Repository navigation
Conversation
Unchanged from v22.21.1, so this build uses the same Ubuntu images, g++-10 and configure flags as the Node 22 builds LunaServer runs today. The FIPS build still links the Ubuntu 22.04 OpenSSL 3.0 headers with --shared-openssl.
Ports the build workflows, build verification and staging script from the Node 26
branch (jrsells/node-v26.13.1-rhel8), which already work without fibers.
Compared with the v22.21.1 branch, this leaves out every fibers change:
- the V8 Isolate thread-local storage patch,
- the src/env.cc change that stopped creating the CppHeap,
- the realm.js change that exposed internalBinding('util') through process.binding('util'),
- the node-fibers workflow and Dockerfile, Dockerfile.Node20fips and build-local.sh.
codez no longer uses node-fibers or fiber_elimination_utils.ts, the only reader of
process.binding('util'), and its Node 26 builds already run without these patches.
The smoke test expects Node 22's shared-cage pointer compression and Maglev disabled,
matching the v22.21.1 builds.
Since 22.22.2, AstRawString::AsArrayIndex() decodes cached array indices with HashSeed(ReadOnlyHeap::GetReadOnlyRoots()), which only exists with V8_SHARED_RO_HEAP. configure turns the shared read-only heap off for --experimental-enable-pointer-compression builds, so ours don't compile (nodejs#62631). The proposed upstream fix, nodejs#62664, calls a GetReadOnlyRoots() that V8 12.4 doesn't have. Without a shared read-only heap there's no process-wide hash seed to decode the cached index with, so parse the index from the string's digits, as the function already does for longer strings. For strings short enough to cache an index, the result is the same.
jrsells
force-pushed
the
jrsells/node-v22.23.5-no-fibers
branch
from
November 15, 2026 00:07
b3bcefb to
a4efcff
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds Node 22.23.5, the latest Node 22 release, for LunaServer's FedRAMP images, which went back to Node 22 FIPS in Asana/codez#464403. Our Node 22 build is 22.21.1 plus one backported fix (CVE-2026-111497), so it misses the other fixes from the six Node 22 security releases since then: 22.22.0, 22.22.2, 22.23.0, 22.23.2, 22.23.4 and 22.23.5.
The base branch
v22.23.5is upstream'sv22.23.5tag, unchanged. This branch adds three commits:Dockerfile.Node22andDockerfile.Node22fipsfromv22.21.1, unchanged. The builds use the same Ubuntu images, g++-10 and configure flags as the 22.21.1 builds, and the FIPS build still links Ubuntu 22.04's OpenSSL 3.0 headers with--shared-openssl.Dockerfile.Node22fips. The smoke test expects Node 22's shared-cage pointer compression and Maglev turned off, matching the 22.21.1 builds.--experimental-enable-pointer-compressionsince 22.22.2 (nodejs/node#62631), which is why our Node 22 build stayed on 22.21.1 and why thev22.23.4port (Merge v22 patches from v22.21.1 branch #29) failed. A hash-flooding backport madeAstRawString::AsArrayIndex()callReadOnlyHeap::GetReadOnlyRoots(), which only exists with a shared read-only heap, andconfigureturns that off for pointer-compression builds. The proposed upstream fix (nodejs/node#62664) doesn't compile on V8 12.4. Here, without a shared read-only heap,AsArrayIndex()parses the index from the string's digits, as it already does for longer strings, instead of decoding the seeded cached index. That gives the same result.It drops every fibers change the
v22.21.1branch carries:Isolatethread-local storage patch;src/env.ccchange that stopped creating theCppHeap;realm.jschange that exposedinternalBinding('util')throughprocess.binding('util');Dockerfile.Node20fipsandbuild-local.sh.codez no longer uses node-fibers or
fiber_elimination_utils.ts, the only reader ofprocess.binding('util'), and its Node 26 builds already run without these patches.The builds derive the version from
src/node_version.h, so they publish to newnode-v22.23.5-releaseandnode-v22.23.5-fips-releaseslots. The Node 22 native packages codez already pins stay usable: the build keepsNODE_MODULE_VERSION127 and the same pointer-compression configuration.Test plan
All checks ran on linux-arm64, with the FIPS build on FedRAMP's FIPS base image (
lunaserver-fips-base), compared with the 22.21.1 builds:asana-verify-build.sh, which runs the smoke test on Ubuntu 22.04 and Wolfi.bcrypt,cld,unix-dgram,@datadog/pprof5.15.1) load on the standard and FIPS builds, and pprof's heap and CPU profiles work.test/parallelsuite: 3,885 passed and 7 failed, against 3,886 and 6 for upstream's official 22.23.5 binary on the same tests. The one extra failure,test-max-old-space-size-percentage, and one extra skip,test-experimental-shared-value-conveyor, come from the 4 GiB pointer-compression heap cage. Upstream CI doesn't build with pointer compression.