Repository navigation
Conversation
Resolve local actions and reusable workflows from the running workflow commit with $/ references, independent of checkout paths. Remove the tarball job's action-only checkout and the WPT action checkout/copy workaround, which are no longer needed. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66013 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Refresh conditional algorithm registration on FIPS changes and use the current state for parameter restrictions. Use per-algorithm availability checks in normalization and native named key generation. Remove getPqcKeyTypes(). Enable supports() tests under FIPS and cover state transitions in warmed workers. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66160 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Read buffer lengths and element sizes from internal slots in randomFillSync() and randomFill(). Shadowed properties can otherwise skip filling, change the selected range, or fail a native bounds check. Use the intrinsic byte length for the getRandomValues() quota check and keep its delegation to randomFillSync(). Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66237 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>
Skip redundant PBKDF2 WPT variants during regular CI. Keep the full matrix when producing a WPT report. Retain the RSA WPT variants because v24 cannot skip whole variants without hanging empty test runs. Use fewer scrypt, PBKDF2, and Argon2 derivations in parallel tests. Reuse RSA key material across OAEP hash and PSS salt tests. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66244 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Convert algorithm dictionaries on the original receiver, with name read once. Validate normalized parameters in their operation steps after the method-level key checks and generation usage checks. This also makes Argon2 validation use converted parallelism and keeps later dictionary conversion errors ahead of semantic parameter errors. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66237 Backport-PR-URL: nodejs#66391 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Require cSHAKE and KMAC output lengths and KMAC key lengths to be multiples of 8 bits. KMAC keys must be at least 32 bits. Share these restrictions between operations and supports. Use OpenSSL's KMAC provider for all supported inputs and its cSHAKE implementation for non-empty function names or customization strings. Keep using SHAKE when both cSHAKE parameters are empty. Remove the custom Keccak framing, partial-bit handling, and short-key fallback. Document the OpenSSL 4.0 requirement for non-empty cSHAKE parameters and reject customization strings containing null bytes. Keep the documented 512-byte customization limit and let backend failures reach callers. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66237 Backport-PR-URL: nodejs#66391 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Instead of creating a RandomBytesJob object, it calls CSPRNG() directly now. Assisted-by: Claude Code Signed-off-by: Mert Can Altin <mertgold60@gmail.com> PR-URL: nodejs#66348 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Signed-off-by: Filip Skokan <panva.ip@gmail.com>
The typed array Blob constructor tests expect little-endian byte order. Mark them as expected failures only on big-endian platforms, so failures on little-endian platforms remain visible. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Claude, Codex PR-URL: nodejs#66322 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Honor allow_uncaught_exception for unhandled promise rejections in the WPT worker path. Apply setup settings before nested callbacks, preserve settings after results start, and apply promise_setup settings when its callback runs. Keep rejection failures in single_test mode. Cover the worker runner and remove the flaky expectation for the Web Locks test that deliberately rejects. Refs: nodejs#59142 Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Claude, Codex PR-URL: nodejs#66322 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
ncrypto::KEM creates a new EVP_PKEY_CTX per operation. Parameters, entropy, scratch buffers, and outputs are private to each call. ML-KEM expansion finishes during import, and operations read an immutable key. EC and X25519 retain read-only recipient keys. RSA synchronizes mutable caches internally. Remove the outer locks serializing jobs that share a KeyObject or CryptoKey. Cover cold keys and worker clones across RSA, EC, X25519, and ML-KEM, checking every resulting shared secret. Refs: https://docs.openssl.org/3.5/man7/openssl-threads/ Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66413 Reviewed-By: James M Snell <jasnell@gmail.com>
Raw and JWK getters return independently owned bytes or BIGNUMs. RSA metadata snapshots public parameters and PSS restrictions. EC fallback paths reconstruct or duplicate the source key. EC PKCS8 export changes encoding flags only on its own clone. Early OpenSSL 3 key downgrading mutated shared provider fields. Current OpenSSL publishes separate legacy and provider conversion caches under internal read/write locks. Ordinary DER/PEM export, equality, signing, and key derivation already access the same keys without these locks. Remove export and metadata acquisitions, including their coverage of V8 allocation and encoding, and remove the now-unused shared mutex storage. Retain shared immutable key ownership. The concurrent reuse test checks that EC PKCS8 export leaves the original flags intact. Refs: nodejs#36825 Refs: https://docs.openssl.org/3.5/man7/openssl-threads/ Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: nodejs#66413 Reviewed-By: James M Snell <jasnell@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
lib / src
Collaborator
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## v24.x-staging #66970 +/- ##
=================================================
+ Coverage 90.31% 90.42% +0.11%
=================================================
Files 711 717 +6
Lines 228425 240577 +12152
Branches 43160 45894 +2734
=================================================
+ Hits 206293 217535 +11242
- Misses 14090 14509 +419
- Partials 8042 8533 +491
🚀 New features to boost your workflow:
|
Collaborator
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the following to
v24.x-staging: