inoway46 · Jun 10, 2026 · Jul 29, 2026 · Aug 13, 2026 · Aug 21, 2026 · Aug 15, 2026
diff --git a/.github/label-pr-config.yml b/.github/label-pr-config.yml
@@ -15,6 +15,7 @@ subSystemLabels:
   /^src\/uv\./: c++, libuv
   /^src\/(?:connect(?:ion)?|pipe|tcp)_/: c++, net
   /^src\/node_os/: c++, os
+  /^src\/permission\//: c++, permission
   /^src\/(?:node_main|signal_)/: c++, process
   /^src\/timer[_s]/: c++, timers
   /^src\/node_root_certs/: c++, tls
@@ -102,6 +103,7 @@ subSystemLabels:
   /^lib\/test.js$/: test_runner
   /^lib\/v8.js$/: v8 module
   /^lib\/internal\/url\.js$/: whatwg-url
+  /^lib\/internal\/process\/permission\.js$/: permission
   /^lib\/internal\/modules\/esm/: esm
   /^lib\/internal\/modules/: module
   /^lib\/internal\/source_map/: source maps
@@ -116,6 +118,13 @@ subSystemLabels:
 
 exlusiveLabels:
   # More specific tests
+  /^test\/(?:parallel|sequential)\/test-(?:[^/]+-)?permission(?:-|\.)/: test, permission
+  /^test\/ffi\/test-ffi-permissions?(?:-|\.)/: test, permission
+  /^test\/addons\/no-addons\/permission\.js$/: test, addons, permission
+  /^test\/es-module\/test-[^/]*-permission(?:-|\.)/: test, esm, permission
+  /^test\/module-hooks\/test-[^/]*-permission(?:-|\.)/: test, module, loaders, permission
+  /^test\/fixtures\/permission\//: test, permission
+  /^test\/fixtures\/rc\/permission-namespace\.json$/: test, permission
   /^test\/addons\//: test, addons
   /^test\/debugger/: test, debugger
   /^test\/doctool\//: test, doc, tools
@@ -150,6 +159,7 @@ exlusiveLabels:
   # test_runner documentation
   /^doc\/api\/test.md$/: doc, test_runner
   # Automatically tag JS subsystem-specific API doc changes
+  /^doc\/api\/permissions\.md$/: doc, permission
   /^doc\/api\/(\w+)\.md$/: doc, $1
   # Add deprecations label to PRs that affect doc/api/deprecations.md
   /^doc\/api\/deprecations.md$/: doc, deprecations
@@ -162,6 +172,7 @@ exlusiveLabels:
   /^doc\//: doc
 
   # More specific benchmarks
+  /^benchmark\/fs\/readfile-permission-enabled\.js$/: benchmark, fs, permission
   /^benchmark\/buffers\//: benchmark, buffer
   /^benchmark\/es\//: benchmark, v8 engine
   /^benchmark\/_http/: benchmark, http
@@ -198,6 +209,7 @@ allJsSubSystems:
   - os
   - path
   - perf_hooks
+  - permission
   - process
   - punycode
   - querystring

diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
@@ -1,6 +1,9 @@
 # This action uses the following secrets:
 #   JENKINS_USER: GitHub user whose Jenkins token is defined below
-#   JENKINS_TOKEN: Jenkins token, to be used to start CI
+#   JENKINS_TOKEN: Jenkins token, to be used to start or resume CI
+# Optional repository variables:
+#   AUTO_START_CI_BATCH_SIZE: maximum PRs to process per run (default: 5)
+#   AUTO_START_CI_MAX_WORKLOAD: pause at this many running or queued PR jobs (default: 15)
 name: Auto Start CI
 
 on:
@@ -30,16 +33,25 @@ jobs:
     steps:
       - name: Get Pull Requests
         id: get_prs_for_ci
-        run: >
-          echo "numbers=$(gh pr list \
+        # Explicit bash enables pipefail so jq cannot hide a failed gh query.
+        shell: bash
+        run: |
+          if ! [[ "$BATCH_SIZE" =~ ^[1-9][0-9]*$ ]]; then
+            echo '::error::AUTO_START_CI_BATCH_SIZE must be a strictly positive integer'
+            exit 1
+          fi
+          # Filter before selecting the batch; UNKNOWN mergeability is retried later.
+          numbers=$(gh pr list \
                   --repo "$GITHUB_REPOSITORY" \
-                  --label 'request-ci' \
-                  --json 'number' \
-                  --search 'review:approved' \
-                  -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 5)" >> "$GITHUB_OUTPUT"
+                  --json 'number,mergeable' \
+                  --search 'review:approved label:request-ci,resume-ci' \
+                  --limit 100 \
+                  | jq --argjson limit "$BATCH_SIZE" \
+                    '[.[] | select(.mergeable == "MERGEABLE") | .number] | .[:$limit] | map(tostring) | join(" ")' -r)
+          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
+          BATCH_SIZE: ${{ vars.AUTO_START_CI_BATCH_SIZE || '5' }}
   start-ci:
     permissions:
       checks: read
@@ -70,9 +82,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
-      - name: Start the CI
+      - name: Start or resume the CI
         run: |
+          read -r -a numbers <<< "$PULL_REQUESTS"
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
-          | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
+          | sh -s -- "${numbers[@]}"
         env:
           GH_TOKEN: ${{ github.token }}
+          PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}
+          MAX_WORKLOAD: ${{ vars.AUTO_START_CI_MAX_WORKLOAD || '15' }}
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
@@ -30,7 +30,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
 
 permissions:

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -30,15 +30,15 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           category: /language:${{matrix.language}}
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
@@ -196,6 +196,8 @@ jobs:
           git config --local user.email "github-bot@iojs.org"
           git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
+          read -r -a numbers <<< "$PULL_REQUESTS"
+          ./tools/actions/commit-queue.sh "${numbers[@]}"
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.numbers }}
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
@@ -34,7 +34,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++
@@ -79,6 +79,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           directory: ./coverage
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
@@ -34,7 +34,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++
@@ -79,6 +79,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           directory: ./coverage
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
@@ -58,7 +58,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
 
 permissions:
@@ -93,6 +93,6 @@ jobs:
       - name: Clean tmp
         run: npx rimraf ./coverage/tmp
       - name: Upload
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           directory: ./coverage
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
@@ -13,6 +13,7 @@ on:
     - cron: 30 0 * * *
 
 env:
+  # WPT's pywebsocket3 still uses CGIHTTPRequestHandler, removed in Python 3.15.
   PYTHON_VERSION: '3.14'
 
 permissions:
@@ -139,7 +140,9 @@ jobs:
       - name: Clone report for upload
         if: ${{ env.WPT_REPORT != '' }}
         working-directory: out/wpt
-        run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
+        run: cp wptreport.json "wptreport-$NODE_VERSION.json"
+        env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -150,12 +153,13 @@ jobs:
       - name: Upload WPT Report to wpt.fyi API
         if: ${{ env.WPT_REPORT != '' }}
         env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
           WPT_FYI_USERNAME: ${{ vars.WPT_FYI_USERNAME }}
           WPT_FYI_PASSWORD: ${{ secrets.WPT_FYI_PASSWORD }}
         working-directory: out/wpt
         run: |
           gzip wptreport.json
-          echo "## Node.js ${{ steps.setup-node.outputs.node-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "## Node.js $NODE_VERSION" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "WPT Revision: [\`${WPT_REVISION:0:7}\`](https://github.com/web-platform-tests/wpt/commits/$WPT_REVISION)" >> $GITHUB_STEP_SUMMARY
           for WPT_FYI_ENDPOINT in "https://wpt.fyi/api/results/upload" "https://staging.wpt.fyi/api/results/upload"

diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: nodejs/node-pr-labeler@d4cf1b8b9f23189c37917000e5e17e796c770a6b  # v1
+      - uses: nodejs/node-pr-labeler@dfe5eb3b099a487644e32567a482744620876ab3  # v1
         with:
           repo-token: ${{ secrets.GH_USER_TOKEN }}
           configuration-path: .github/label-pr-config.yml
diff --git a/.github/workflows/lint-release-proposal.yml b/.github/workflows/lint-release-proposal.yml
@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   NODE_VERSION: lts/*
 
 permissions:

diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
@@ -14,7 +14,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   NODE_VERSION: lts/*
 
 permissions:
@@ -41,6 +41,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
+          # Skip large vendored trees that lint-cpp does not use.
+          sparse-checkout: |
+            /*
+            !/deps/openssl/
+            !/deps/v8/
+          sparse-checkout-cone-mode: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
@@ -53,7 +59,8 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          fetch-depth: 0
+          # The first parent of the PR merge commit is the base branch commit.
+          fetch-depth: 2
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
@@ -70,7 +77,7 @@ jobs:
           # because it is irrelevant. We already check if the formatter produced
           # a diff in the next line.
           # Refs: https://github.com/nodejs/node/pull/42764
-          CLANG_FORMAT_START="$(git merge-base HEAD refs/remotes/origin/$GITHUB_BASE_REF)" \
+          CLANG_FORMAT_START=HEAD^ \
             make format-cpp || true
           git --no-pager diff --exit-code && EXIT_CODE="$?" || EXIT_CODE="$?"
           if [ "$EXIT_CODE" != "0" ]
@@ -91,13 +98,29 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
+        id: setup-node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: |
+            tools/doc/package-lock.json
+            tools/eslint/package-lock.json
+            tools/lint-md/package-lock.json
+      - name: Cache ESLint results
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        env:
+          # ESLint only invalidates its cache on config changes, so the key also
+          # covers the custom rules and the files they read.
+          cache-prefix: eslint-${{ runner.os }}-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('eslint.config.mjs', '*/eslint.config_partial.mjs', 'tools/eslint/*', 'tools/eslint-rules/**', 'doc/api/errors.md', 'doc/api/deprecations.md') }}
+        with:
+          path: .eslintcache
+          key: ${{ env.cache-prefix }}-${{ github.sha }}
+          restore-keys: ${{ env.cache-prefix }}-
       - name: Lint JavaScript files
         run: |
           set +e
-          NODE=$(command -v node) make lint-js
+          NODE=$(command -v node) make lint-js ESLINT_CACHE_FLAGS='--cache --cache-strategy content'
           EXIT_CODE="$?"
           if [ "$EXIT_CODE" != "0" ]; then
             echo
@@ -127,7 +150,7 @@ jobs:
       - name: Lint markdown files
         run: |
           echo "::add-matcher::.github/workflows/remark-lint-problem-matcher.json"
-          NODE=$(command -v node) make lint-md
+          NODE=$(command -v node) make lint-md ESLINT_CACHE_FLAGS='--cache --cache-strategy content'
         env:
           NODE_RELEASED_VERSIONS: ${{ steps.get-released-versions.outputs.NODE_RELEASED_VERSIONS }}
   lint-py:

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
@@ -33,7 +33,7 @@ on:
         type: string
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   XCODE_VERSION: '16.4'
   CLANG_VERSION: '19'
   RUSTC_VERSION: '1.82'

diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
@@ -31,7 +31,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++

diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
@@ -8,6 +8,7 @@ on:
       - configure.py
       - node.gyp
       - node.gypi
+      - deps/v8/**
       - deps/ngtcp2/**
       - deps/nghttp3/**
       - deps/openssl/**
@@ -30,7 +31,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++

diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
@@ -35,7 +35,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++

diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
@@ -31,7 +31,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   XCODE_VERSION: '16.1'
   FLAKY_TESTS: keep_retrying