Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.0 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b20883b...89a39a4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61911
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

PR-URL: #61944
Refs: #61903
Reviewed-By: René <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

PR-URL: #61833
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Replace native methods with primordials.

PR-URL: #61219
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>

Signed-off-by: marcopiraccini <[email protected]>
PR-URL: #61836
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

The WHATWG Streams spec requires that pipeTo's chunk handling must
queue a microtask before calling the write algorithm. This ensures
that enqueue() does not synchronously trigger writes.

Previously, PipeToReadableStreamReadRequest[kChunk] would synchronously
call writableStreamDefaultWriterWrite(), which violated the spec and
caused the WPT test "enqueue() must not synchronously call write
algorithm" to fail.

Fix by wrapping the write operation in queueMicrotask(), which defers
it to the next microtask as required by the spec.

Refs: whatwg/streams#1243
PR-URL: #61800
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>

Signed-off-by: Igor <[email protected]>
PR-URL: #61525
Fixes: #61462
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

PR-URL: #61974
Refs: #38161
Reviewed-By: Kohei Ueno <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61976
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #61773
Refs: #61762
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

As specified in WebIDL (<https://webidl.spec.whatwg.org/#js-dictionary>),
the fields of a dictionary need to be read in lexicographical order.

PR-URL: #61980
Reviewed-By: Jason Zhang <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #61721
Reviewed-By: René <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>

PR-URL: #61916
Reviewed-By: René <[email protected]>

PR-URL: #62020
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>

Bumps [minimatch](https://github.com/isaacs/minimatch)
from 3.1.2 to 3.1.3.
- [Changelog](http://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #61977
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #62034
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Jake Yuesong Li <[email protected]>

Add validateHeaderName/validateHeaderValue checks for non-link
headers and checkInvalidHeaderChar for the Link value in HTTP/1.1
writeEarlyHints, closing a CRLF injection gap where header names
and values were concatenated into the raw response without
validation.

Also tighten linkValueRegExp to reject CR/LF inside the <...>
URL portion of Link header values.

PR-URL: #61897
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

PR-URL: #61972
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>

`validateInt32(keylen, 'keylen', 0)` lets `-0` through: `typeof -0` is
`'number'`, `Number.isInteger(-0)` is `true`, and `-0 < 0` is `false`.
The value then reaches the PBKDF2Job binding, whose `IsInt32()` check
fails (V8 boxes `-0` as a HeapNumber rather than a tagged SMI) and
aborts the process with SIGABRT.
Coerce `keylen` to `+0`
after validation so the binding sees a true Int32.

Reachable from any caller that forwards a JSON-parsed value,
since `JSON.parse('{"keylen":-0}').keylen` preserves the sign.

Mirror of the prior pbkdf2 fix. `validateInt32(keylen, 'keylen', 0)`
lets `-0` through (since `-0 < 0` is `false`), and the ScryptJob
binding's `IsInt32()` check at `crypto_scrypt.cc` aborts the process
with SIGABRT because V8 boxes `-0` as a HeapNumber rather than a
tagged SMI. Coerce `keylen` to `+0` after validation.

Signed-off-by: Jordan Harband <[email protected]>
PR-URL: #63531
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

This is the [`certdata.txt`][0] from NSS 3.123.1.

This is the version of NSS that shipped in Firefox 151.0.1 on 2026-05-21

Certificates removed:
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- Izenpe.com
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB

[0]: https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_123_1_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #63527
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63515
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Edy Silva <[email protected]>

The example claimed that posting a URL object via MessageChannel would
print an empty object, but since v21.0.0 (commit d920b7c) it
throws a DataCloneError. Update the example and surrounding text to
reflect the current behavior.

Fixes: #60504

Co-Authored-By: Claude Opus 4.6 <[email protected]>
Signed-off-by: Kit Dallege <[email protected]>
PR-URL: #62203
Fixes: #60504
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: #63479
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Signed-off-by: RonGamzu <[email protected]>
PR-URL: #63465
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Original commit message:

    Fix a bug causing the session module to dereference a NULL pointer when applying a corrupt changeset.
    FossilOrigin-Name: e807d4e3798efd532b3d78d1dfe513ed4fbd3cb793dd0ae5c30cae6031422b10

Refs: https://sqlite.org/src/info/e807d4e3798efd53
Signed-off-by: junius-sec <[email protected]>
PR-URL: #63525
Refs: https://hackerone.com/reports/3736889
Refs: sqlite/sqlite@b869ed6
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Guards scheduled jobs in daily.yml, codeql.yml, and scorecard.yml so
they only run on nodejs/node, matching the pattern already used in
tools.yml, stale.yml, and others. This prevents wasted Actions minutes
and failed-run email notifications on forks.

Signed-off-by: Jamie Magee <[email protected]>
PR-URL: #63565
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Jake Yuesong Li <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #63405
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #63414
Fixes: #63412
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

PR-URL: #62331
Refs: #61478
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Signed-off-by: Renegade334 <[email protected]>

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: #63583
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63586
Refs: nodejs/node-core-utils#1043
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #63588
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #63591
Reviewed-By: Jake Yuesong Li <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Forward Node.js tail stream data through a pipe-style data listener
instead of manually draining readable events. This keeps compose closer
to the stream pipe hot path while preserving backpressure with pause
and resume.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: #63593
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Jake Yuesong Li <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <[email protected]>
PR-URL: #63491
Fixes: #63473
Reviewed-By: René <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63609
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #63621
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Joyee Cheung <[email protected]>
PR-URL: #63650
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

PR-URL: #62962
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

Original commit message:

    Fixes #1056

    The commit
    c-ares/c-ares@1d1b3d4
    refactored the function to use wide strings, but didn't touch this
    check. Because an empty wide string would now be size 2 and not 1, the
    empty string would go on and cause the DNS domain list to be replaced
    with nothing.

    Signed-off-by: @dankmeme01

Refs: c-ares/c-ares@8ba37af
PR-URL: #64110
Fixes: #62347
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #64330
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #63752
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Notable changes:

crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527

PR-URL: #64567