Merge branch 'main' into perf_node_resolver

Cargo.lock

@@ -347,6 +347,12 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "auto_impl"
 version = "1.2.0"
@@ -1542,9 +1548,9 @@ dependencies = [
 
 [[package]]
 name = "deno_core"
-version = "0.331.0"
+version = "0.333.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2d1779358cad2bc56d71176298767be628d707bb75585f6f8a4be2da8ccda1"
+checksum = "2e67f6f874401f3b8fb3e851743c40ee14014648db6685b233b34f783f6959e8"
 dependencies = [
  "anyhow",
  "az",
@@ -1557,6 +1563,7 @@ dependencies = [
  "deno_core_icudata",
  "deno_error",
  "deno_ops",
+ "deno_path_util",
  "deno_unsync",
  "futures",
  "indexmap 2.3.0",
@@ -1706,7 +1713,7 @@ dependencies = [
  "dyn-clone",
  "error_reporter",
  "fast-socks5",
- "h2 0.4.4",
+ "h2 0.4.7",
  "hickory-resolver",
  "http 1.1.0",
  "http-body-util",
@@ -2061,7 +2068,7 @@ dependencies = [
  "elliptic-curve",
  "errno",
  "faster-hex",
- "h2 0.4.4",
+ "h2 0.4.7",
  "hkdf",
  "http 1.1.0",
  "http-body-util",
@@ -2170,9 +2177,9 @@ dependencies = [
 
 [[package]]
 name = "deno_ops"
-version = "0.207.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96f000a21f6969b4c945bc8e9e785aa439f11ca4fd3fbddcd5bebc102167eb37"
+checksum = "fbda741ba267a252bad86153d16c859c3a8e1b219b300a1b4f0a2632c0a465cf"
 dependencies = [
  "indexmap 2.3.0",
  "proc-macro-rules",
@@ -2591,7 +2598,7 @@ dependencies = [
  "deno_permissions",
  "deno_tls",
  "fastwebsockets",
- "h2 0.4.4",
+ "h2 0.4.7",
  "http 1.1.0",
  "http-body-util",
  "hyper 1.4.1",
@@ -3851,15 +3858,15 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.4"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
+checksum = "ccae279728d634d083c00f6099cb58f01cc99c145b84b8be2f6c74618d79922e"
 dependencies = [
+ "atomic-waker",
  "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
- "futures-util",
  "http 1.1.0",
  "indexmap 2.3.0",
  "slab",
@@ -4231,7 +4238,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.4",
+ "h2 0.4.7",
  "http 1.1.0",
  "http-body 1.0.0",
  "httparse",
@@ -6443,7 +6450,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-util",
- "h2 0.4.4",
+ "h2 0.4.7",
  "http 1.1.0",
  "http-body 1.0.0",
  "http-body-util",
@@ -6994,9 +7001,9 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.240.0"
+version = "0.242.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd0494d74c40ab94f53a19485de359ea6a55f05341b817b93440b673c1ce8ec6"
+checksum = "aa9d64ec1fdc3316cb65ca60ccbb5a3a914f014ccb0b5f71fc9280506fd28247"
 dependencies = [
  "deno_error",
  "num-bigint",
@@ -7984,7 +7991,7 @@ dependencies = [
  "flate2",
  "futures",
  "glob",
- "h2 0.4.4",
+ "h2 0.4.7",
  "http 1.1.0",
  "http-body-util",
  "hyper 1.4.1",
@@ -8278,7 +8285,7 @@ dependencies = [
  "axum",
  "base64 0.22.1",
  "bytes",
- "h2 0.4.4",
+ "h2 0.4.7",
  "http 1.1.0",
  "http-body 1.0.0",
  "http-body-util",

Cargo.toml

@@ -51,7 +51,7 @@ repository = "https://github.com/denoland/deno"
 
 [workspace.dependencies]
 deno_ast = { version = "=0.44.0", features = ["transpiling"] }
-deno_core = { version = "0.331.0" }
+deno_core = { version = "0.333.0" }
 
 deno_bench_util = { version = "0.181.0", path = "./bench_util" }
 deno_config = { version = "=0.45.0", features = ["workspace"] }
@@ -142,7 +142,7 @@ flate2 = { version = "1.0.30", default-features = false }
 fs3 = "0.5.0"
 futures = "0.3.21"
 glob = "0.3.1"
-h2 = "0.4.4"
+h2 = "0.4.6"
 hickory-resolver = { version = "0.25.0-alpha.4", features = ["tokio-runtime", "serde"] }
 http = "1.0"
 http-body = "1.0"

cli/lsp/tsc.rs

@@ -3684,6 +3684,10 @@ impl CompletionInfo {
     position: u32,
     language_server: &language_server::Inner,
   ) -> lsp::CompletionResponse {
+    // A cache for costly resolution computations.
+    // On a test project, it was found to speed up completion requests
+    // by 10-20x and contained ~300 entries for 8000 completion items.
+    let mut cache = HashMap::with_capacity(512);
     let items = self
       .entries
       .iter()
@@ -3695,6 +3699,7 @@ impl CompletionInfo {
           specifier,
           position,
           language_server,
+          &mut cache,
         )
       })
       .collect();
@@ -3899,6 +3904,7 @@ impl CompletionEntry {
     self.insert_text.clone()
   }
 
+  #[allow(clippy::too_many_arguments)]
   pub fn as_completion_item(
     &self,
     line_index: Arc<LineIndex>,
@@ -3907,6 +3913,7 @@ impl CompletionEntry {
     specifier: &ModuleSpecifier,
     position: u32,
     language_server: &language_server::Inner,
+    resolution_cache: &mut HashMap<(ModuleSpecifier, ModuleSpecifier), String>,
   ) -> Option<lsp::CompletionItem> {
     let mut label = self.name.clone();
     let mut label_details: Option<lsp::CompletionItemLabelDetails> = None;
@@ -3965,14 +3972,18 @@ impl CompletionEntry {
         }
       }
     }
-
     if let Some(source) = &self.source {
       let mut display_source = source.clone();
       if let Some(import_data) = &self.auto_import_data {
         let import_mapper =
           language_server.get_ts_response_import_mapper(specifier);
-        if let Some(mut new_specifier) = import_mapper
-          .check_specifier(&import_data.normalized, specifier)
+        let maybe_cached = resolution_cache
+          .get(&(import_data.normalized.clone(), specifier.clone()))
+          .cloned();
+        if let Some(mut new_specifier) = maybe_cached
+          .or_else(|| {
+            import_mapper.check_specifier(&import_data.normalized, specifier)
+          })
           .or_else(|| relative_specifier(specifier, &import_data.normalized))
           .or_else(|| {
             ModuleSpecifier::parse(&import_data.raw.module_specifier)
@@ -3980,6 +3991,10 @@ impl CompletionEntry {
               .then(|| import_data.normalized.to_string())
           })
         {
+          resolution_cache.insert(
+            (import_data.normalized.clone(), specifier.clone()),
+            new_specifier.clone(),
+          );
           if new_specifier.contains("/node_modules/") {
             return None;
           }

cli/module_loader.rs

@@ -606,12 +606,13 @@ impl<TGraphContainer: ModuleGraphContainer>
     } else if referrer == "." {
       // main module, use the initial cwd
       deno_core::resolve_path(referrer, &self.shared.initial_cwd)
-        .map_err(|e| e.into())
+        .map_err(|e| JsErrorBox::from_err(e).into())
     } else {
       // this cwd check is slow, so try to avoid it
       let cwd = std::env::current_dir()
         .map_err(|e| JsErrorBox::from_err(UnableToGetCwdError(e)))?;
-      deno_core::resolve_path(referrer, &cwd).map_err(|e| e.into())
+      deno_core::resolve_path(referrer, &cwd)
+        .map_err(|e| JsErrorBox::from_err(e).into())
     }
   }
 

cli/rt/run.rs

@@ -165,7 +165,8 @@ impl ModuleLoader for EmbeddedModuleLoader {
         );
       }
       let current_dir = std::env::current_dir().unwrap();
-      deno_core::resolve_path(".", &current_dir)?
+      deno_core::resolve_path(".", &current_dir)
+        .map_err(JsErrorBox::from_err)?
     } else {
       Url::parse(referrer).map_err(|err| {
         JsErrorBox::type_error(format!(

cli/tsc/mod.rs

@@ -529,6 +529,9 @@ pub enum LoadError {
   #[error("Unable to load {path}: {error}")]
   LoadFromNodeModule { path: String, error: std::io::Error },
   #[class(inherit)]
+  #[error("{0}")]
+  ResolveUrlOrPathError(#[from] deno_path_util::ResolveUrlOrPathError),
+  #[class(inherit)]
   #[error(
     "Error converting a string module specifier for \"op_resolve\": {0}"
   )]
@@ -713,6 +716,9 @@ pub enum ResolveError {
   PackageSubpathResolve(PackageSubpathResolveError),
   #[class(inherit)]
   #[error("{0}")]
+  ResolveUrlOrPathError(#[from] deno_path_util::ResolveUrlOrPathError),
+  #[class(inherit)]
+  #[error("{0}")]
   ResolvePkgFolderFromDenoModule(#[from] ResolvePkgFolderFromDenoModuleError),
   #[class(inherit)]
   #[error("{0}")]

ext/fs/ops.rs

@@ -171,9 +171,6 @@ where
 {
   let fs = state.borrow::<FileSystemRc>();
   let path = fs.cwd()?;
-  state
-    .borrow_mut::<P>()
-    .check_read_blind(&path, "CWD", "Deno.cwd()")?;
   let path_str = path_into_string(path.into_os_string())?;
   Ok(path_str)
 }

ext/node/lib.rs

@@ -301,6 +301,7 @@ deno_core::extension!(deno_node,
     ops::crypto::x509::op_node_x509_parse,
     ops::crypto::x509::op_node_x509_ca,
     ops::crypto::x509::op_node_x509_check_email,
+    ops::crypto::x509::op_node_x509_check_host,
     ops::crypto::x509::op_node_x509_fingerprint,
     ops::crypto::x509::op_node_x509_fingerprint256,
     ops::crypto::x509::op_node_x509_fingerprint512,
@@ -591,7 +592,6 @@ deno_core::extension!(deno_node,
     "internal/readline/utils.mjs",
     "internal/stream_base_commons.ts",
     "internal/streams/add-abort-signal.mjs",
-    "internal/streams/buffer_list.mjs",
     "internal/streams/destroy.mjs",
     "internal/streams/end-of-stream.mjs",
     "internal/streams/lazy_transform.mjs",

ext/node/ops/crypto/cipher.rs

@@ -8,6 +8,7 @@ use aes::cipher::block_padding::Pkcs7;
 use aes::cipher::BlockDecryptMut;
 use aes::cipher::BlockEncryptMut;
 use aes::cipher::KeyIvInit;
+use aes::cipher::KeySizeUser;
 use deno_core::Resource;
 use digest::generic_array::GenericArray;
 use digest::KeyInit;
@@ -190,12 +191,20 @@ impl Cipher {
       "aes-192-ecb" => Aes192Ecb(Box::new(ecb::Encryptor::new(key.into()))),
       "aes-256-ecb" => Aes256Ecb(Box::new(ecb::Encryptor::new(key.into()))),
       "aes-128-gcm" => {
+        if key.len() != aes::Aes128::key_size() {
+          return Err(CipherError::InvalidKeyLength);
+        }
+
         let cipher =
           aead_gcm_stream::AesGcm::<aes::Aes128>::new(key.into(), iv);
 
         Aes128Gcm(Box::new(cipher))
       }
       "aes-256-gcm" => {
+        if key.len() != aes::Aes256::key_size() {
+          return Err(CipherError::InvalidKeyLength);
+        }
+
         let cipher =
           aead_gcm_stream::AesGcm::<aes::Aes256>::new(key.into(), iv);
 
@@ -406,12 +415,20 @@ impl Decipher {
       "aes-192-ecb" => Aes192Ecb(Box::new(ecb::Decryptor::new(key.into()))),
       "aes-256-ecb" => Aes256Ecb(Box::new(ecb::Decryptor::new(key.into()))),
       "aes-128-gcm" => {
+        if key.len() != aes::Aes128::key_size() {
+          return Err(DecipherError::InvalidKeyLength);
+        }
+
         let decipher =
           aead_gcm_stream::AesGcm::<aes::Aes128>::new(key.into(), iv);
 
         Aes128Gcm(Box::new(decipher))
       }
       "aes-256-gcm" => {
+        if key.len() != aes::Aes256::key_size() {
+          return Err(DecipherError::InvalidKeyLength);
+        }
+
         let decipher =
           aead_gcm_stream::AesGcm::<aes::Aes256>::new(key.into(), iv);
 

ext/node/ops/crypto/mod.rs

@@ -571,7 +571,7 @@ fn scrypt(
     parallelization,
     keylen as usize,
   )
-  .unwrap();
+  .map_err(|_| JsErrorBox::generic("scrypt params construction failed"))?;
 
   // Call into scrypt
   let res = scrypt::scrypt(&password, &salt, &params, output_buffer);

ext/node/ops/crypto/x509.rs

@@ -130,6 +130,43 @@ pub fn op_node_x509_check_email(
   false
 }
 
+#[op2(fast)]
+pub fn op_node_x509_check_host(
+  #[cppgc] cert: &Certificate,
+  #[string] host: &str,
+) -> bool {
+  let cert = cert.inner.get().deref();
+
+  let subject = cert.subject();
+  if subject
+    .iter_common_name()
+    .any(|e| e.as_str().unwrap_or("") == host)
+  {
+    return true;
+  }
+
+  let subject_alt = cert
+    .extensions()
+    .iter()
+    .find(|e| e.oid == x509_parser::oid_registry::OID_X509_EXT_SUBJECT_ALT_NAME)
+    .and_then(|e| match e.parsed_extension() {
+      extensions::ParsedExtension::SubjectAlternativeName(s) => Some(s),
+      _ => None,
+    });
+
+  if let Some(subject_alt) = subject_alt {
+    for name in &subject_alt.general_names {
+      if let extensions::GeneralName::DNSName(n) = name {
+        if *n == host {
+          return true;
+        }
+      }
+    }
+  }
+
+  false
+}
+
 #[op2]
 #[string]
 pub fn op_node_x509_fingerprint(#[cppgc] cert: &Certificate) -> Option<String> {

ext/node/polyfills/01_require.js

@@ -122,7 +122,6 @@ import internalFsUtils from "ext:deno_node/internal/fs/utils.mjs";
 import internalHttp from "ext:deno_node/internal/http.ts";
 import internalReadlineUtils from "ext:deno_node/internal/readline/utils.mjs";
 import internalStreamsAddAbortSignal from "ext:deno_node/internal/streams/add-abort-signal.mjs";
-import internalStreamsBufferList from "ext:deno_node/internal/streams/buffer_list.mjs";
 import internalStreamsLazyTransform from "ext:deno_node/internal/streams/lazy_transform.mjs";
 import internalStreamsState from "ext:deno_node/internal/streams/state.mjs";
 import internalTestBinding from "ext:deno_node/internal/test/binding.ts";
@@ -225,7 +224,6 @@ function setupBuiltinModules() {
     "internal/http": internalHttp,
     "internal/readline/utils": internalReadlineUtils,
     "internal/streams/add-abort-signal": internalStreamsAddAbortSignal,
-    "internal/streams/buffer_list": internalStreamsBufferList,
     "internal/streams/lazy_transform": internalStreamsLazyTransform,
     "internal/streams/state": internalStreamsState,
     "internal/test/binding": internalTestBinding,

ext/node/polyfills/_brotli.js

@@ -181,7 +181,6 @@ export function brotliCompress(
     callback = options;
     options = {};
   }
-
   const { quality, lgwin, mode } = oneOffCompressOptions(options);
   PromisePrototypeCatch(
     PromisePrototypeThen(
@@ -204,8 +203,13 @@ export function brotliCompressSync(
   return Buffer.from(TypedArrayPrototypeSubarray(output, 0, len));
 }
 
-export function brotliDecompress(input) {
+export function brotliDecompress(input, options, callback) {
   const buf = toU8(input);
+
+  if (typeof options === "function") {
+    callback = options;
+    options = {};
+  }
   return PromisePrototypeCatch(
     PromisePrototypeThen(
       op_brotli_decompress_async(buf),

ext/node/polyfills/_tls_wrap.ts

@@ -158,6 +158,7 @@ export class TLSSocket extends net.Socket {
           // onSocket handler of ClientRequest object.
           tlssock.emit("secure");
           tlssock.removeListener("end", onConnectEnd);
+          return;
         }
 
         try {

ext/node/polyfills/http.ts

@@ -414,6 +414,11 @@ class ClientRequest extends OutgoingMessage {
             oncreate,
           );
           if (newSocket) {
+            // If socket is created by createConnection option
+            // we apply sock-init-workaround
+            // This covers npm:ws and npm:mqtt
+            // https://github.com/denoland/deno/issues/27694
+            newSocket._needsSockInitWorkaround = true;
             oncreate(null, newSocket);
           }
         } catch (err) {

ext/node/polyfills/internal/crypto/scrypt.ts

@@ -107,23 +107,19 @@ export function scrypt(
     throw new Error("exceeds max memory");
   }
 
-  try {
-    op_node_scrypt_async(
-      password,
-      salt,
-      keylen,
-      Math.log2(N),
-      r,
-      p,
-      maxmem,
-    ).then(
-      (buf: Uint8Array) => {
-        cb(null, Buffer.from(buf.buffer));
-      },
-    );
-  } catch (err: unknown) {
-    return cb(err);
-  }
+  op_node_scrypt_async(
+    password,
+    salt,
+    keylen,
+    Math.log2(N),
+    r,
+    p,
+    maxmem,
+  ).then(
+    (buf: Uint8Array) => {
+      cb(null, Buffer.from(buf.buffer));
+    },
+  ).catch((err: unknown) => cb(err));
 }
 
 export default {

ext/node/polyfills/internal/crypto/x509.ts

@@ -7,6 +7,7 @@
 import {
   op_node_x509_ca,
   op_node_x509_check_email,
+  op_node_x509_check_host,
   op_node_x509_fingerprint,
   op_node_x509_fingerprint256,
   op_node_x509_fingerprint512,
@@ -90,8 +91,11 @@ export class X509Certificate {
     }
   }
 
-  checkHost(_name: string, _options?: X509CheckOptions): string | undefined {
-    notImplemented("crypto.X509Certificate.prototype.checkHost");
+  checkHost(name: string, _options?: X509CheckOptions): string | undefined {
+    validateString(name, "name");
+    if (op_node_x509_check_host(this.#handle, name)) {
+      return name;
+    }
   }
 
   checkIP(_ip: string): string | undefined {

ext/node/polyfills/internal/streams/buffer_list.mjs

@@ -1,188 +0,0 @@
-// Copyright 2018-2025 the Deno authors. MIT license.
-// Copyright Joyent and Node contributors. All rights reserved. MIT license.
-// deno-lint-ignore-file
-
-import { Buffer } from "node:buffer";
-import { inspect } from "ext:deno_node/internal/util/inspect.mjs";
-
-class BufferList {
-  constructor() {
-    this.head = null;
-    this.tail = null;
-    this.length = 0;
-  }
-
-  push(v) {
-    const entry = { data: v, next: null };
-    if (this.length > 0) {
-      this.tail.next = entry;
-    } else {
-      this.head = entry;
-    }
-    this.tail = entry;
-    ++this.length;
-  }
-
-  unshift(v) {
-    const entry = { data: v, next: this.head };
-    if (this.length === 0) {
-      this.tail = entry;
-    }
-    this.head = entry;
-    ++this.length;
-  }
-
-  shift() {
-    if (this.length === 0) {
-      return;
-    }
-    const ret = this.head.data;
-    if (this.length === 1) {
-      this.head = this.tail = null;
-    } else {
-      this.head = this.head.next;
-    }
-    --this.length;
-    return ret;
-  }
-
-  clear() {
-    this.head = this.tail = null;
-    this.length = 0;
-  }
-
-  join(s) {
-    if (this.length === 0) {
-      return "";
-    }
-    let p = this.head;
-    let ret = "" + p.data;
-    while (p = p.next) {
-      ret += s + p.data;
-    }
-    return ret;
-  }
-
-  concat(n) {
-    if (this.length === 0) {
-      return Buffer.alloc(0);
-    }
-    const ret = Buffer.allocUnsafe(n >>> 0);
-    let p = this.head;
-    let i = 0;
-    while (p) {
-      ret.set(p.data, i);
-      i += p.data.length;
-      p = p.next;
-    }
-    return ret;
-  }
-
-  // Consumes a specified amount of bytes or characters from the buffered data.
-  consume(n, hasStrings) {
-    const data = this.head.data;
-    if (n < data.length) {
-      // `slice` is the same for buffers and strings.
-      const slice = data.slice(0, n);
-      this.head.data = data.slice(n);
-      return slice;
-    }
-    if (n === data.length) {
-      // First chunk is a perfect match.
-      return this.shift();
-    }
-    // Result spans more than one buffer.
-    return hasStrings ? this._getString(n) : this._getBuffer(n);
-  }
-
-  first() {
-    return this.head.data;
-  }
-
-  *[Symbol.iterator]() {
-    for (let p = this.head; p; p = p.next) {
-      yield p.data;
-    }
-  }
-
-  // Consumes a specified amount of characters from the buffered data.
-  _getString(n) {
-    let ret = "";
-    let p = this.head;
-    let c = 0;
-    do {
-      const str = p.data;
-      if (n > str.length) {
-        ret += str;
-        n -= str.length;
-      } else {
-        if (n === str.length) {
-          ret += str;
-          ++c;
-          if (p.next) {
-            this.head = p.next;
-          } else {
-            this.head = this.tail = null;
-          }
-        } else {
-          ret += str.slice(0, n);
-          this.head = p;
-          p.data = str.slice(n);
-        }
-        break;
-      }
-      ++c;
-    } while (p = p.next);
-    this.length -= c;
-    return ret;
-  }
-
-  // Consumes a specified amount of bytes from the buffered data.
-  _getBuffer(n) {
-    const ret = Buffer.allocUnsafe(n);
-    const retLen = n;
-    let p = this.head;
-    let c = 0;
-    do {
-      const buf = p.data;
-      if (n > buf.length) {
-        ret.set(buf, retLen - n);
-        n -= buf.length;
-      } else {
-        if (n === buf.length) {
-          ret.set(buf, retLen - n);
-          ++c;
-          if (p.next) {
-            this.head = p.next;
-          } else {
-            this.head = this.tail = null;
-          }
-        } else {
-          ret.set(
-            new Uint8Array(buf.buffer, buf.byteOffset, n),
-            retLen - n,
-          );
-          this.head = p;
-          p.data = buf.slice(n);
-        }
-        break;
-      }
-      ++c;
-    } while (p = p.next);
-    this.length -= c;
-    return ret;
-  }
-
-  // Make sure the linked list only shows the minimal necessary information.
-  [inspect.custom](_, options) {
-    return inspect(this, {
-      ...options,
-      // Only inspect one level.
-      depth: 0,
-      // It should not recurse.
-      customInspect: false,
-    });
-  }
-}
-
-export default BufferList;

tests/integration/compile_tests.rs

@@ -820,14 +820,14 @@ fn compile_npm_cowsay_main() {
 #[test]
 fn compile_npm_no_permissions() {
   run_npm_bin_compile_test(RunNpmBinCompileOptions {
-    input_specifier: "npm:cowsay@1.5.0",
+    input_specifier: "npm:@denotest/cli-with-permissions@1.0.0",
     copy_temp_dir: None,
-    compile_args: vec![],
+    compile_args: vec!["-o", "denotest"],
     run_args: vec!["Hello"],
-    output_file: "npm/deno_run_cowsay_no_permissions.out",
+    output_file: "npm/compile_npm_no_permissions.out",
     node_modules_local: false,
     input_name: None,
-    expected_name: "cowsay",
+    expected_name: "denotest",
     exit_code: 1,
   });
 }

tests/integration/lsp_tests.rs

@@ -5762,7 +5762,6 @@ fn lsp_jsr_auto_import_completion() {
     json!({ "triggerKind": 1 }),
   );
   assert!(!list.is_incomplete);
-  assert_eq!(list.items.len(), 268);
   let item = list.items.iter().find(|i| i.label == "add").unwrap();
   assert_eq!(&item.label, "add");
   assert_eq!(
@@ -5842,7 +5841,6 @@ fn lsp_jsr_auto_import_completion_import_map() {
     json!({ "triggerKind": 1 }),
   );
   assert!(!list.is_incomplete);
-  assert_eq!(list.items.len(), 268);
   let item = list.items.iter().find(|i| i.label == "add").unwrap();
   assert_eq!(&item.label, "add");
   assert_eq!(json!(&item.label_details), json!({ "description": "add" }));

tests/integration/run_tests.rs

@@ -358,10 +358,12 @@ fn permissions_prompt_allow_all_2() {
       console.write_line_raw("A");
       console.expect("✅ Granted all sys access.");
 
+      let text = console.read_until("Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all read permissions)");
       // "read" permissions
-      console.expect(concat!(
-        "┏ ⚠️  Deno requests read access to <CWD>.\r\n",
-        "┠─ Requested by `Deno.cwd()` API.\r\n",
+      test_util::assertions::assert_wildcard_match(&text, concat!(
+        "\r\n",
+        "┏ ⚠️  Deno requests read access to \"[WILDCARD]/tests/testdata/\".\r\n",
+        "┠─ Requested by `Deno.lstatSync()` API.\r\n",
         "┠─ To see a stack trace for this prompt, set the DENO_TRACE_PERMISSIONS environmental variable.\r\n",
         "┠─ Learn more at: https://docs.deno.com/go/--allow-read\r\n",
         "┠─ Run again with --allow-read to bypass this prompt.\r\n",

tests/registry/npm/@denotest/cli-with-permissions/1.0.0/index.js

@@ -0,0 +1,3 @@
+console.log("Hello in CLI with permissions");
+console.log("Reading DENO_HELLO env var...");
+console.log(Deno.env.get("DENO_HELLO"));

tests/registry/npm/@denotest/cli-with-permissions/1.0.0/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "@denotest/cli-with-permissions",
+  "version": "1.0.0",
+  "bin": "./index.js"
+}

tests/registry/npm/bufferutil/registry.json

@@ -0,0 +1,73 @@
+{
+  "name": "bufferutil",
+  "dist-tags": {
+    "latest": "4.0.9"
+  },
+  "versions": {
+    "4.0.9": {
+      "name": "bufferutil",
+      "version": "4.0.9",
+      "description": "WebSocket buffer utils",
+      "main": "index.js",
+      "engines": {
+        "node": ">=6.14.2"
+      },
+      "scripts": {
+        "install": "node-gyp-build",
+        "prebuild": "prebuildify --napi --strip --target=8.11.2",
+        "prebuild-darwin-x64+arm64": "prebuildify --arch x64+arm64 --napi --strip --target=8.11.2",
+        "test": "mocha"
+      },
+      "repository": {
+        "type": "git",
+        "url": "git+https://github.com/websockets/bufferutil.git"
+      },
+      "author": {
+        "name": "Einar Otto Stangvik",
+        "email": "einaros@gmail.com",
+        "url": "http://2x.io"
+      },
+      "license": "MIT",
+      "bugs": {
+        "url": "https://github.com/websockets/bufferutil/issues"
+      },
+      "dependencies": {
+        "node-gyp-build": "^4.3.0"
+      },
+      "devDependencies": {
+        "mocha": "^11.0.1",
+        "node-gyp": "^11.0.0",
+        "prebuildify": "^6.0.0"
+      },
+      "_id": "bufferutil@4.0.9",
+      "gitHead": "35e2eb6a14a8d58b87bc1f9ff2ddff67e2f1fa97",
+      "_nodeVersion": "23.5.0",
+      "_npmVersion": "10.9.2",
+      "dist": {
+        "integrity": "sha512-WDtdLmJvAuNNPzByAYpRo2rF1Mmradw6gvWsQKf63476DDXmomT9zUiGypLcG4ibIM67vhAj8jJRdbmEws2Aqw==",
+        "shasum": "6e81739ad48a95cad45a279588e13e95e24a800a",
+        "tarball": "http://localhost:4260/bufferutil/bufferutil-4.0.9.tgz",
+        "fileCount": 11,
+        "unpackedSize": 371859
+      },
+      "directories": {},
+      "_hasShrinkwrap": false
+    }
+  },
+  "bugs": {
+    "url": "https://github.com/websockets/bufferutil/issues"
+  },
+  "author": {
+    "name": "Einar Otto Stangvik",
+    "email": "einaros@gmail.com",
+    "url": "http://2x.io"
+  },
+  "license": "MIT",
+  "homepage": "https://github.com/websockets/bufferutil",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/websockets/bufferutil.git"
+  },
+  "description": "WebSocket buffer utils",
+  "readmeFilename": "README.md"
+}

tests/registry/npm/utf-8-validate/registry.json

@@ -0,0 +1,75 @@
+{
+  "name": "utf-8-validate",
+  "dist-tags": {
+    "latest": "6.0.5"
+  },
+  "versions": {
+    "6.0.5": {
+      "name": "utf-8-validate",
+      "version": "6.0.5",
+      "description": "Check if a buffer contains valid UTF-8",
+      "main": "index.js",
+      "engines": {
+        "node": ">=6.14.2"
+      },
+      "scripts": {
+        "install": "node-gyp-build",
+        "prebuild": "prebuildify --napi --strip --target=8.11.2",
+        "prebuild-linux-musl-x64": "prebuildify-cross --image alpine --napi --strip --target=8.11.2",
+        "prebuild-darwin-x64+arm64": "prebuildify --arch x64+arm64 --napi --strip --target=8.11.2",
+        "test": "mocha"
+      },
+      "repository": {
+        "type": "git",
+        "url": "git+https://github.com/websockets/utf-8-validate.git"
+      },
+      "author": {
+        "name": "Einar Otto Stangvik",
+        "email": "einaros@gmail.com",
+        "url": "http://2x.io"
+      },
+      "license": "MIT",
+      "bugs": {
+        "url": "https://github.com/websockets/utf-8-validate/issues"
+      },
+      "dependencies": {
+        "node-gyp-build": "^4.3.0"
+      },
+      "devDependencies": {
+        "mocha": "^10.0.0",
+        "node-gyp": "^10.0.1",
+        "prebuildify": "^6.0.0",
+        "prebuildify-cross": "^5.0.0"
+      },
+      "_id": "utf-8-validate@6.0.5",
+      "gitHead": "4a9a05728641674620818c6a78b01fce38e6f222",
+      "_nodeVersion": "22.10.0",
+      "_npmVersion": "10.9.0",
+      "dist": {
+        "integrity": "sha512-EYZR+OpIXp9Y1eG1iueg8KRsY8TuT8VNgnanZ0uA3STqhHQTLwbl+WX76/9X5OY12yQubymBpaBSmMPkSTQcKA==",
+        "shasum": "8087d39902be2cc15bdb21a426697ff256d65aab",
+        "tarball": "http://localhost:4260/utf-8-validate/utf-8-validate-6.0.5.tgz",
+        "fileCount": 15,
+        "unpackedSize": 717511
+      },
+      "directories": {},
+      "_hasShrinkwrap": false
+    }
+  },
+  "bugs": {
+    "url": "https://github.com/websockets/utf-8-validate/issues"
+  },
+  "author": {
+    "name": "Einar Otto Stangvik",
+    "email": "einaros@gmail.com",
+    "url": "http://2x.io"
+  },
+  "license": "MIT",
+  "homepage": "https://github.com/websockets/utf-8-validate",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/websockets/utf-8-validate.git"
+  },
+  "description": "Check if a buffer contains valid UTF-8",
+  "readmeFilename": "README.md"
+}

tests/registry/npm/ws/registry.json

@@ -0,0 +1,97 @@
+{
+  "name": "ws",
+  "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
+  "dist-tags": {
+    "latest": "8.18.0"
+  },
+  "versions": {
+    "8.18.0": {
+      "name": "ws",
+      "version": "8.18.0",
+      "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
+      "bugs": {
+        "url": "https://github.com/websockets/ws/issues"
+      },
+      "repository": {
+        "type": "git",
+        "url": "git+https://github.com/websockets/ws.git"
+      },
+      "author": {
+        "name": "Einar Otto Stangvik",
+        "email": "einaros@gmail.com",
+        "url": "http://2x.io"
+      },
+      "license": "MIT",
+      "main": "index.js",
+      "exports": {
+        ".": {
+          "browser": "./browser.js",
+          "import": "./wrapper.mjs",
+          "require": "./index.js"
+        },
+        "./package.json": "./package.json"
+      },
+      "browser": "browser.js",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "scripts": {
+        "test": "nyc --reporter=lcov --reporter=text mocha --throw-deprecation test/*.test.js",
+        "integration": "mocha --throw-deprecation test/*.integration.js",
+        "lint": "eslint . && prettier --check --ignore-path .gitignore \"**/*.{json,md,yaml,yml}\""
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      },
+      "devDependencies": {
+        "benchmark": "^2.1.4",
+        "bufferutil": "^4.0.1",
+        "eslint": "^9.0.0",
+        "eslint-config-prettier": "^9.0.0",
+        "eslint-plugin-prettier": "^5.0.0",
+        "globals": "^15.0.0",
+        "mocha": "^8.4.0",
+        "nyc": "^15.0.0",
+        "prettier": "^3.0.0",
+        "utf-8-validate": "^6.0.0"
+      },
+      "_id": "ws@8.18.0",
+      "gitHead": "976c53c4065c49ede73bfba824caf5a6e0f290cb",
+      "_nodeVersion": "22.4.0",
+      "_npmVersion": "10.8.1",
+      "dist": {
+        "integrity": "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==",
+        "shasum": "0d7505a6eafe2b0e712d232b42279f53bc289bbc",
+        "tarball": "http://localhost:4260/ws/ws-8.18.0.tgz",
+        "fileCount": 19,
+        "unpackedSize": 146647
+      },
+      "directories": {},
+      "_hasShrinkwrap": false
+    }
+  },
+  "author": {
+    "name": "Einar Otto Stangvik",
+    "email": "einaros@gmail.com",
+    "url": "http://2x.io"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/websockets/ws.git"
+  },
+  "license": "MIT",
+  "homepage": "https://github.com/websockets/ws",
+  "bugs": {
+    "url": "https://github.com/websockets/ws/issues"
+  },
+  "readmeFilename": "README.md"
+}

tests/specs/npm/ws_compat/__test__.jsonc

@@ -0,0 +1,4 @@
+{
+  "args": "run -A --cert=../../../testdata/tls/RootCA.pem main.ts",
+  "output": "main.out"
+}

tests/specs/npm/ws_compat/main.out

@@ -0,0 +1,4 @@
+[WILDCARD]
+open on server
+open on client
+message on server

tests/specs/npm/ws_compat/main.ts

@@ -0,0 +1,24 @@
+import WebSocket from "npm:ws@8.18.0";
+
+const key = Deno.readTextFileSync("../../../testdata/tls/localhost.key");
+const cert = Deno.readTextFileSync("../../../testdata/tls/localhost.crt");
+
+Deno.serve({ key, cert, port: 0, onListen }, (req) => {
+  const { socket, response } = Deno.upgradeWebSocket(req);
+  socket.addEventListener("open", () => {
+    console.log("open on server");
+  });
+  socket.addEventListener("message", () => {
+    console.log("message on server");
+    Deno.exit(0);
+  });
+  return response;
+});
+
+function onListen({ port }) {
+  const socket = new WebSocket(`wss://localhost:${port}`);
+  socket.on("open", () => {
+    console.log("open on client");
+    socket.send("hi");
+  });
+}

tests/testdata/npm/compile_npm_no_permissions.out

@@ -0,0 +1,5 @@
+Hello in CLI with permissions
+Reading DENO_HELLO env var...
+error: Uncaught (in promise) NotCapable: Requires env access to "DENO_HELLO", specify the required permissions during compilation using `deno compile --allow-env`
+console.log(Deno.env.get("DENO_HELLO"));
+[WILDCARD]

tests/testdata/npm/deno_run_cowsay_no_permissions.out

@@ -1,2 +0,0 @@
-error: Uncaught (in promise) NotCapable: Requires read access to <CWD>, specify the required permissions during compilation using `deno compile --allow-read`
-[WILDCARD]

tests/unit/dir_test.ts

@@ -38,16 +38,6 @@ Deno.test({ permissions: { read: true, write: true } }, function dirCwdError() {
   }
 });
 
-Deno.test({ permissions: { read: false } }, function dirCwdPermError() {
-  assertThrows(
-    () => {
-      Deno.cwd();
-    },
-    Deno.errors.NotCapable,
-    "Requires read access to <CWD>, run again with the --allow-read flag",
-  );
-});
-
 Deno.test(
   { permissions: { read: true, write: true } },
   function dirChdirError() {

tests/unit_node/crypto/crypto_cipher_gcm_test.ts

@@ -143,3 +143,32 @@ Deno.test({
     );
   },
 });
+
+Deno.test({
+  name: "aes gcm with invalid key length",
+  fn() {
+    assertThrows(
+      () => {
+        crypto.createCipheriv(
+          "aes-128-gcm",
+          Buffer.alloc(15),
+          Buffer.alloc(12),
+        );
+      },
+      Error,
+      "Invalid key length",
+    );
+
+    assertThrows(
+      () => {
+        crypto.createCipheriv(
+          "aes-256-gcm",
+          Buffer.alloc(31),
+          Buffer.alloc(12),
+        );
+      },
+      Error,
+      "Invalid key length",
+    );
+  },
+});

tests/unit_node/crypto/crypto_key_test.ts

@@ -12,6 +12,7 @@ import {
   generateKeyPairSync,
   KeyObject,
   randomBytes,
+  X509Certificate,
 } from "node:crypto";
 import { promisify } from "node:util";
 import { Buffer } from "node:buffer";
@@ -716,3 +717,41 @@ Deno.test("RSA export private JWK", function () {
   assertEquals((privateKey as any).kty, "RSA");
   assertEquals((privateKey as any).n, (publicKey as any).n);
 });
+
+Deno.test("X509Certificate checkHost", function () {
+  const der = Buffer.from(
+    "308203e8308202d0a0030201020214147d36c1c2f74206de9fab5f2226d78adb00a42630" +
+      "0d06092a864886f70d01010b0500307a310b3009060355040613025553310b3009060355" +
+      "04080c024341310b300906035504070c025346310f300d060355040a0c064a6f79656e74" +
+      "3110300e060355040b0c074e6f64652e6a73310c300a06035504030c036361313120301e" +
+      "06092a864886f70d010901161172794074696e79636c6f7564732e6f72673020170d3232" +
+      "303930333231343033375a180f32323936303631373231343033375a307d310b30090603" +
+      "55040613025553310b300906035504080c024341310b300906035504070c025346310f30" +
+      "0d060355040a0c064a6f79656e743110300e060355040b0c074e6f64652e6a73310f300d" +
+      "06035504030c066167656e74313120301e06092a864886f70d010901161172794074696e" +
+      "79636c6f7564732e6f726730820122300d06092a864886f70d01010105000382010f0030" +
+      "82010a0282010100d456320afb20d3827093dc2c4284ed04dfbabd56e1ddae529e28b790" +
+      "cd4256db273349f3735ffd337c7a6363ecca5a27b7f73dc7089a96c6d886db0c62388f1c" +
+      "dd6a963afcd599d5800e587a11f908960f84ed50ba25a28303ecda6e684fbe7baedc9ce8" +
+      "801327b1697af25097cee3f175e400984c0db6a8eb87be03b4cf94774ba56fffc8c63c68" +
+      "d6adeb60abbe69a7b14ab6a6b9e7baa89b5adab8eb07897c07f6d4fa3d660dff574107d2" +
+      "8e8f63467a788624c574197693e959cea1362ffae1bba10c8c0d88840abfef103631b2e8" +
+      "f5c39b5548a7ea57e8a39f89291813f45a76c448033a2b7ed8403f4baa147cf35e2d2554" +
+      "aa65ce49695797095bf4dc6b0203010001a361305f305d06082b06010505070101045130" +
+      "4f302306082b060105050730018617687474703a2f2f6f6373702e6e6f64656a732e6f72" +
+      "672f302806082b06010505073002861c687474703a2f2f63612e6e6f64656a732e6f7267" +
+      "2f63612e63657274300d06092a864886f70d01010b05000382010100c3349810632ccb7d" +
+      "a585de3ed51e34ed154f0f7215608cf2701c00eda444dc2427072c8aca4da6472c1d9e68" +
+      "f177f99a90a8b5dbf3884586d61cb1c14ea7016c8d38b70d1b46b42947db30edc1e9961e" +
+      "d46c0f0e35da427bfbe52900771817e733b371adf19e12137235141a34347db0dfc05579" +
+      "8b1f269f3bdf5e30ce35d1339d56bb3c570de9096215433047f87ca42447b44e7e6b5d0e" +
+      "48f7894ab186f85b6b1a74561b520952fea888617f32f582afce1111581cd63efcc68986" +
+      "00d248bb684dedb9c3d6710c38de9e9bc21f9c3394b729d5f707d64ea890603e5989f8fa" +
+      "59c19ad1a00732e7adc851b89487cc00799dde068aa64b3b8fd976e8bc113ef2",
+    "hex",
+  );
+
+  const cert = new X509Certificate(der);
+  assertEquals(cert.checkHost("www.google.com"), undefined);
+  assertEquals(cert.checkHost("agent1"), "agent1");
+});

tests/unit_node/crypto/crypto_scrypt_test.ts

@@ -188,3 +188,13 @@ Deno.test("scryptSync with options works correctly", () => {
     ]),
   );
 });
+
+Deno.test("log_n > 64 doesn't panic", async () => {
+  const { promise, resolve } = Promise.withResolvers<void>();
+
+  scrypt("password", "salt", 128, () => {
+    resolve();
+  });
+
+  await promise;
+});

tests/unit_node/zlib_test.ts

@@ -5,6 +5,7 @@ import { fromFileUrl, relative } from "@std/path";
 import {
   brotliCompress,
   brotliCompressSync,
+  brotliDecompress,
   brotliDecompressSync,
   constants,
   crc32,
@@ -35,7 +36,11 @@ Deno.test("brotli compression async", async () => {
     })
   );
   assertEquals(compressed instanceof Buffer, true);
-  const decompressed = brotliDecompressSync(compressed);
+  const decompressed: Buffer = await new Promise((resolve) =>
+    brotliDecompress(compressed, (_, res) => {
+      return resolve(res);
+    })
+  );
   assertEquals(decompressed.toString(), "hello world");
 });
 

tools/core_import_map.json

@@ -156,7 +156,6 @@
     "ext:deno_node/internal/readline/symbols.mjs": "../ext/node/polyfills/internal/readline/symbols.mjs",
     "ext:deno_node/internal/readline/utils.mjs": "../ext/node/polyfills/internal/readline/utils.mjs",
     "ext:deno_node/internal/streams/add-abort-signal.mjs": "../ext/node/polyfills/internal/streams/add-abort-signal.mjs",
-    "ext:deno_node/internal/streams/buffer_list.mjs": "../ext/node/polyfills/internal/streams/buffer_list.mjs",
     "ext:deno_node/internal/streams/destroy.mjs": "../ext/node/polyfills/internal/streams/destroy.mjs",
     "node:_stream_duplex": "../ext/node/polyfills/internal/streams/duplex.mjs",
     "ext:deno_node/internal/streams/end-of-stream.mjs": "../ext/node/polyfills/internal/streams/end-of-stream.mjs",