[v24.x backport] crypto and Web IDL fixes and features

.github/dependabot.yml

@@ -9,6 +9,11 @@ updates:
     commit-message:
       prefix: meta
     open-pull-requests-limit: 10
+    groups:
+      codeql-action:
+        applies-to: version-updates
+        patterns:
+          - github/codeql-action
 
   - package-ecosystem: npm
     directory: /tools/eslint

.github/workflows/codeql.yml

@@ -25,18 +25,20 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: /language:${{matrix.language}}

.github/workflows/commit-lint.yml

@@ -41,7 +41,11 @@ jobs:
               '--no-validate-metadata', '--tap', '-',
             ], {
               cwd: process.env.RUNNER_TEMP,
-              input: Buffer.from(JSON.stringify([{ id: commit.sha, message: commit.commit.message }])),
+              input: Buffer.from(JSON.stringify([{
+                id: commit.sha,
+                message: commit.commit.message,
+                author: commit.commit.author,
+              }])),
               silent: true,
               ignoreReturnCode: true,
             });

.github/workflows/commit-queue.yml

@@ -188,6 +188,7 @@ jobs:
           # to be set here because `checkout` configures GitHub authentication
           # for push as well.
           token: ${{ secrets.GH_USER_TOKEN }}
+          persist-credentials: true
 
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''

.github/workflows/notify-on-push.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
@@ -50,7 +50,7 @@ jobs:
           COMMITS: ${{ toJSON(github.event.commits) }}
       - name: Slack Notification
         if: ${{ failure() && steps.commit-check.conclusion == 'failure' && github.repository == 'nodejs/node' }}
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48

.github/workflows/notify-on-review-wanted.yml

@@ -34,7 +34,7 @@ jobs:
           fi
 
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           MSG_MINIMAL: actions url
           SLACK_COLOR: '#3d85c6'

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: results.sarif

BUILDING.md

@@ -776,16 +776,7 @@ Follow <https://github.com/ccache/ccache/wiki/MS-Visual-Studio>, and you
 should notice that obj file will be bigger than the normal one.
 
 First, install ccache. Assuming the installation of ccache is in `c:\ccache`
-(where you can find `ccache.exe`), copy `c:\ccache\ccache.exe` to `c:\ccache\cl.exe`
-with this command.
-
-```powershell
-cp c:\ccache\ccache.exe c:\ccache\cl.exe
-```
-
-With newer version of Visual Studio, it may need the copy to be `clang-cl.exe`
-instead. If the output of `vcbuild.bat` suggests missing `clang-cl.exe`, copy
-it differently:
+(where you can find `ccache.exe`), setup aliases as the following commands:
 
 ```powershell
 cp c:\ccache\ccache.exe c:\ccache\clang-cl.exe
@@ -800,12 +791,6 @@ When building Node.js, provide a path to your ccache via the option:
 This will allow for near-instantaneous rebuilds when switching branches back
 and forth that were built with cache.
 
-To use it with ClangCL, run this instead:
-
-```powershell
-.\vcbuild.bat clang-cl ccache c:\ccache\
-```
-
 ### Android
 
 Android is not a supported platform. Patches to improve the Android build are

GOVERNANCE.md

@@ -12,6 +12,7 @@
   * [Ideal Nominees](#ideal-nominees)
   * [Nominating a new Collaborator](#nominating-a-new-collaborator)
   * [Onboarding](#onboarding)
+  * [Restoring emeritus Collaborators](#restoring-emeritus-collaborators)
 * [Consensus seeking process](#consensus-seeking-process)
 
 <!-- /TOC -->
@@ -68,7 +69,8 @@ See:
 * Merging pull requests
 
 The TSC can remove inactive collaborators or provide them with _emeritus_
-status. Emeriti may request that the TSC restore them to active status.
+status. Emeriti may request that the TSC restore them to active status. See
+[Restoring emeritus Collaborators](#restoring-emeritus-collaborators).
 
 A collaborator is automatically made emeritus (and removed from active
 collaborator status) if it has been more than 12 months since the collaborator
@@ -335,6 +337,29 @@ After the nomination passes, a TSC member onboards the new collaborator. See
 [the onboarding guide](./onboarding.md) for details of the onboarding
 process.
 
+### Restoring emeritus Collaborators
+
+An emeritus collaborator who has resumed contributing may request restoration to
+active status by opening an issue in [the TSC issue tracker][]. The request
+describes their recent contributions and their intent to take on collaborator
+responsibilities again. There is no new nomination and no vote. The request
+stays open for one week, matching the window for a collaborator nomination. If
+no TSC member objects, the request passes.
+
+Before restoring access, a TSC member confirms that the account making the
+request is still under the control of the same person. See
+[The Authenticity of Contributors](#the-authenticity-of-contributors).
+
+After the request passes, a TSC member re-onboards the returning collaborator,
+reversing the applicable
+[offboarding tasks](./doc/contributing/offboarding.md). As in
+[the onboarding guide][], the returning collaborator authors the pull request
+moving themselves from the emeriti list back to the active list in the README.
+That restarts the activity clock the [inactive collaborator workflow][] measures.
+
+An emeritus TSC member returning as a collaborator rejoins the TSC through a TSC
+motion under [Section 3 of the TSC Charter][TSC Charter].
+
 ## Consensus seeking process
 
 The TSC follows a [Consensus Seeking][] decision-making model per the
@@ -343,5 +368,8 @@ The TSC follows a [Consensus Seeking][] decision-making model per the
 [Consensus Seeking]: https://en.wikipedia.org/wiki/Consensus-seeking_decision-making
 [TSC Charter]: https://github.com/nodejs/TSC/blob/HEAD/TSC-Charter.md
 [discussion in the nodejs/collaborators]: https://github.com/nodejs/collaborators/discussions/categories/collaborator-nominations
+[inactive collaborator workflow]: https://github.com/nodejs/node/blob/HEAD/.github/workflows/find-inactive-collaborators.yml
 [nodejs/help]: https://github.com/nodejs/help
 [nodejs/node]: https://github.com/nodejs/node
+[the TSC issue tracker]: https://github.com/nodejs/TSC/issues
+[the onboarding guide]: ./onboarding.md#exercise-make-a-pull-request-adding-yourself-to-the-readme

README.md

@@ -285,6 +285,8 @@ For information about the governance of the Node.js project, see
   **Antoine du Hamel** <<duhamelantoine1995@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/aduh95)
 * [anonrig](https://github.com/anonrig) -
   **Yagiz Nizipli** <<yagiz@nizipli.com>> (he/him) - [Support me](https://github.com/sponsors/anonrig)
+* [araujogui](https://github.com/araujogui) -
+  **Guilherme Araújo** <<arauujogui@gmail.com>> (he/him)
 * [atlowChemi](https://github.com/atlowChemi) -
   **Chemi Atlow** <<chemi@atlow.co.il>> (he/him)
 * [avivkeller](https://github.com/avivkeller) -
@@ -761,6 +763,8 @@ maintaining the Node.js project.
   **Wiyeong Seo** <<hbsps.dev@gmail.com>>
 * [iam-frankqiu](https://github.com/iam-frankqiu) -
   **Frank Qiu** <<iam.frankqiu@gmail.com>> (he/him)
+* [inoway46](https://github.com/inoway46) -
+  **Yuya Inoue** <<inoueyuya416@gmail.com>> (he/him)
 * [milesguicent](https://github.com/milesguicent) -
   **Miles Guicent** <<guicent@pm.me>> (he/him)
 * [preveen-stack](https://github.com/preveen-stack) -

SECURITY.md

@@ -500,7 +500,15 @@ The following are **not** vulnerabilities in Node.js:
 * **Operator-controlled flags**: Behavior unlocked by flags the operator
   explicitly passes (e.g., `--localstorage-file`) is the operator's
   responsibility. The permission model does not restrict how Node.js behaves
-  when the operator intentionally configures it.
+  when the operator intentionally configures it. This includes any file or
+  resource that Node.js itself creates, writes, or reads at a location the
+  operator selected through a flag, including every path derived from a
+  template or pattern in that flag. For example, trace files rotated by
+  `--trace-event-file-pattern` (`${rotation}`) being written without a
+  matching `--allow-fs-write` entry is not a permission model bypass. Such
+  paths are part of the operator's configuration, not application file-system
+  access. Inconsistent checks on these paths are treated as regular bugs and
+  should be reported through the public issue tracker.
 
 * **`node:sqlite` and the permission model**: `DatabaseSync` operates with the
   same file-system privileges as the process. Using SQL pragmas or built-in