Merge tag 'v22.18.0' into node-v22.18.0-nsolid-v6.0.0-release

2025-07-31 Node.js v22.18.0 Jod (LTS) Release
Git-EVTag-v0-SHA512: 54697e2867b91f7258423437f182c3a27f45ba95f91e8446fa67397ab118011c5cf42f4e8b685bc6a73674ab5a82df8948c84b548a58d1b4e1ac81d2874276b8

Author: santigimeno

.github/CODEOWNERS

@@ -216,3 +216,10 @@
 /src/node_options.* @nodejs/config
 /test/parallel/test-config-* @nodejs/config
 /test/parallel/test-dotenv-* @nodejs/config
+
+# Inspector
+/src/inspector/* @nodejs/inspector
+/src/inspector_* @nodejs/inspector
+/lib/internal/inspector/* @nodejs/inspector
+/lib/internal/inspector_* @nodejs/inspector
+/lib/inspector.js @nodejs/inspector

.github/workflows/codeql.yml

@@ -27,15 +27,15 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b  # v3.29.2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+        uses: github/codeql-action/autobuild@181d5eefc20863364f96762470ba6f862bdef56b  # v3.29.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b  # v3.29.2
         with:
           category: /language:${{matrix.language}}

.github/workflows/commit-queue.yml

@@ -1,6 +1,6 @@
 # This action requires the following secrets to be set on the repository:
-#   GH_USER_NAME: GitHub user whose Jenkins and GitHub token are defined below
 #   GH_USER_TOKEN: GitHub user token, to be used by ncu and to push changes
+#   JENKINS_USER: GitHub user whose Jenkins token is defined below
 #   JENKINS_TOKEN: Jenkins token, to be used to check CI status
 
 name: Commit Queue
@@ -34,24 +34,24 @@ jobs:
         id: get_mergeable_prs
         run: |
           prs=$(gh pr list \
-                  --repo ${{ github.repository }} \
-                  --base ${{ github.ref_name }} \
+                  --repo "$GITHUB_REPOSITORY" \
+                  --base "$GITHUB_REF_NAME" \
                   --label 'commit-queue' \
                   --json 'number' \
                   --search "created:<=$(date --date="2 days ago"  +"%Y-%m-%dT%H:%M:%S%z") -label:blocked" \
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 100)
           fast_track_prs=$(gh pr list \
-                  --repo ${{ github.repository }} \
-                  --base ${{ github.ref_name }} \
+                  --repo "$GITHUB_REPOSITORY" \
+                  --base "$GITHUB_REF_NAME" \
                   --label 'commit-queue' \
                   --label 'fast-track' \
                   --search "-label:blocked" \
                   --json 'number' \
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 100)
           numbers=$(echo $prs' '$fast_track_prs | jq -r -s 'unique | join(" ")')
-          echo "numbers=$numbers" >> $GITHUB_OUTPUT
+          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   commitQueue:
@@ -61,9 +61,6 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
-          # Needs the whole git history for ncu to work
-          # See https://github.com/nodejs/node-core-utils/pull/486
-          fetch-depth: 0
           # A personal token is required because pushing with GITHUB_TOKEN will
           # prevent commits from running CI after they land. It needs
           # to be set here because `checkout` configures GitHub authentication
@@ -80,24 +77,23 @@ jobs:
 
       - name: Set variables
         run: |
-          echo "REPOSITORY=$(echo ${{ github.repository }} | cut -d/ -f2)" >> $GITHUB_ENV
-          echo "OWNER=${{ github.repository_owner }}" >> $GITHUB_ENV
+          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
 
       - name: Configure @node-core/utils
         run: |
-          ncu-config set branch ${GITHUB_REF_NAME}
+          ncu-config set branch "${GITHUB_REF_NAME}"
           ncu-config set upstream origin
           ncu-config set username "$USERNAME"
-          ncu-config set token "$GH_TOKEN"
+          ncu-config set token "$GITHUB_TOKEN"
           ncu-config set jenkins_token "$JENKINS_TOKEN"
           ncu-config set repo "${REPOSITORY}"
-          ncu-config set owner "${OWNER}"
+          ncu-config set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Start the Commit Queue
-        run: ./tools/actions/commit-queue.sh ${{ env.OWNER }} ${{ env.REPOSITORY }} ${{ needs.get_mergeable_prs.outputs.numbers }}
+        run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ needs.get_mergeable_prs.outputs.numbers }}
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}

.github/workflows/scorecard.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0  # v2.12.0
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49  # v2.12.2
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -73,6 +73,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.18
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b  # v3.29.2
         with:
           sarif_file: results.sarif

.mailmap

@@ -436,7 +436,8 @@ Rebecca Turner <me@re-becca.org> <rebecca@npmjs.com>
 Refael Ackermann <refack@gmail.com> <refael@empeeric.com>
 Reza Akhavan <reza@akhavan.me>
 Ricardo Sánchez Gregorio <me@richnologies.io>
-Richard Lau <rlau@redhat.com> <riclau@uk.ibm.com>
+Richard Lau <richard.lau@ibm.com> <riclau@uk.ibm.com>
+Richard Lau <richard.lau@ibm.com> <rlau@redhat.com>
 Rick Olson <technoweenie@gmail.com>
 rickyes <0x19951125@gmail.com> <ives199511@gmail.com>
 rickyes <0x19951125@gmail.com> <mail@zhoumq.cn>

CHANGELOG.md

@@ -37,7 +37,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V22.md#22.17.1">22.17.1</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V22.md#22.18.0">22.18.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V22.md#22.17.1">22.17.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V22.md#22.17.0">22.17.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V22.md#22.16.0">22.16.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V22.md#22.15.1">22.15.1</a><br/>

GOVERNANCE.md

@@ -101,9 +101,17 @@ Charter need approval by the OpenJS Foundation Cross-Project Council (CPC).
 The TSC meets in a video conference call. Each year, the TSC elects a chair to
 run the meetings. The TSC streams its meetings for public viewing on YouTube.
 
+TSC meetings may consist of a public portion and a private portion. The private
+portion is used to discuss sensitive topics, such as personnel issues,
+security vulnerabilities, or other confidential matters. Private discussions
+should be avoided as much as possible, and the TSC should strive to keep
+discussions in the public portion of the meeting, but there are times when
+private discussions are necessary.
+
 The TSC agenda includes issues that are at an impasse. The intention of the
 agenda is not to review or approve all patches. Collaborators review and approve
-patches on GitHub.
+patches on GitHub. The preference is to minimize the need for TSC meetings to
+make decisions that can otherwise be made by collaborators on GitHub.
 
 Any community member can create a GitHub issue asking that the TSC review
 something. If consensus-seeking fails for an issue, a collaborator may apply the
@@ -113,21 +121,55 @@ Before each TSC meeting, the meeting chair will share the agenda with members of
 the TSC. TSC members can also add items to the agenda at the beginning of each
 meeting. The meeting chair and the TSC cannot veto or remove items.
 
-The TSC may invite people to take part in a non-voting capacity.
-
-During the meeting, the TSC chair ensures that someone takes minutes. After the
-meeting, the TSC chair ensures that someone opens a pull request with the
-minutes.
-
-The TSC seeks to resolve as many issues as possible outside meetings using
-[the TSC issue tracker](https://github.com/nodejs/TSC/issues). The process in
-the issue tracker is:
+The TSC may invite people to take part in a non-voting capacity in either the
+public or private portions of the meeting.
+
+During the public portion of the meeting, the TSC chair ensures that someone
+takes minutes that include a summary of the discussion and any
+decisions made. After the meeting, the TSC chair ensures that someone opens a
+public pull request with the minutes from the public portion of the meeting.
+
+The public portion of the TSC meeting is expected to be recorded and made
+available for live streaming during the meeting or download by anyone after.
+This expectation is to be announced to all participants at the start of the
+each meeting before the recording is started. Continued participation in the
+public portion of the meeting after this announcement is interpreted as consent to the
+recording.
+
+For the private portion of the meeting, the TSC chair ensures that someone
+produces a summary of the discussions, gets it reviewed by the attendees,
+and shares it to all the TSC members once approved by the attendees via a
+private discussion channel such as the TSC private mailing list. The summary
+may be made public if there is consensus within the TSC and the non-TSC
+attendees to make it public.
+
+Recording the private portion of a meeting or maintaining or publishing a
+detailed transcript is only permitted when all participants present during the
+private portion of the meeting explicitly agree to the recording and/or
+transcript, in order to comply to privacy regulations.
+
+All discussions made during meetings are considered provisional, receiving no
+objections from folks at the TSC meeting to take an action is not equivalent to
+the TSC endorsing that action.
+
+If a quorum of TSC voting members is present, it is possible to call for an
+explicit vote, and take the vote immediately if there are no objections. The
+decision is considered confirmed once the rest of the TSC voting members have
+been informed and no objection for taking that vote has been raised in 48 hours.
+To clarify, TSC voting members can object to the vote taking place during the
+meeting, but not to the vote itself.
+
+For discussions outside of meetings, the TSC uses
+[the TSC issue tracker](https://github.com/nodejs/TSC/issues) for public
+issues, and the private TSC email list for private matters. The process for
+public issues in the issue tracker is:
 
 * A TSC member opens an issue explaining the proposal/issue and @-mentions
   @nodejs/tsc.
 * The proposal passes if, after 72 hours, there are two or more TSC voting
   member approvals and no TSC voting member opposition.
-* If there is an extended impasse, a TSC member may make a motion for a vote.
+* If there is an extended impasse, a TSC member may ask for the issue to be
+  added to the TSC agenda, or make a motion for a vote.
 
 ## Collaborator nominations
 

LICENSE

@@ -1545,9 +1545,9 @@ The externally maintained libraries used by Node.js are:
 - zlib, located at deps/zlib, is licensed as follows:
   """
     zlib.h -- interface of the 'zlib' general purpose compression library
-    version 1.3.0.1, August xxth, 2023
+    version 1.3.1, January 22nd, 2024
 
-    Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
+    Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
 
     This software is provided 'as-is', without any express or implied
     warranty.  In no event will the authors be held liable for any damages

Makefile

@@ -220,7 +220,7 @@ testclean: ## Remove test artifacts.
 distclean: ## Remove all build and test artifacts.
 	$(RM) -r out
 	$(RM) config.gypi icu_config.gypi
-	$(RM) config.mk
+	$(RM) config.mk config.status
 	$(RM) -r $(NODE_EXE) $(NODE_G_EXE)
 	$(RM) -r node_modules
 	$(RM) -r deps/icu

benchmark/source_map/source-map-cache.js

@@ -0,0 +1,60 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('assert');
+const fixtures = require('../../test/common/fixtures');
+
+const bench = common.createBenchmark(
+  main,
+  {
+    operation: [
+      'findSourceMap-valid',
+      'findSourceMap-generated-source',
+    ],
+    n: [1e5],
+  },
+);
+
+function main({ operation, n }) {
+  const Module = require('node:module');
+
+  Module.setSourceMapsSupport(true, {
+    generatedCode: true,
+  });
+  const validFileName = fixtures.path('test-runner/source-maps/line-lengths/index.js');
+
+  const fileNameKey = '/source-map/disk.js';
+  const generatedFileName = fixtures.path(fileNameKey);
+  const generatedFileContent = fixtures.readSync(fileNameKey, 'utf8');
+  const sourceMapUrl = generatedFileName.replace(/\.js$/, '.map');
+  const sourceWithGeneratedSourceMap =
+    `${generatedFileContent}\n//# sourceMappingURL=${sourceMapUrl}\n//# sourceURL=${generatedFileName}`;
+  const generatedExpectedUrl = `file://${generatedFileName}`;
+
+  let sourceMap;
+  switch (operation) {
+    case 'findSourceMap-valid':
+      require(validFileName);
+
+      bench.start();
+      for (let i = 0; i < n; i++) {
+        sourceMap = Module.findSourceMap(validFileName);
+      }
+      bench.end(n);
+      break;
+
+    case 'findSourceMap-generated-source':
+      eval(sourceWithGeneratedSourceMap);
+
+      bench.start();
+      for (let i = 0; i < n; i++) {
+        sourceMap = Module.findSourceMap(generatedExpectedUrl);
+      }
+      bench.end(n);
+      break;
+
+    default:
+      throw new Error(`Unknown operation: ${operation}`);
+  }
+  assert.ok(sourceMap);
+}