@node-core/utils 6.3.2 → 6.4.0

package/lib/cli.js

@@ -94,6 +94,14 @@ export default class CLI {
     return answer;
   }
 
+  async promptCheckbox(message, choices) {
+    if (this.assumeYes) {
+      return choices.filter((c) => c.checked).map((c) => c.value);
+    }
+
+    return inquirer.checkbox({ message, choices });
+  }
+
   setAssumeYes() {
     this.assumeYes = true;
   }

package/lib/landing_session.js

@@ -316,40 +316,49 @@ export default class LandingSession extends Session {
 
     // git has very specific rules about what is a trailer and what is not.
     // Instead of trying to implement those ourselves, let git parse the
-    // original commit message and see if it outputs any trailers.
-    const originalTrailers = runSync('git', [
+    // commit message and see if it outputs any trailers.
+    const interpretTrailers = commitMessage => runSync('git', [
       'interpret-trailers', '--parse', '--no-divider'
     ], {
-      input: `${original}\n`
-    }).split('\n').map(trailer => {
-      const separatorIndex = trailer.indexOf(':');
-      return [trailer.slice(0, separatorIndex), trailer.slice(separatorIndex + 2)];
-    }).slice(0, -1); // Remove the last line return entry
+      input: `${commitMessage}\n`
+    });
 
+    const originalTrailers = interpretTrailers(original);
     const containCVETrailer = CVE_RE.test(originalTrailers);
 
-    const filterTrailer = (line) => ([key]) =>
-      line.startsWith(key) &&
-          new RegExp(`^${RegExp.escape?.(key) ?? key}\\s*:`).test(line);
-    const amended = original.trim().split('\n')
-      .filter(line =>
-        !line.includes(':') ||
-        !originalTrailers.some(filterTrailer(line)));
-    for (let i = amended.length - 1; amended[i] === ''; i--) {
-      amended.pop();
-    }
+    const amended = original.trim().split('\n');
+    let keptTrailers = [];
+    if (originalTrailers) {
+      const stillInTrailers = () => {
+        const result = interpretTrailers(amended.join('\n'));
+        return result.length && originalTrailers.startsWith(result.trim());
+      };
+      // Remove all lines until we find an empty string, which should get of all
+      // trailers in most cases.
+      amended.splice(amended.lastIndexOf(''), Infinity);
+      for (let i = amended.length - 1; amended[i] === '' || stillInTrailers(); i--) {
+        // Remove last line until git no longer detects any trailers
+        amended.pop();
+      }
 
-    // Only keep existing trailers that we won't add ourselves
-    const trailersToFilterOut = ['BACKPORT-PR-URL', 'REVIEWED-BY'];
-    if (!this.backport) trailersToFilterOut.push('PR-URL');
-    const keptTrailers = originalTrailers.filter(
-      ([key]) => !trailersToFilterOut.includes(key.toUpperCase())
-    );
+      // Only keep existing trailers that we won't add ourselves
+      const trailersToFilterOut = ['BACKPORT-PR-URL', 'REVIEWED-BY'];
+      if (!this.backport) trailersToFilterOut.push('PR-URL');
+      keptTrailers = originalTrailers
+        .split('\n')
+        .map(trailer => {
+          const separatorIndex = trailer.indexOf(':');
+          return [trailer.slice(0, separatorIndex), trailer.slice(separatorIndex + 2)];
+        })
+        .slice(0, -1) // Remove the last line return entry
+        .filter(
+          ([key]) => !trailersToFilterOut.includes(key.toUpperCase())
+        );
+    }
     amended.push('', ...keptTrailers.map(([key, value]) => `${key}: ${value}`));
 
     for (const line of metadata.trim().split('\n')) {
-      const foundMatchingTrailer = keptTrailers.find(filterTrailer(line));
-      if (foundMatchingTrailer && line === foundMatchingTrailer.join(': ')) {
+      if (keptTrailers.some((trailer) => line.toUpperCase() === trailer.join(': ').toUpperCase())) {
         cli.warn(`Found ${line}, skipping..`);
         continue;
       }

package/lib/prepare_security.js

@@ -10,11 +10,19 @@ import {
   validateDate,
   promptDependencies,
   getSupportedVersions,
+  getReportSeverity,
   pickReport,
   SecurityRelease
 } from './security-release/security-release.js';
 import _ from 'lodash';
 
+function relativeDate(date) {
+  const days = Math.floor((Date.now() - date) / (1000 * 60 * 60 * 24));
+  if (days < 30) return days === 1 ? '1 day ago' : `${days} days ago`;
+  const months = Math.floor(days / 30);
+  return months === 1 ? '1 month ago' : `${months} months ago`;
+}
+
 export default class PrepareSecurityRelease extends SecurityRelease {
   title = 'Next Security Release';
 
@@ -25,6 +33,13 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     });
 
     this.req = new Request(credentials);
+
+    let excludedReports = [];
+    const showTriaged = await this.promptShowTriagedWithoutPR();
+    if (showTriaged) {
+      excludedReports = await this.showTriagedReportsWithoutPR();
+    }
+
     const releaseDate = await this.promptReleaseDate();
     if (releaseDate !== 'TBD') {
       validateDate(releaseDate);
@@ -34,7 +49,8 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     let securityReleasePRUrl;
     const content = await this.buildDescription(releaseDate, securityReleasePRUrl);
     if (createVulnerabilitiesJSON) {
-      securityReleasePRUrl = await this.startVulnerabilitiesJSONCreation(releaseDate, content);
+      securityReleasePRUrl = await this.startVulnerabilitiesJSONCreation(
+        releaseDate, content, excludedReports);
     }
 
     this.cli.ok('Done!');
@@ -93,12 +109,12 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     this.cli.ok('Done!');
   }
 
-  async startVulnerabilitiesJSONCreation(releaseDate, content) {
+  async startVulnerabilitiesJSONCreation(releaseDate, content, excludedReports = []) {
     // checkout on the next-security-release branch
     checkoutOnSecurityReleaseBranch(this.cli, this.repository);
 
     // choose the reports to include in the security release
-    const reports = await this.chooseReports();
+    const reports = await this.chooseReports(excludedReports);
     const depUpdates = await this.getDependencyUpdates();
     const deps = _.groupBy(depUpdates, 'name');
 
@@ -184,17 +200,61 @@ export default class PrepareSecurityRelease extends SecurityRelease {
       { defaultAnswer: true });
   }
 
+  async promptShowTriagedWithoutPR() {
+    return this.cli.prompt(
+      'Do you want to see which reports are triaged but have no PR URL?',
+      { defaultAnswer: true });
+  }
+
+  async showTriagedReportsWithoutPR() {
+    this.cli.info('Fetching triaged reports without PR URL...');
+    const reports = await this.req.getTriagedReports();
+    const reportsWithoutPR = reports.data.filter(
+      (report) => !report.relationships.custom_field_values.data.length
+    );
+    if (!reportsWithoutPR.length) {
+      this.cli.ok('All triaged reports have a PR URL.');
+      return [];
+    }
+    const severityRank = { critical: 0, high: 1, medium: 2, low: 3 };
+    const choices = reportsWithoutPR
+      .sort((a, b) => {
+        const dateA = new Date(a.attributes.created_at);
+        const dateB = new Date(b.attributes.created_at);
+        if (dateB - dateA !== 0) return dateB - dateA;
+        const rankA = severityRank[getReportSeverity(a).rating] ?? 4;
+        const rankB = severityRank[getReportSeverity(b).rating] ?? 4;
+        return rankA - rankB;
+      })
+      .map((report) => {
+        const { id, attributes: { title, created_at } } = report;
+        const { rating } = getReportSeverity(report);
+        const openedDate = relativeDate(new Date(created_at));
+        const link = `https://hackerone.com/reports/${id}`;
+        return {
+          name: `[${openedDate}] (${rating}) ${title} - ${link}`,
+          value: id,
+          checked: true
+        };
+      });
+    return this.cli.promptCheckbox(
+      'Select reports to exclude from the upcoming security release:',
+      choices
+    );
+  }
+
   async buildDescription() {
     const template = await this.getSecurityIssueTemplate();
     return template;
   }
 
-  async chooseReports() {
+  async chooseReports(excludedReports = []) {
     this.cli.info('Getting triaged H1 reports...');
     const reports = await this.req.getTriagedReports();
     const selectedReports = [];
 
     for (const report of reports.data) {
+      if (excludedReports.includes(report.id)) continue;
       const rep = await pickReport(report, { cli: this.cli, req: this.req });
       if (!rep) continue;
       selectedReports.push(rep);

package/lib/update-v8/constants.js

@@ -47,6 +47,14 @@ const highwayIgnore = `/third_party/highway/src/*
 const dragonboxIgnore = `/third_party/dragonbox/src/*
 !/third_party/dragonbox/src/include`;
 
+const llvmLibcIgnore = `/third_party/llvm-libc/src/*
+!/third_party/llvm-libc/src/hdr
+!/third_party/llvm-libc/src/include
+!/third_party/llvm-libc/src/shared
+!/third_party/llvm-libc/src/src
+/third_party/llvm-libc/src/src/*
+!/third_party/llvm-libc/src/src/__support`;
+
 export const v8Deps = [
   {
     name: 'trace_event',
@@ -146,4 +154,13 @@ export const v8Deps = [
     },
     since: 138
   },
+  {
+    name: 'llvm-libc',
+    repo: 'third_party/llvm-libc/src',
+    gitignore: {
+      match: '/third_party/llvm-libc/src',
+      replace: llvmLibcIgnore
+    },
+    since: 150
+  },
 ];