Node v24.18.1 nsolid v6.3.5 release

[santigimeno]

Summary by CodeRabbit

• Bug Fixes

  • Improved pattern expansion reliability, including nested and empty expansions.
  • Added safeguards to prevent excessive expansion output and improve resource usage.
  • Improved module state recovery when loading errors occur.

• Maintenance

  • Updated bundled dependency versions, including minimatch, brace-expansion, and tar.

• Release

  • Marked the NSolid 24.18.1-nsolid-v6.3.5 build as an official release.
  • Added the release to the changelog.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 233bbb9a-d2af-42c9-b353-98df9692f2eb

📥 Commits

Reviewing files that changed from the base of the PR and between 58fcc34 and e069ccf.

⛔ Files ignored due to path filters (11)

• deps/minimatch/package-lock.json is excluded by !**/package-lock.json
• deps/npm/node_modules/brace-expansion/dist/commonjs/index.js is excluded by !**/dist/**, !**/node_modules/**
• deps/npm/node_modules/brace-expansion/dist/esm/index.js is excluded by !**/dist/**, !**/node_modules/**
• deps/npm/node_modules/brace-expansion/package.json is excluded by !**/node_modules/**
• deps/npm/node_modules/tar/dist/commonjs/index.min.js is excluded by !**/dist/**, !**/node_modules/**, !**/*.min.js
• deps/npm/node_modules/tar/dist/commonjs/list.js is excluded by !**/dist/**, !**/node_modules/**
• deps/npm/node_modules/tar/dist/commonjs/parse.js is excluded by !**/dist/**, !**/node_modules/**
• deps/npm/node_modules/tar/dist/esm/index.min.js is excluded by !**/dist/**, !**/node_modules/**, !**/*.min.js
• deps/npm/node_modules/tar/dist/esm/list.js is excluded by !**/dist/**, !**/node_modules/**
• deps/npm/node_modules/tar/dist/esm/parse.js is excluded by !**/dist/**, !**/node_modules/**
• deps/npm/node_modules/tar/package.json is excluded by !**/node_modules/**

📒 Files selected for processing (5)

• deps/minimatch/index.js
• deps/minimatch/package.json
• deps/npm/package.json
• doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V24.md
• src/node_version.h

---

Walkthrough

The change adds bounded brace expansion to minimatch, resets loader state after callback errors, updates related package metadata, documents the Krypton release, and marks the NSolid build as a release.

Changes

Minimatch and NSolid release

Layer / File(s)	Summary
Bounded brace expansion deps/minimatch/index.js	Brace expansion now enforces expansion-count and total-output-length limits across sequences, recursive options, nested braces, and Cartesian combination.
Loader error-state handling deps/minimatch/index.js	The CommonJS loader clears module state before rethrowing callback errors.
Dependency and release integration deps/minimatch/package.json, deps/npm/package.json, doc/changelogs/..., src/node_version.h	Package metadata updates minimatch, brace-expansion, and tar. The changelog adds the release entry, and NSOLID_VERSION_IS_RELEASE is set to 1.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant expand
  participant sequenceExpansion
  participant combine
  expand->>sequenceExpansion: generate bounded numeric or alphabetic ranges
  sequenceExpansion->>combine: pass limited expansion values
  expand->>combine: combine recursive and trailing pattern results
  combine-->>expand: return results within count and length limits

Loading

Possibly related PRs

• nodesource/nsolid#329: Updates minimatch and brace-expansion handling and release state.
• nodesource/nsolid#332: Updates related release metadata and dependencies.
• nodesource/nsolid#397: Changes NSOLID_VERSION_IS_RELEASE from 0 to 1.

Suggested reviewers: rafaelgss, nodejs-github-bot

Poem

A rabbit bounds braces, four million wide,
Counts each expansion and keeps them inside.
Packages hop to their newer release,
The loader resets, then errors find peace.
The build flag rises—release is in sight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Node v24.18.1 and N|Solid v6.3.5 release described by the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch node-v24.18.1-nsolid-v6.3.5-release

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​tshy@​4.1.0 ⏵ 4.1.3			+1	-1
	npm/​oxlint@​1.58.0 ⏵ 1.76.0	+1			+1
	npm/​tap@​21.6.2 ⏵ 21.7.5			+1	+2
	npm/​typedoc@​0.28.18 ⏵ 0.28.20				+3
	npm/​oxlint-tsgolint@​0.18.1 ⏵ 7.0.2001	+1			+4
	npm/​prettier@​3.8.1 ⏵ 3.9.6			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm tshy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: deps/minimatch/package-lock.json → npm/tshy@4.1.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tshy@4.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report