fix: close review issues #6-#13 on 3.4.0 - #25695
Merged
Merged
Conversation
Rebase the OPEN review follow-ups onto live upstream master (c0f78a1, 3.4.0) so Stream drain/backpressure from msgpack#43 is kept. Pin nan 2.28.0 and c8 12.0.0; CI uses npm ci on Node 22/24 with full-SHA GitHub Actions. engines.node is >=22. Cap Stream receive before allocate and drop buf on close/end/error. Re-emit underlying socket errors when the Stream is not already dead so a socket 'error' is not swallowed by the listener. Apply kMaxContainer to pack array/map walks. Cap CLI stdin concat at MAX_STDIN_BYTES. Document a risk-based bump window in SECURITY.md.
InitLazy still calls ObjectTemplate::SetIndexedPropertyHandler, which Node 24 V8 headers no longer provide. Parent never tested 24. engines.node is ^22 so 24 is not advertised. CI matrix is [22] only.
Snapshot Length() once, throw when n > 1e6, and iterate the frozen n so interpret cannot walk a sparse array past the PackArray policy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebase of the OPEN review follow-ups onto live upstream master (
c0f78a1, 3.4.0).The earlier fork PR (#14 on enochgroot/msgpack-node) was based on a stale 2.0 line, so Stream drain/backpressure from #43 would have been dropped. This branch's first commit parent is
c0f78a1.Fixes
nan2.28.0 andc812.0.0; CI usesnpm cion Node 22 with full-SHA Actionsengines.nodeis^22(Node 24 is not advertised: lazy unpack still usesSetIndexedPropertyHandler, which Node 24 V8 removed)MAX_STREAM_BYTES); dropbufon close/end/errorerroris no longer swallowed)kMaxContainerto pack array/map walks (Lengthfreeze)MAX_STDIN_BYTESVerification
npm test: 240 pass, 0 failLengthtests all fail when the matching guard is removed, then restoredFixes #25696
Fixes #25697
Fixes #25698
Fixes #25699
Fixes #25700
Fixes #25701
Fixes #25702
Fixes #25703