@node-core/utils 6.3.3 → 7.0.0

package/lib/security_blog.js

@@ -1,6 +1,5 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import _ from 'lodash';
 import nv from '@pkgjs/nv';
 import {
   PLACEHOLDERS,
@@ -8,10 +7,16 @@ import {
   validateDate,
   SecurityRelease,
   commitAndPushVulnerabilitiesJSON,
+  getAffectedVersionLines,
+  getDependencyUpdates,
+  getHighestSeverityAnnouncement,
+  writeSecurityFile,
 } from './security-release/security-release.js';
 import auth from './auth.js';
 import Request from './request.js';
 
+const SEVERITY_ORDER = ['critical', 'high', 'medium', 'low'];
+
 export default class SecurityBlog extends SecurityRelease {
   req;
 
@@ -19,15 +24,14 @@ export default class SecurityBlog extends SecurityRelease {
     const { cli } = this;
 
     // checkout on security release branch
-    checkoutOnSecurityReleaseBranch(cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(cli, this.repository);
 
     // read vulnerabilities JSON file
     const content = this.readVulnerabilitiesJSON();
     // validate the release date read from vulnerabilities JSON
     if (!content.releaseDate) {
-      cli.error('Release date is not set in vulnerabilities.json,' +
+      throw new Error('Release date is not set in vulnerabilities.json,' +
         ' run `git node security --update-date=YYYY/MM/DD` to set the release date.');
-      process.exit(1);
     }
 
     validateDate(content.releaseDate);
@@ -38,7 +42,7 @@ export default class SecurityBlog extends SecurityRelease {
       annoucementDate: await this.getAnnouncementDate(cli),
       releaseDate: this.formatReleaseDate(releaseDate),
       affectedVersions: this.getAffectedVersions(content),
-      vulnerabilities: this.getVulnerabilities(content),
+      vulnerabilities: this.getPreReleaseVulnerabilities(content),
       slug: this.getSlug(releaseDate),
       impact: this.getImpact(content)
     };
@@ -58,14 +62,19 @@ export default class SecurityBlog extends SecurityRelease {
     endDate.setDate(endDate.getDate() + 7);
 
     const link = `https://nodejs.org/en/blog/vulnerability/${fileName}`;
-    this.updateWebsiteBanner(site, {
+    await this.updateWebsiteBanner(site, {
       startDate: data.annoucementDate,
       endDate: endDate.toISOString(),
       text: `New security releases to be made available ${data.releaseDate}`,
       link,
       type: 'warning'
     });
-    fs.writeFileSync(file, preRelease);
+    await writeSecurityFile(
+      cli,
+      file,
+      preRelease,
+      'This writes the pre-release vulnerability announcement post.'
+    );
 
     cli.ok(`Announcement file created and banner has been updated. Folder: ${nodejsOrgFolder}`);
     await this.updateAnnouncementLink(link);
@@ -74,23 +83,23 @@ export default class SecurityBlog extends SecurityRelease {
   async updateAnnouncementLink(link) {
     const vulnerabilitiesJSONPath = this.getVulnerabilitiesJSONPath();
     const content = this.readVulnerabilitiesJSON(vulnerabilitiesJSONPath);
-    let shouldCommit = false;
-    for (let i = 0; i < content.reports.length; ++i) {
-      if (content.reports[i].announcement !== link) {
-        content.reports[i].announcement = link;
-        shouldCommit = true;
-      }
-    };
 
-    if (shouldCommit) {
-      fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
-      const commitMessage = 'chore: add announcement link';
-      commitAndPushVulnerabilitiesJSON([vulnerabilitiesJSONPath],
-        commitMessage, { cli: this.cli, repository: this.repository });
-
-      this.cli.ok('Updated the announcement link in vulnerabilities.json');
+    if (content.announcement === link) {
+      return [vulnerabilitiesJSONPath];
     }
 
+    content.announcement = link;
+    await writeSecurityFile(
+      this.cli,
+      vulnerabilitiesJSONPath,
+      JSON.stringify(content, null, 2),
+      'This writes the announcement link to vulnerabilities.json.'
+    );
+    const commitMessage = 'chore: add announcement link';
+    await commitAndPushVulnerabilitiesJSON([vulnerabilitiesJSONPath],
+      commitMessage, { cli: this.cli, repository: this.repository });
+
+    this.cli.ok('Updated the announcement link in vulnerabilities.json');
     return [vulnerabilitiesJSONPath];
   }
 
@@ -104,14 +113,13 @@ export default class SecurityBlog extends SecurityRelease {
     this.req = new Request(credentials);
 
     // checkout on security release branch
-    checkoutOnSecurityReleaseBranch(cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(cli, this.repository);
 
     // read vulnerabilities JSON file
     const content = this.readVulnerabilitiesJSON();
     if (!content.releaseDate) {
-      cli.error('Release date is not set in vulnerabilities.json,' +
+      throw new Error('Release date is not set in vulnerabilities.json,' +
         ' run `git node security --update-date=YYYY/MM/DD` to set the release date.');
-      process.exit(1);
     }
 
     validateDate(content.releaseDate);
@@ -133,8 +141,7 @@ export default class SecurityBlog extends SecurityRelease {
     const preReleasePath = path.resolve(pathToBlogPosts, data.slug + '.md');
     let preReleaseContent = this.findExistingPreRelease(preReleasePath);
     if (!preReleaseContent) {
-      cli.error(`Existing pre-release not found! Path: ${preReleasePath} `);
-      process.exit(1);
+      throw new Error(`Existing pre-release not found! Path: ${preReleasePath} `);
     }
 
     const postReleaseContent = await this.buildPostRelease(template, data, content);
@@ -150,13 +157,18 @@ export default class SecurityBlog extends SecurityRelease {
     const month = releaseDate.toLocaleString('en-US', { month: 'long' });
     const capitalizedMonth = month[0].toUpperCase() + month.slice(1);
 
-    this.updateWebsiteBanner(pathToBannerJson, {
+    await this.updateWebsiteBanner(pathToBannerJson, {
       startDate: releaseDate,
       endDate,
       text: `${capitalizedMonth} Security Release is available`
     });
 
-    fs.writeFileSync(preReleasePath, updatedContent);
+    await writeSecurityFile(
+      cli,
+      preReleasePath,
+      updatedContent,
+      'This writes the post-release vulnerability announcement post.'
+    );
     cli.ok(`Announcement file and banner has been updated. Folder: ${nodejsOrgFolder}`);
   }
 
@@ -176,7 +188,7 @@ export default class SecurityBlog extends SecurityRelease {
     });
   }
 
-  updateWebsiteBanner(siteJsonPath, content) {
+  async updateWebsiteBanner(siteJsonPath, content) {
     const siteJson = JSON.parse(fs.readFileSync(siteJsonPath));
 
     const currentValue = siteJson.websiteBanners.index;
@@ -187,7 +199,12 @@ export default class SecurityBlog extends SecurityRelease {
       link: content.link ?? currentValue.link,
       type: content.type ?? currentValue.type
     };
-    fs.writeFileSync(siteJsonPath, JSON.stringify(siteJson, null, 2) + '\n');
+    await writeSecurityFile(
+      this.cli,
+      siteJsonPath,
+      JSON.stringify(siteJson, null, 2) + '\n',
+      'This writes the updated security release website banner.'
+    );
   }
 
   formatReleaseDate(releaseDate) {
@@ -242,28 +259,26 @@ export default class SecurityBlog extends SecurityRelease {
   }
 
   async getReportsTemplate(content) {
-    const reports = content.reports;
+    const reports = [...content.reports].sort((a, b) =>
+      this.getSeverityOrder(a) - this.getSeverityOrder(b));
     let template = '';
     for (const report of reports) {
       const cveId = report.cveIds?.join(', ');
       if (!cveId) {
-        this.cli.error(`CVE ID for vulnerability ${report.link} ${report.title} not found`);
-        process.exit(1);
+        throw new Error(`CVE ID for vulnerability ${report.link} ${report.title} not found`);
       }
       template += `## ${report.title} (${cveId}) - (${report.severity.rating})\n\n`;
       if (!report.summary) {
-        this.cli.error(`Summary missing for vulnerability ${report.link} ` +
+        throw new Error(`Summary missing for vulnerability ${report.link} ` +
         `${report.title}. Please create it before continuing.`);
-        process.exit(1);
       }
 
       template += `${report.summary}\n\n`;
-      const releaseLines = report.affectedVersions.join(', ');
+      const releaseLines = getAffectedVersionLines(report.affectedVersions).join(', ');
       template += `Impact:\n\n- This vulnerability affects all users\
  in active release lines: ${releaseLines}\n\n`;
       if (!report.patchAuthors) {
-        this.cli.error(`Missing patch author for vulnerability ${report.link} ${report.title}`);
-        process.exit(1);
+        throw new Error(`Missing patch author for vulnerability ${report.link} ${report.title}`);
       }
       template += `Thank you, to ${report.reporter} for reporting this vulnerability\
  and thank you ${report.patchAuthors.join(' and ')} for fixing it.\n\n`;
@@ -271,17 +286,58 @@ export default class SecurityBlog extends SecurityRelease {
     return template;
   }
 
+  getSeverityOrder(report) {
+    const rating = report.severity?.rating?.toLowerCase();
+    const index = SEVERITY_ORDER.indexOf(rating);
+    if (index === -1) return SEVERITY_ORDER.length;
+    return index;
+  }
+
   getDependencyUpdatesTemplate(dependencyUpdates) {
-    if (typeof dependencyUpdates !== 'object') return '';
-    if (Object.keys(dependencyUpdates).length === 0) return '';
+    const updates = getDependencyUpdates(dependencyUpdates);
+    if (updates.length === 0) return '';
     let template = '\nThis security release includes the following dependency' +
       ' updates to address public vulnerabilities:\n';
-    for (const [dependency, { versions, affectedVersions }] of Object.entries(dependencyUpdates)) {
-      template += `- ${dependency} (${versions.join(', ')}) on ${affectedVersions.join(', ')}\n`;
+    for (const update of updates) {
+      const title = this.formatDependencyUpdateTitle(update) || update.name;
+      const releaseLines = getAffectedVersionLines(update.affectedVersions);
+      const formattedVersions = this.formatDependencyVersions(update.versions);
+      const versionText = formattedVersions ? ` (${formattedVersions})` : '';
+      template += `- ${title}${versionText} on ${releaseLines.join(', ')}\n`;
     }
     return template;
   }
 
+  formatDependencyUpdateVersion(version) {
+    if (typeof version === 'string' || typeof version === 'number') {
+      return String(version);
+    }
+
+    if (!version || typeof version !== 'object') return '';
+
+    return version.version || version.to || version.patched || version.name ||
+      this.formatDependencyUpdateTitle(version) || version.url || JSON.stringify(version);
+  }
+
+  formatDependencyVersions(versions) {
+    if (!Array.isArray(versions)) return '';
+    // The current schema carries one entry per release line, so the same
+    // version repeats when every line gets the same update.
+    return [...new Set(versions
+      .map((version) => this.formatDependencyUpdateVersion(version))
+      .filter(Boolean))]
+      .join(', ');
+  }
+
+  formatDependencyUpdateTitle(dependency) {
+    if (!dependency || typeof dependency !== 'object') return '';
+    if (!dependency.title) return dependency.name ?? '';
+
+    const titleSeparator = dependency.title.indexOf(':');
+    if (titleSeparator === -1) return dependency.title;
+    return dependency.title.substring(titleSeparator + ':'.length).trim();
+  }
+
   async getDownloadsTemplate(affectedVersions) {
     let template = '';
     const versionsToBeReleased = (await nv('supported')).filter(
@@ -306,7 +362,7 @@ export default class SecurityBlog extends SecurityRelease {
       const date = await this.promptAnnouncementDate(cli);
       validateDate(date);
       return new Date(date).toISOString();
-    } catch (error) {
+    } catch {
       return PLACEHOLDERS.annoucementDate;
     }
   }
@@ -323,7 +379,11 @@ export default class SecurityBlog extends SecurityRelease {
   getImpact(content) {
     const impact = new Map();
     for (const report of content.reports) {
-      for (const version of report.affectedVersions) {
+      if (!report.severity?.rating) {
+        throw new Error(`severity.rating not found for report ${report.id}.`);
+      }
+
+      for (const version of getAffectedVersionLines(report.affectedVersions)) {
         if (!impact.has(version)) impact.set(version, []);
         impact.get(version).push(report);
       }
@@ -331,38 +391,43 @@ export default class SecurityBlog extends SecurityRelease {
 
     const result = Array.from(impact.entries())
       .sort(([a], [b]) => b.localeCompare(a)) // DESC
-      .map(([version, reports]) => {
-        const severityCount = new Map();
-
-        for (const report of reports) {
-          const rating = report.severity.rating?.toLowerCase();
-          if (!rating) {
-            this.cli.error(`severity.rating not found for report ${report.id}.`);
-            process.exit(1);
-          }
-          severityCount.set(rating, (severityCount.get(rating) || 0) + 1);
-        }
-
-        const groupedByRating = Array.from(severityCount.entries())
-          .map(([rating, count]) => `${count} ${rating} severity issues`)
-          .join(', ');
-
-        return `The ${version} release line of Node.js is vulnerable to ${groupedByRating}.`;
-      })
+      .map(([version, reports]) =>
+        getHighestSeverityAnnouncement(reports, `the ${version} release line`))
       .join('\n');
 
     return result;
   }
 
   getVulnerabilities(content) {
-    const grouped = _.groupBy(content.reports, 'severity.rating');
+    const severityCount = new Map();
+
+    for (const report of content.reports) {
+      if (!report.severity?.rating) {
+        throw new Error(`severity.rating not found for report ${report.id}.`);
+      }
+
+      const rating = report.severity.rating;
+      severityCount.set(rating, (severityCount.get(rating) || 0) + 1);
+    }
+
     const text = [];
-    for (const [key, value] of Object.entries(grouped)) {
-      text.push(`- ${value.length} ${key.toLocaleLowerCase()} severity issues.`);
+    for (const [rating, count] of severityCount) {
+      text.push(`- ${count} ${rating} severity issues.`);
     }
+
     return text.join('\n');
   }
 
+  getPreReleaseVulnerabilities(content) {
+    for (const report of content.reports) {
+      if (!report.severity?.rating) {
+        throw new Error(`severity.rating not found for report ${report.id}.`);
+      }
+    }
+
+    return getHighestSeverityAnnouncement(content.reports);
+  }
+
   getSecurityPreReleaseTemplate() {
     return fs.readFileSync(
       new URL(

package/lib/session.js

@@ -160,7 +160,7 @@ export default class Session {
     let sess;
     try {
       sess = this.session;
-    } catch (err) {
+    } catch {
       return fs.rmSync(this.sessionPath, { recursive: true, force: true });
     }
 
@@ -345,8 +345,9 @@ export default class Session {
   }
 
   getStrayCommits(verbose) {
-    const { upstream, branch } = this;
-    const ref = `${upstream}/${branch}...HEAD`;
+    const { upstream, branch, cli } = this;
+    const base = cli.hasDetachedHEAD || `${upstream}/${branch}`;
+    const ref = `${base}...HEAD`;
     const gitCmd = verbose
       ? ['log', '--oneline', '--reverse', ref]
       : ['rev-list', '--reverse', ref];

package/lib/team_info.js

@@ -76,7 +76,7 @@ TeamInfo.update = async function(cli, request, content) {
       const opening = `<!-- ncu-team-sync.team(${org}/${team}) -->`;
       const ending = '<!-- ncu-team-sync end -->';
       blocks.set(mapKey, `${opening}\n\n${teamData}\n\n${ending}`);
-    };
+    }
   }
 
   if (blocks.size === 0) {

package/lib/update-v8/applyNodeChanges.js

@@ -1,7 +1,6 @@
 import path from 'node:path';
 
 import {
-  getNodeV8Version,
   filterForVersion,
   replaceGitignore,
   removeDirectory
@@ -18,8 +17,7 @@ export default function applyNodeChanges() {
   return {
     title: 'Apply Node-specific changes',
     task: async(ctx, task) => {
-      const v8Version = await getNodeV8Version(ctx.nodeDir);
-      const list = filterForVersion(nodeChanges, v8Version);
+      const list = filterForVersion(nodeChanges, ctx.newVersion);
       return task.newListr(list.map((change) => change.task()));
     }
   };

package/lib/update-v8/backport.js

@@ -8,7 +8,7 @@ import { ListrEnquirerPromptAdapter } from '@listr2/prompt-adapter-enquirer';
 
 import { shortSha } from '../utils.js';
 
-import { getCurrentV8Version } from './common.js';
+import { getV8Version } from './common.js';
 import { forceRunAsync } from '../run.js';
 
 export async function checkOptions(options) {
@@ -24,11 +24,11 @@ export async function checkOptions(options) {
       return true;
     }
   }
-};
+}
 
 export function doBackport(options) {
   const todo = [
-    getCurrentV8Version(),
+    getV8Version('current'),
     generatePatches()
   ];
 
@@ -54,7 +54,7 @@ export function doBackport(options) {
       return task.newListr(todo);
     }
   };
-};
+}
 
 function commitSquashedBackport() {
   return {
@@ -77,7 +77,7 @@ function commitSquashedBackport() {
       await ctx.execGitNode('commit', ['-m', messageTitle, '-m', messageBody]);
     }
   };
-};
+}
 
 const commitTask = (patch, extraArgs, trailers) => async(ctx) => {
   const messageTitle = formatMessageTitle([patch]);
@@ -261,7 +261,7 @@ async function applyPatch(ctx, task, patch, method = 'apply') {
       ['-p1', '--3way', '--directory=deps/v8'],
       patch.data /* input */
     );
-  } catch (e) {
+  } catch {
     patch.hadConflicts = true;
     return task.prompt(ListrEnquirerPromptAdapter).run({
       type: 'input',

package/lib/update-v8/commitUpdate.js

@@ -1,10 +1,7 @@
-import { getNodeV8Version } from './util.js';
-
 export default function commitUpdate() {
   return {
     title: 'Commit V8 update',
     task: async(ctx) => {
-      const newV8Version = await getNodeV8Version(ctx.nodeDir);
       await ctx.execGitNode('add', ['deps/v8']);
       const moreArgs = [];
       let message;
@@ -15,12 +12,12 @@ export default function commitUpdate() {
           '-m',
           `Refs: https://github.com/v8/v8/compare/${prev}...${next}`
         );
-        message = `deps: patch V8 to ${newV8Version}`;
+        message = `deps: patch V8 to ${ctx.newVersion}`;
       } else {
-        message = `deps: update V8 to ${newV8Version}`;
+        message = `deps: update V8 to ${ctx.newVersion}`;
       }
       await ctx.execGitNode('commit', ['-m', message, ...moreArgs]);
     },
     skip: (ctx) => ctx.skipped
   };
-};
+}

package/lib/update-v8/common.js

@@ -1,16 +1,39 @@
+import assert from 'node:assert';
 import path from 'node:path';
 import { promises as fs } from 'node:fs';
 
 import { getNodeV8Version } from './util.js';
+import { forceRunAsync } from '../run.js';
 
-export function getCurrentV8Version() {
+export function getV8Version(label) {
   return {
-    title: 'Get current V8 version',
+    title: `Get ${label} V8 version`,
     task: async(ctx) => {
-      ctx.currentVersion = await getNodeV8Version(ctx.nodeDir);
+      ctx[`${label}Version`] = await getNodeV8Version(ctx.nodeDir);
     }
   };
-};
+}
+
+export function checkCargoAvailable() {
+  return {
+    title: 'Check Cargo exists in environment',
+    task: async(ctx) => {
+      try {
+        const output = await forceRunAsync(ctx.cargo, ['--version'], {
+          ignoreFailure: false,
+          captureStdout: true,
+        });
+        assert(output.startsWith('cargo'));
+      } catch (cause) {
+        let error = 'Unable to determine cargo version.';
+        if (ctx.cargo === 'cargo') {
+          error += '\nYou may need to specify the path to your cargo binary with `--cargo`.';
+        }
+        throw new Error(error, { cause });
+      }
+    }
+  };
+}
 
 export async function checkCwd(ctx) {
   let isNode = false;
@@ -23,7 +46,7 @@ export async function checkCwd(ctx) {
       isNode = true;
       ctx.nodeMajorVersion = parseInt(match[1], 10);
     }
-  } catch (e) {
+  } catch {
     // ignore
   }
   if (!isNode) {
@@ -32,4 +55,5 @@ export async function checkCwd(ctx) {
       `node-dir: ${ctx.nodeDir}`
     );
   }
-};
+  return ctx;
+}

package/lib/update-v8/constants.js

@@ -47,6 +47,14 @@ const highwayIgnore = `/third_party/highway/src/*
 const dragonboxIgnore = `/third_party/dragonbox/src/*
 !/third_party/dragonbox/src/include`;
 
+const llvmLibcIgnore = `/third_party/llvm-libc/src/*
+!/third_party/llvm-libc/src/hdr
+!/third_party/llvm-libc/src/include
+!/third_party/llvm-libc/src/shared
+!/third_party/llvm-libc/src/src
+/third_party/llvm-libc/src/src/*
+!/third_party/llvm-libc/src/src/__support`;
+
 export const v8Deps = [
   {
     name: 'trace_event',
@@ -146,4 +154,18 @@ export const v8Deps = [
     },
     since: 138
   },
+  {
+    name: 'rust',
+    repo: 'third_party/rust',
+    since: 139
+  },
+  {
+    name: 'llvm-libc',
+    repo: 'third_party/llvm-libc/src',
+    gitignore: {
+      match: '/third_party/llvm-libc/src',
+      replace: llvmLibcIgnore
+    },
+    since: 150
+  },
 ];

package/lib/update-v8/deps.js

@@ -6,7 +6,6 @@ import { forceRunAsync } from '../run.js';
 import {
   addToGitignore,
   filterForVersion,
-  getNodeV8Version,
   removeDirectory,
   replaceGitignore,
 } from './util.js';
@@ -54,13 +53,12 @@ export default function updateV8Deps() {
   return {
     title: 'Update V8 DEPS',
     task: async(ctx, task) => {
-      const newV8Version = await getNodeV8Version(ctx.nodeDir);
-      const repoPrefix = newV8Version.majorMinor >= 86 ? '' : 'v8/';
+      const repoPrefix = ctx.newVersion.majorMinor >= 86 ? '' : 'v8/';
       const deps = filterForVersion(v8Deps.map((v8Dep) => ({
         ...v8Dep,
         repo: `${repoPrefix}${v8Dep.repo}`,
         path: v8Dep.repo
-      })), newV8Version);
+      })), ctx.newVersion);
       if (deps.length === 0) return;
       const depsTable = await readDeps(ctx.nodeDir);
       const subtasks = [];
@@ -85,4 +83,4 @@ export default function updateV8Deps() {
       return task.newListr(subtasks, { concurrent: ctx.concurrent });
     }
   };
-};
+}

package/lib/update-v8/index.js

@@ -1,20 +1,29 @@
 import { Listr } from 'listr2';
 
+import { checkCargoAvailable } from './common.js';
 import { checkOptions, doBackport } from './backport.js';
 import updateVersionNumbers from './updateVersionNumbers.js';
 import commitUpdate from './commitUpdate.js';
 import majorUpdate from './majorUpdate.js';
 import minorUpdate from './minorUpdate.js';
 import updateDeps from './deps.js';
+import updateCrates from './updateCrates.js';
 import updateV8Clone from './updateV8Clone.js';
 
 export function major(options) {
   const tasks = new Listr(
-    [updateV8Clone(), majorUpdate(), commitUpdate(), updateVersionNumbers()],
+    [
+      checkCargoAvailable(),
+      updateV8Clone(),
+      majorUpdate(),
+      commitUpdate(),
+      updateCrates(),
+      updateVersionNumbers()
+    ],
     getOptions(options)
   );
   return tasks.run(options);
-};
+}
 
 export function minor(options) {
   const tasks = new Listr(
@@ -22,7 +31,7 @@ export function minor(options) {
     getOptions(options)
   );
   return tasks.run(options);
-};
+}
 
 export async function backport(options) {
   const shouldStop = await checkOptions(options);
@@ -33,7 +42,7 @@ export async function backport(options) {
     getOptions(options)
   );
   return tasks.run(options);
-};
+}
 
 export async function deps(options) {
   const tasks = new Listr(
@@ -41,7 +50,7 @@ export async function deps(options) {
     getOptions(options)
   );
   return tasks.run(options);
-};
+}
 
 /**
  * Get the listr2 options.