasso Reviewed-By: Colin Ihrig --- .github/workflows/build-tarball.yml | 2 +- .github/workflows/coverage-linux-without-intl.yml | 2 +- .github/workflows/coverage-linux.yml | 2 +- .github/workflows/stress-test.yml | 2 +- .github/workflows/test-internet.yml | 2 +- .github/workflows/test-linux-quic.yml | 2 +- .github/workflows/test-linux.yml | 2 +- .github/workflows/test-macos.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml index 67ef806c53c1..7d0e63ddbc5e 100644 --- a/.github/workflows/build-tarball.yml +++ b/.github/workflows/build-tarball.yml @@ -118,7 +118,7 @@ jobs: allow-prereleases: true - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 - name: Download tarball diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml index 8216c0913b1a..ea5527300a33 100644 --- a/.github/workflows/coverage-linux-without-intl.yml +++ b/.github/workflows/coverage-linux-without-intl.yml @@ -64,7 +64,7 @@ jobs: allow-prereleases: true - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 - name: Install gcovr diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml index 32f5db02e166..fa74aa923967 100644 --- a/.github/workflows/coverage-linux.yml +++ b/.github/workflows/coverage-linux.yml @@ -64,7 +64,7 @@ jobs: allow-prereleases: true - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 - name: Install gcovr diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml index a97f6039706d..f9688bb7e5ab 100644 --- a/.github/workflows/stress-test.yml +++ b/.github/workflows/stress-test.yml @@ -76,7 +76,7 @@ jobs: rustup override set "$RUSTC_VERSION" rustup --version - name: Set up sccache - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 # This is needed due to https://github.com/nodejs/build/issues/3878 diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml index e899deb4d8d5..184e3ae568f2 100644 --- a/.github/workflows/test-internet.yml +++ b/.github/workflows/test-internet.yml @@ -69,7 +69,7 @@ jobs: allow-prereleases: true - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 - name: Build diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml index 932e270b98ce..36056a25110e 100644 --- a/.github/workflows/test-linux-quic.yml +++ b/.github/workflows/test-linux-quic.yml @@ -66,7 +66,7 @@ jobs: allow-prereleases: true - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 - name: Build diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml index 998a5e8843bf..e3db225b4024 100644 --- a/.github/workflows/test-linux.yml +++ b/.github/workflows/test-linux.yml @@ -77,7 +77,7 @@ jobs: allow-prereleases: true - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 - name: Build diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml index ffb626ebe667..19669089cc9b 100644 --- a/.github/workflows/test-macos.yml +++ b/.github/workflows/test-macos.yml @@ -100,7 +100,7 @@ jobs: rustup --version - name: Set up sccache if: github.base_ref == 'main' || github.ref_name == 'main' - uses: Mozilla-Actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 with: version: v0.16.0 # The `npm ci` for this step fails a lot as part of the Test step. Run it From 76cdc0e51d6bf37d3db6f210b87048f587762292 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:00:00 +0000 Subject: [PATCH 07/12] meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64931 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fea54e9b8852..df60778c5301 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,7 +28,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} config-file: ./.github/codeql-config.yml From ffa62401d7b36a727249c9cf9f6813ea7666413b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:00:10 +0000 Subject: [PATCH 08/12] meta: bump actions/setup-python from 6.3.0 to 7.0.0 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64932 Reviewed-By: Aviv Keller Reviewed-By: Colin Ihrig --- .github/workflows/build-tarball.yml | 4 ++-- .github/workflows/coverage-linux-without-intl.yml | 2 +- .github/workflows/coverage-linux.yml | 2 +- .github/workflows/coverage-windows.yml | 2 +- .github/workflows/daily-wpt-fyi.yml | 2 +- .github/workflows/linters.yml | 8 ++++---- .github/workflows/stress-test.yml | 2 +- .github/workflows/test-internet.yml | 2 +- .github/workflows/test-linux-quic.yml | 2 +- .github/workflows/test-linux.yml | 2 +- .github/workflows/test-macos.yml | 2 +- .github/workflows/tools.yml | 2 +- 12 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml index 7d0e63ddbc5e..1e1febe22c7f 100644 --- a/.github/workflows/build-tarball.yml +++ b/.github/workflows/build-tarball.yml @@ -78,7 +78,7 @@ jobs: with: persist-credentials: false - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true @@ -112,7 +112,7 @@ jobs: with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml index ea5527300a33..1519ef6592e8 100644 --- a/.github/workflows/coverage-linux-without-intl.yml +++ b/.github/workflows/coverage-linux-without-intl.yml @@ -58,7 +58,7 @@ jobs: with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml index fa74aa923967..e4a3c334c8cd 100644 --- a/.github/workflows/coverage-linux.yml +++ b/.github/workflows/coverage-linux.yml @@ -58,7 +58,7 @@ jobs: with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml index b282f03ccb7b..59329670e6c2 100644 --- a/.github/workflows/coverage-windows.yml +++ b/.github/workflows/coverage-windows.yml @@ -74,7 +74,7 @@ jobs: with: persist-credentials: false - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml index b6f7af237c9e..8dda0ff75d6e 100644 --- a/.github/workflows/daily-wpt-fyi.yml +++ b/.github/workflows/daily-wpt-fyi.yml @@ -39,7 +39,7 @@ jobs: runs-on: ubuntu-24.04-arm steps: - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml index a7641a3c04d7..6917eb995c9e 100644 --- a/.github/workflows/linters.yml +++ b/.github/workflows/linters.yml @@ -42,7 +42,7 @@ jobs: with: persist-credentials: false - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true @@ -61,7 +61,7 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true @@ -151,7 +151,7 @@ jobs: *.py sparse-checkout-cone-mode: false - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true @@ -173,7 +173,7 @@ jobs: *.yaml sparse-checkout-cone-mode: false - name: Use Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml index f9688bb7e5ab..b6fa42137d5e 100644 --- a/.github/workflows/stress-test.yml +++ b/.github/workflows/stress-test.yml @@ -67,7 +67,7 @@ jobs: if: runner.os == 'macOS' run: sudo xcode-select -s /Applications/Xcode_${{ env.XCODE_VERSION }}.app - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml index 184e3ae568f2..ab3070947c90 100644 --- a/.github/workflows/test-internet.yml +++ b/.github/workflows/test-internet.yml @@ -63,7 +63,7 @@ jobs: with: clang-version: ${{ env.CLANG_VERSION }} - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml index 36056a25110e..38d2ef9b8407 100644 --- a/.github/workflows/test-linux-quic.yml +++ b/.github/workflows/test-linux-quic.yml @@ -60,7 +60,7 @@ jobs: rustup override set "$RUSTC_VERSION" rustup --version - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml index e3db225b4024..c38bae0693fd 100644 --- a/.github/workflows/test-linux.yml +++ b/.github/workflows/test-linux.yml @@ -71,7 +71,7 @@ jobs: rustup override set "$RUSTC_VERSION" rustup --version - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml index 19669089cc9b..173f6758ad71 100644 --- a/.github/workflows/test-macos.yml +++ b/.github/workflows/test-macos.yml @@ -88,7 +88,7 @@ jobs: persist-credentials: false path: node - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml index 9ee3b8b45e13..0008b0478f55 100644 --- a/.github/workflows/tools.yml +++ b/.github/workflows/tools.yml @@ -315,7 +315,7 @@ jobs: if: | (matrix.id == 'icu' || matrix.id == 'inspector_protocol') && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id) - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.PYTHON_VERSION }} allow-prereleases: true From 88b82eadcc3b61b6f30505c5772c4f382501ae0f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:00:21 +0000 Subject: [PATCH 09/12] meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64933 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index df60778c5301..d1f69dc7e4b7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: config-file: ./.github/codeql-config.yml - name: Autobuild - uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 From 2774f014e93a0d51824a7fe45b3f01918e6b5b91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:00:30 +0000 Subject: [PATCH 10/12] meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64934 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d1f69dc7e4b7..23084c68ac5e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,6 +37,6 @@ jobs: uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: /language:${{matrix.language}} From 4cc0ced00844cb3b35d488b113150fc3a2a2bb51 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:00:40 +0000 Subject: [PATCH 11/12] meta: bump actions/stale from 10.3.0 to 11.0.0 Bumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to 11.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...4391f3da665fdf50b6810c1a66712fb9ba21aa93) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/64935 Reviewed-By: Aviv Keller Reviewed-By: Trivikram Kamat Reviewed-By: Colin Ihrig --- .github/workflows/close-stalled.yml | 2 +- .github/workflows/stale.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/close-stalled.yml b/.github/workflows/close-stalled.yml index 56c0f2542b9e..3c7ab04339d1 100644 --- a/.github/workflows/close-stalled.yml +++ b/.github/workflows/close-stalled.yml @@ -20,7 +20,7 @@ jobs: if: github.repository == 'nodejs/node' runs-on: ubuntu-slim steps: - - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} days-before-close: 30 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 0047f5f7718a..eb5921edb932 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -33,7 +33,7 @@ jobs: if: github.repository == 'nodejs/node' runs-on: ubuntu-slim steps: - - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} days-before-stale: 90 From f00fb7505183973b926a703e71b6cd15883fc4f5 Mon Sep 17 00:00:00 2001 From: Trivikram Kamat <16024985+trivikr@users.noreply.github.com> Date: Mon, 3 Aug 2026 12:34:01 -0700 Subject: [PATCH 12/12] sqlite: invalidate sessions when closing database DatabaseSync::DeleteSessions() deleted native sqlite3_session handles without clearing the pointers held by their Session wrappers. Reopening the database allowed stale session handles to be used, crashing the process. Track Session wrappers and delete sessions through Session::Delete() so the wrappers are marked closed. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: codex:gpt-5.6-sol PR-URL: https://github.com/nodejs/node/pull/64783 Fixes: https://github.com/nodejs/node/issues/64782 Reviewed-By: Aviv Keller --- src/node_sqlite.cc | 23 +++++++++++++++++------ src/node_sqlite.h | 5 ++++- test/parallel/test-sqlite-session.js | 16 ++++++++++++++++ 3 files changed, 37 insertions(+), 7 deletions(-) diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc index 8c3709178af0..272e6ffd0aeb 100644 --- a/src/node_sqlite.cc +++ b/src/node_sqlite.cc @@ -912,10 +912,9 @@ void DatabaseSync::RemoveBackup(BackupJob* job) { void DatabaseSync::DeleteSessions() { // all attached sessions need to be deleted before the database is closed // https://www.sqlite.org/session/sqlite3session_create.html - for (auto* session : sessions_) { - sqlite3session_delete(session); + while (!sessions_.empty()) { + (*sessions_.begin())->Delete(); } - sessions_.clear(); } DatabaseSync::~DatabaseSync() { @@ -2118,13 +2117,22 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo& args) { sqlite3_session* pSession; int r = sqlite3session_create(db->connection_, db_name.c_str(), &pSession); CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void()); - db->sessions_.insert(pSession); + bool wrapper_owns_session = false; + auto delete_session_on_failure = OnScopeLeave([&]() { + if (!wrapper_owns_session) { + sqlite3session_delete(pSession); + } + }); r = sqlite3session_attach(pSession, table == "" ? nullptr : table.c_str()); CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void()); BaseObjectPtr session = Session::Create(env, BaseObjectPtr(db), pSession); + if (!session) { + return; + } + wrapper_owns_session = true; args.GetReturnValue().Set(session->object()); } @@ -3813,6 +3821,7 @@ Session::Session(Environment* env, : BaseObject(env, object), session_(session), database_(std::move(database)) { + database_->sessions_.insert(this); MakeWeak(); } @@ -3905,10 +3914,12 @@ void Session::Dispose(const v8::FunctionCallbackInfo& args) { } void Session::Delete() { - if (!database_ || !database_->connection_ || session_ == nullptr) return; + if (session_ == nullptr) return; sqlite3session_delete(session_); - database_->sessions_.erase(session_); session_ = nullptr; + if (database_) { + database_->sessions_.erase(this); + } } void DefineConstants(Local target) { diff --git a/src/node_sqlite.h b/src/node_sqlite.h index 84c0e26e61ad..48463b215cb3 100644 --- a/src/node_sqlite.h +++ b/src/node_sqlite.h @@ -133,6 +133,7 @@ class DatabaseSyncLimits; class StatementSyncIterator; class StatementSync; class BackupJob; +class Session; class StatementExecutionHelper { public: @@ -243,7 +244,7 @@ class DatabaseSync : public BaseObject { bool ignore_next_sqlite_error_; std::set backups_; - std::set sessions_; + std::unordered_set sessions_; std::unordered_set statements_; friend class DatabaseSyncLimits; @@ -360,6 +361,8 @@ class Session : public BaseObject { void Delete(); sqlite3_session* session_; BaseObjectPtr database_; // The Parent Database + + friend class DatabaseSync; }; class SQLTagStore : public BaseObject { diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js index ad481ba4de77..c36b4352a341 100644 --- a/test/parallel/test-sqlite-session.js +++ b/test/parallel/test-sqlite-session.js @@ -81,6 +81,22 @@ test('session.changeset() - closed database results in exception', (t) => { }); }); +test('session methods - reopened database results in exception', (t) => { + for (const method of ['changeset', 'close']) { + const database = new DatabaseSync(':memory:'); + const session = database.createSession(); + database.close(); + database.open(); + + t.assert.throws(() => { + session[method](); + }, { + name: 'Error', + message: 'session is not open', + }); + } +}); + test('database.applyChangeset() - closed database results in exception', (t) => { const database = new DatabaseSync(':memory:'); const session = database.createSession();