diff --git a/.github/workflows/android-emulator-tests.yml b/.github/workflows/android-emulator-tests.yml
index 30b9eff71c..0467a0ed7a 100644
--- a/.github/workflows/android-emulator-tests.yml
+++ b/.github/workflows/android-emulator-tests.yml
@@ -23,6 +23,16 @@ on:
required: false
default: ""
workflow_dispatch:
+ inputs:
+ build_run_id:
+ description: Build run containing the combined Android artifacts
+ type: string
+ required: true
+ flavor:
+ description: Runtime flavors available in that build
+ type: choice
+ options: [both, full, lite]
+ default: both
env:
ANDROID_NDK_VERSION: r29
@@ -51,7 +61,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- flavor: [full, lite]
+ flavor: ${{ fromJSON(inputs.flavor == 'lite' && '["lite"]' || inputs.flavor == 'full' && '["full"]' || '["full","lite"]') }}
runs-on: ubuntu-24.04
timeout-minutes: 90
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f0fa572fc0..5e82164aba 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -135,7 +135,7 @@ jobs:
# change to these flags must invalidate the cached libnode. Never in
# workflow env: it would leak into the iOS link, which Apple's ld
# rejects ("ld: unknown options: -z").
- ANDROID_LDFLAGS: "-Wl,-z,max-page-size=16384"
+ ANDROID_LDFLAGS: "-Wl,-z,max-page-size=16384 -Wl,-z,common-page-size=16384"
steps:
- uses: actions/checkout@v7
@@ -193,6 +193,7 @@ jobs:
# binary, so they must change the key.
H=$( { git rev-parse "HEAD:src" "HEAD:deps" "HEAD:lib" "HEAD:tools/v8_gypfiles" "HEAD:tools/gyp" "HEAD:tools/icu"; \
git hash-object node.gyp node.gypi common.gypi configure configure.py android-configure android_configure.py tools/android_build.sh tools/copy_libnode_headers.sh; \
+ if [ -f tools/android_openssl.sh ]; then git hash-object tools/android_openssl.sh; else echo no-android-openssl; fi; \
printf '%s\n' "$ANDROID_LDFLAGS" "$ANDROID_TARGET_SDK_VERSION"; \
} | git hash-object --stdin )
echo "key=rust${NODEJS_MOBILE_RUST_TOOLCHAIN}-libnode-android-${TARGET_ARCH}${FLAVOR_SUFFIX}-ndk${ANDROID_NDK_VERSION}-${H}" >> "$GITHUB_OUTPUT"
@@ -248,6 +249,18 @@ jobs:
run: |
./tools/android_build.sh $MY_ANDROID_NDK_HOME $ANDROID_TARGET_SDK_VERSION $TARGET_ARCH
+ # The Android build links a prebuilt static OpenSSL 4.x tree through
+ # --shared-openssl (docs/OPENSSL-4.md). Prove the shipped library carries
+ # it. Runs on cache hits too, where out_android is restored.
+ - name: Verify OpenSSL 4.x linkage
+ run: |
+ case "$TARGET_ARCH" in
+ arm) abi=armeabi-v7a ;;
+ arm64) abi=arm64-v8a ;;
+ x86_64) abi=x86_64 ;;
+ esac
+ grep -a -o -m1 'OpenSSL 4\.0\.[0-9]*' "out_android/$abi/libnode.so"
+
# NAPI/addon headers are static src/ + deps/ files (no build output, no
# toolchain), so stage them unconditionally — this survives a libnode cache
# hit (where the Build step is skipped) and lets combine-android just merge
diff --git a/.github/workflows/openssl4-android.yml b/.github/workflows/openssl4-android.yml
new file mode 100644
index 0000000000..527fcfb7d4
--- /dev/null
+++ b/.github/workflows/openssl4-android.yml
@@ -0,0 +1,132 @@
+name: OpenSSL 4 Android client
+
+on:
+ push:
+ branches: [openssl4/node26.12.0]
+ paths: [patches/**, mobile-src/**, expected-tree.txt, .github/workflows/openssl4-android.yml]
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: openssl4-android-${{ github.ref }}
+ cancel-in-progress: false
+
+env:
+ NODEJS_MOBILE_FLAVOR: lite
+ SCCACHE_IDLE_TIMEOUT: '0'
+ SCCACHE_LOG: warn
+
+jobs:
+ build:
+ runs-on: ubuntu-24.04
+ strategy:
+ fail-fast: false
+ matrix:
+ arch: [arm64, arm, x86_64]
+ env:
+ LDFLAGS: -Wl,-z,max-page-size=16384 -Wl,-z,common-page-size=16384
+ steps:
+ - uses: actions/checkout@v7
+ - uses: ./.github/actions/materialize
+ - name: Install build tools
+ run: |
+ sudo apt-get update
+ sudo apt-get install -y gcc-multilib g++-multilib clang-19
+ echo CC_host=clang-19 >> "$GITHUB_ENV"
+ echo CXX_host=clang++-19 >> "$GITHUB_ENV"
+ - uses: actions/setup-python@v6
+ with:
+ python-version: '3.13'
+ - run: python -m pip install setuptools packaging
+ - uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779
+ id: ndk
+ with:
+ ndk-version: r29
+ add-to-path: false
+ - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba
+ - uses: ./.github/actions/restore-compiler-cache
+ id: objects
+ with:
+ lane: android-${{ matrix.arch }}-lite-ndkr29
+ # This development workflow only uses the local cache. No R2 credentials,
+ # tags, releases or publication permissions enter this job.
+ - name: Build OpenSSL 4 and native QUIC
+ env:
+ NODEJS_MOBILE_SCCACHE: '1'
+ NDK: ${{ steps.ndk.outputs.ndk-path }}
+ ARCH: ${{ matrix.arch }}
+ run: |
+ ./tools/android_build.sh "$NDK" 24 "$ARCH"
+ ./tools/copy_libnode_headers.sh android
+ python tools/strip-android-runtime.py --ndk "$NDK" out_android
+ - name: Flush compiler objects
+ if: always() && steps.objects.outcome == 'success'
+ run: sccache --stop-server || true
+ - uses: actions/cache/save@v6
+ if: always() && steps.objects.outcome == 'success'
+ with:
+ path: ${{ runner.temp }}/nodejs-mobile-sccache
+ key: ${{ steps.objects.outputs.key }}
+ - uses: actions/upload-artifact@v7
+ with:
+ name: openssl4-${{ matrix.arch }}
+ path: out_android
+ retention-days: 30
+ package:
+ needs: build
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/download-artifact@v8
+ with:
+ pattern: openssl4-*
+ merge-multiple: true
+ path: out_android
+ - name: Package the verified ABI set
+ run: |
+ mkdir -p artifacts/bin artifacts/include
+ for abi in arm64-v8a armeabi-v7a x86_64; do
+ test -s "out_android/$abi/libnode.so"
+ grep -a -o -m1 'OpenSSL 4\.0\.3' "out_android/$abi/libnode.so"
+ cp -R "out_android/$abi" artifacts/bin/
+ done
+ cp -R out_android/libnode/include/* artifacts/include/
+ - uses: actions/upload-artifact@v7
+ with:
+ name: nodejs-mobile-android-lite
+ path: artifacts
+ retention-days: 90
+ smoke:
+ needs: package
+ runs-on: ubuntu-24.04
+ steps:
+ - uses: actions/checkout@v7
+ - uses: ./.github/actions/materialize
+ - uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779
+ id: ndk
+ with:
+ ndk-version: r29
+ add-to-path: false
+ - uses: actions/download-artifact@v8
+ with:
+ name: nodejs-mobile-android-lite
+ path: artifacts
+ - name: Enable KVM and build embedder
+ env:
+ NDK: ${{ steps.ndk.outputs.ndk-path }}
+ run: |
+ echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+ sudo udevadm control --reload-rules
+ sudo udevadm trigger --name-match=kvm
+ ./tools/mobile-test/smoke/build-android-embedder.sh "$NDK" x86_64 "$PWD/artifacts/bin/x86_64" "$PWD/node_smoke"
+ cp "$NDK/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android/libc++_shared.so" "$PWD/libc++_shared.so"
+ - uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d
+ with:
+ api-level: 30
+ arch: x86_64
+ target: default
+ force-avd-creation: false
+ emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
+ disable-animations: true
+ script: ./tools/mobile-test/smoke/run-android-smoke.sh "$PWD/node_smoke" "$PWD/artifacts/bin/x86_64/libnode.so" "$PWD/libc++_shared.so" && ./tools/mobile-test/smoke/run-android-quic-smoke.sh "$PWD/node_smoke" "$PWD/artifacts/bin/x86_64/libnode.so" "$PWD/libc++_shared.so"
diff --git a/README.md b/README.md
index f33e5725c4..b89f469428 100644
--- a/README.md
+++ b/README.md
@@ -9,16 +9,20 @@ in-app, with npm modules and N-API native addons.
| Android | `libnode.so` + headers | `arm64-v8a`, `armeabi-v7a`, `x86_64` (16 KB page size) |
| iOS | `NodeMobile.xcframework` | `arm64` device, `arm64` simulator |
-Current line: **Node.js 26** (`v26.11.0`, upstream PR preview).
-This checkout pins [official release proposal #66546](https://github.com/nodejs/node/pull/66546)
-at `49072a0be4c7410982557aebf5b5c924fe7db597`, before its merge/tag.
-Builds are CI previews; [provenance and validation](docs/UPSTREAM-26.11.md)
-record how to move to the official tag after release.
+Current line: **Node.js 26** (`v26.12.1`, official release).
+This checkout pins the official tag `v26.12.1` at commit
+`bc2e01dcf6acd5cf7d169b5f26cf89abaaeb41f1`. It is upstream's security
+release for the 26.12 line, and the patch series moves forward from the
+reviewed 26.12.0 line with no mobile-code changes beyond upstream context
+updates. [Provenance and validation](docs/UPSTREAM-26.11.md) record the
+rebase.
+Android builds link a prebuilt static OpenSSL 4.0.3 tree instead of the
+bundled 3.5.x line; see [Android OpenSSL 4.x](docs/OPENSSL-4.md).
The stable Node 24 line continues independently on [`recipe`](https://github.com/fogtape/nodejs-mobile/tree/recipe).
See [maintained version lines](docs/VERSION-LINES.md) for branch selection,
build instructions and download locations. `process.version` reports the
upstream version unchanged, so version-parsing tools keep working; the
-mobile build is identified by `process.versions.mobile` (e.g. `"26.11.0-0"`).
+mobile build is identified by `process.versions.mobile` (e.g. `"26.12.1-0"`).
## Get it
@@ -57,7 +61,7 @@ for building one — about 1.5 MB instead of a 1 GB fork:
| | |
|---|---|
-| `upstream-base.txt` | the pinned upstream PR commit (see [26.11 provenance](docs/UPSTREAM-26.11.md)) |
+| `upstream-base.txt` | the pinned upstream release tag (see [26.11 provenance](docs/UPSTREAM-26.11.md)) |
| `patches/` | per-concern patches to upstream files, plus `series` (apply order) and `files.map` (which patch owns which file) |
| `mobile-src/` | files that have no upstream counterpart — build scripts, the iOS framework project, test apps and harness |
| `expected-tree.txt` | the git tree hash the reconstruction must produce |
diff --git a/docs/BUILDING.md b/docs/BUILDING.md
index 38a3d95b75..8a58cf50aa 100644
--- a/docs/BUILDING.md
+++ b/docs/BUILDING.md
@@ -1,8 +1,8 @@
# Build Instructions
These instructions describe the Node 26 line. This checkout is the pinned
-26.11 upstream PR preview on `upgrade/node26.11-mobile-lite`;
-see [provenance](UPSTREAM-26.11.md). For Node 24,
+26.12 upstream line on `openssl4/node26.12.0`; see
+[provenance](UPSTREAM-26.11.md). For Node 24,
use the `recipe` branch and its toolchain instructions. See
[VERSION-LINES.md](VERSION-LINES.md) for the maintenance policy and the
Node 26 FFI/Temporal configuration.
@@ -88,7 +88,7 @@ sdkmanager "ndk;29.0.14206865"
This repository holds the recipe, not the source. Generate a tree from it:
```sh
-git clone -b upgrade/node26.11-mobile-lite https://github.com/fogtape/nodejs-mobile
+git clone -b openssl4/node26.12.0 https://github.com/fogtape/nodejs-mobile
cd nodejs-mobile && scripts/prepare.sh && cd out
```
@@ -120,6 +120,17 @@ make
# -> out/Release/lib.target/libnode.so
```
+### Android OpenSSL 4.x
+
+Android builds link a prebuilt static OpenSSL 4.x tree instead of the
+bundled 3.5.x line. `tools/android_build.sh` fetches and builds the pinned
+release asset per ABI (`tools/android_openssl.sh`, OpenSSL 4.0.3, SHA-256
+verified) and passes it to configure through
+`NODEJS_MOBILE_ANDROID_OPENSSL_DIR`; the linked `libnode.so` is checked for
+the embedded version string. Set `NODEJS_MOBILE_ANDROID_OPENSSL=0` to build
+against the bundled line instead. iOS is unaffected. Details, rationale and
+maintenance: [OPENSSL-4.md](OPENSSL-4.md).
+
---
## iOS — build on macOS
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index bd3a8c4850..b80052aa71 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -6,6 +6,9 @@
+26.12.1-0
+26.12.0-0
+26.11.1-0
26.11.0-0
26.10.0-0
26.1.0-0
@@ -42,6 +45,87 @@
|
+
+## 2026-10-21, Version 26.12.1-0 (Current)
+
+- Rebase onto the official Node.js `v26.12.1` security release
+ (`bc2e01dcf6acd5cf7d169b5f26cf89abaaeb41f1`); the regenerated series
+ changes only patch context and line numbers, and the mobile hunks in the
+ two upstream files it touches (`common.gypi`,
+ `src/crypto/crypto_context.cc`) are unchanged.
+- Pick up upstream's ten CVE fixes (four High): tls non-canonical IP
+ addresses and IP normalization, dns resolve null bytes, the http agent
+ data guard, brotli block-switch decoding, zlib ZIP local headers,
+ permission-model wildcard/`realpathSync` checks and crypto snapshot
+ random caches. Also carry c-ares 1.34.9, undici 8.12.2, root certificates
+ NSS 3.131.1 and the "synchronously load most ES modules" revert.
+- Android keeps the prebuilt static OpenSSL 4.0.3 tree with native ECH/H3,
+ so this release's bundled-OpenSSL 3.5.9 update does not apply to the
+ Android runtime. iOS and the bundled fallback keep their existing line.
+- Keep the danmu lite feature contract unchanged: complete ICU API with the
+ reviewed data profile, web encodings, Chinese collation and normalization;
+ omit Temporal, FFI, Inspector, SQLite/Web Storage, Amaro and SEA.
+- Exclude the new `test-crypto-random-cache-snapshot` regression on Android
+ and iOS: it builds and runs snapshots through `common/snapshot`, which
+ spawns child Node executables. The remaining new in-process regressions
+ (tls non-canonical IP and SPKI blocklist, dns null bytes, http agent
+ pending read, X.509 name conversion, permission audit `realpathSync`) stay
+ runnable.
+- Triage the rest of the full device suite. `test-crypto-x509` runs its
+ malformed-certificate legacy conversion in-process on both platforms
+ instead of in a child, and `test-fastutf8stream-flush-mocks` keeps every
+ in-process case while guarding only the one that needs a child with a
+ regular-file stdout. `test-bench-cli-ack`, `test-bench-run-exit-code`,
+ `test-common-wpt-allowed-rejections`, `test-permission-allow-fs-vfs-flags`
+ and `sequential/test-benchmark-node-bench-tools` are excluded because they
+ spawn child Node executables, and `test-sqlite-statement` because its
+ oversized-string cases outgrow the app heap.
+- Exclude `test-webcrypto-fips-refresh` on both platforms: switching the FIPS
+ provider at runtime does not finish inside the suite timeout on a device,
+ the same limitation that already excludes `test-crypto-fips`.
+- Android QUIC key-update and H3 regressions are excluded with their reason
+ recorded: seven tests abort inside ngtcp2 with
+ `conn->state == NGTCP2_CS_POST_HANDSHAKE` in `conn_initiate_key_update`.
+ They are unchanged by 26.12, so this belongs to the OpenSSL 4 QUIC line and
+ is carried as a follow-up rather than a regression of this upgrade; the
+ other 261 QUIC tests still run on Android.
+- This source upgrade does not itself switch `danmu-api-android` to 26.12.1.
+ A new runtime archive, checksum update and device validation are separate,
+ reviewed steps.
+
+
+## 2026-10-18, Version 26.12.0-0 (Current)
+
+- Rebase the mobile patch series onto the official Node.js `v26.12.0` tag
+ (`26e72d85a611e222e3f06025de8a3c496923bacd`). All 24 patches apply; the
+ OpenSSL 4 ECH/H3 and QUIC changes carry forward unchanged, and the
+ upstream-workflow removal patch absorbs 16 upstream workflow edits.
+- 26.12.0 is a regular Current minor release with no security designation:
+ V8, libuv, npm and OpenSSL versions are unchanged from 26.11.1. Relevant
+ mobile changes are upstream HTTP/stream/ESM fixes and the new
+ `http.websocketMask()` / `websocketUnmask()` helpers.
+- Keep the danmu lite feature contract unchanged: complete ICU API with the
+ reviewed data profile, web encodings, Chinese collation and normalization;
+ omit Temporal, FFI, Inspector, SQLite/Web Storage, Amaro and SEA. Android
+ retains JIT/native WASM, JNI/ECH/H3 and 16 KB page alignment.
+- This source upgrade does not itself switch `danmu-api-android` to 26.12.
+ A new runtime archive, checksum update and device validation are separate,
+ reviewed steps.
+
+
+## 2026-10-14, Version 26.11.1-0 (Current)
+
+- Rebase onto the official Node.js `v26.11.1` release tag
+ (`364593d0631def13e3043dd84f77ebca2c767ce5`); the regenerated series
+ changes only the upstream-workflow removal patch.
+- Android links a prebuilt static OpenSSL 4.0.3 tree built by
+ `tools/android_openssl.sh` (`--shared-openssl`, SHA-256-verified release
+ asset) instead of the bundled 3.5.x line. Android enables native QUIC/H3
+ with the vendored ngtcp2/nghttp3 libraries. TLS and QUIC client options
+ accept a mandatory ECHConfigList and expose authenticated acceptance;
+ rejected ECH cannot fall back to plaintext SNI. iOS and the bundled
+ OpenSSL fallback retain their previous library and no ECH support.
+
## 2026-10-07, Version 26.11.0-0 (Current)
diff --git a/docs/DANMU-LITE.md b/docs/DANMU-LITE.md
index 40fcef80f5..9803e9a0de 100644
--- a/docs/DANMU-LITE.md
+++ b/docs/DANMU-LITE.md
@@ -29,7 +29,7 @@ cannot be inferred from today's imports.
before/after trimming and lets icupkg validate package dependencies. A unique
intermediate package name prevents an installed host's full ICU from hiding
missing resources. The final conventional data entry point is preserved.
-With the Node 26.11 proposal’s bundled ICU data, the production helper
+With the Node 26.12 line’s bundled ICU data, the production helper
reduces 33,107,952 to 11,026,480 bytes (22,081,472 bytes removed). This
measures data only, not a complete newly compiled libnode or compressed ZIP.
diff --git a/docs/OPENSSL-4.md b/docs/OPENSSL-4.md
new file mode 100644
index 0000000000..aaec411f85
--- /dev/null
+++ b/docs/OPENSSL-4.md
@@ -0,0 +1,92 @@
+# Android OpenSSL 4.x
+
+Android builds on this line link a prebuilt, statically linked OpenSSL 4.0.3
+tree instead of Node's bundled 3.5.x. iOS and the fallback path keep the
+bundled line unchanged.
+
+OpenSSL 4 is connected to the client APIs on this branch. Android external-OpenSSL
+builds enable experimental QUIC and use Node's vendored ngtcp2 OpenSSL adapter
+and nghttp3; no external QUIC library or Go process is needed. iOS and the
+bundled fallback still build without ECH.
+
+## Client API (fork extension)
+
+- `require('node:tls').ECH_SUPPORTED` reports compile-time ECH support.
+- `tls.connect({ servername, echConfigList, ... })` accepts a binary
+ ECHConfigList (`Buffer` or another ArrayBufferView). A supplied config is
+ mandatory: certificate verification and TLS 1.3 are enforced inside OpenSSL,
+ and an unaccepted ECH handshake cannot become a successful JS connection.
+ `socket.echAccepted` and `socket.getECHStatus()` expose the outcome.
+- `node:quic.connect(address, { servername, echConfigList, verifyPeer:'strict' })`
+ applies the same policy. `await session.opened` includes `echAccepted`.
+ ECH disables session-ticket 0-RTT and prevents stream creation until its
+ handshake succeeds. Load the module with `--experimental-quic`.
+- ECH configuration discovery/TTL, protocol selection and safe retries belong
+ to the caller. No automatic plaintext-SNI fallback is implemented.
+
+`test-mobile-ech` covers input validation, unsupported bundled builds, and
+rejection without application-data leakage to an ordinary TLS server.
+Implementation validation is recorded separately from the earlier build below;
+that build predates these APIs and does not validate ECH/H3.
+
+## How it is built
+
+- `tools/android_openssl.sh` downloads the pinned release asset
+ (`openssl-4.0.3.tar.gz`), verifies its SHA-256, and configures it with the
+ NDK for the target ABI:
+ `no-shared no-module no-tests no-docs no-asm -fPIC --libdir=lib`.
+ `no-asm` mirrors the bundled builds this replaces (`--openssl-no-asm`).
+ The result is a static `libcrypto.a` / `libssl.a` tree under
+ `/../openssl4-android/prefix/-` (override with
+ `OPENSSL4_ROOT`).
+- `tools/android_build.sh` builds that tree per ABI and exports
+ `NODEJS_MOBILE_ANDROID_OPENSSL_DIR`.
+- `android_configure.py` passes `--shared-openssl --shared-openssl-includes=…`
+ (and drops `--openssl-no-asm`, incompatible with `--shared-openssl`) and
+ exports the library directory through `GYP_DEFINES`. `configure.py`'s
+ `configure_library` is patched so this mode adds only the include
+ directory: the normal shared-openssl path would put `-L…`/`-lssl`/`-lcrypto`
+ into the global libraries, which gyp applies to host tools and pre-libnode
+ targets (`node_js2c`, `nop`). `node.gypi` adds the link flags for the
+ node/libnode targets themselves.
+- The archives are linked into `libnode.so`; no new runtime `.so` files
+ ship with the app.
+
+## Verify
+
+- Every Android flavor/ABI build greps the artifact for the embedded
+ version and fails without it:
+ `grep -a -o -m1 'OpenSSL 4\.0\.[0-9]*' out_android//libnode.so`.
+ The Build workflow repeats this after restore, so cache hits are covered.
+- On device, `process.versions.openssl` reports `4.0.3`.
+- Android builds set both `max-page-size=16384` and `common-page-size=16384`.
+ `tools/check-android-elf.py` rejects a library unless every LOAD segment
+ has 16 KB alignment and congruent file/virtual offsets, and every GNU_RELRO
+ segment ends at a 16 KB boundary. Checking only LOAD alignment misses
+ libraries whose RELRO padding still uses 4 KB pages.
+
+## Validation record
+
+[Build run 38581872268](https://github.com/fogtape/nodejs-mobile/actions/runs/38581872268)
+(2026-10-14, tree `d41435800d43f8de4c6775704f8b477e371f93ee`) passed all six
+Android legs (full/lite × arm/arm64/x86_64) and all four iOS legs, both
+Android boot smokes and both Android curated suites. The full device suites
+are skipped on manual dispatches, so this is a preview gate, not a release
+run. Every Android job re-verified the embedded version string, and a
+downloaded `nodejs-mobile-android-lite` artifact carries `OpenSSL 4.0.3` in
+all three ABIs. That older run had QUIC disabled and did not contain the
+ECH client APIs described above.
+
+## Fall back to the bundled line
+
+```sh
+NODEJS_MOBILE_ANDROID_OPENSSL=0 ./tools/android_build.sh 24
+```
+
+## Maintenance
+
+- Bump `OPENSSL4_VERSION` and `OPENSSL4_SHA256` together in
+ `tools/android_openssl.sh`; the Android libnode cache key includes the
+ script's hash, so a stale library cannot be restored after a bump.
+- Prefer the latest 4.0.x patch release; ECH API stability matters more
+ than new features here.
diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md
index ca62a20868..219d312e63 100644
--- a/docs/UPGRADING.md
+++ b/docs/UPGRADING.md
@@ -23,7 +23,8 @@ PR snapshots can run normal builds and produce CI preview packages. Cut release
and prerelease publication reject a SHA baseline. After upstream releases,
compare the proposal commit with the official tag, rebase/regenerate as needed,
update the tree checksum, and complete the build/device gates before release
-preparation. The [26.11 preview](UPSTREAM-26.11.md) records the current pin.
+preparation. The [26.11 provenance](UPSTREAM-26.11.md) records the current
+pin and the earlier proposal snapshot.
## Re-base the series
diff --git a/docs/UPSTREAM-26.11.md b/docs/UPSTREAM-26.11.md
index c288573de1..30cc971005 100644
--- a/docs/UPSTREAM-26.11.md
+++ b/docs/UPSTREAM-26.11.md
@@ -1,4 +1,46 @@
-# Node 26.11 upstream PR preview
+# Node 26 upstream line
+
+`upstream-base.txt` pins the official tag `v26.12.1`
+(`bc2e01dcf6acd5cf7d169b5f26cf89abaaeb41f1`), upstream's security release
+for this line, which follows the reviewed 26.12.0 line described below. The
+rebase re-emitted the same 24 patches; only context and line-number changes
+differ, and the two mobile-owned upstream files this release touches
+(`common.gypi` and `src/crypto/crypto_context.cc`) keep their mobile hunks
+unchanged. The mobile version is `26.12.1-0`, and `expected-tree.txt`
+records the new source-tree checksum.
+
+The release carries ten CVE fixes, four of them High: tls non-canonical IP
+addresses and the IP-normalization regression, dns resolve null bytes, http
+agent data guard, brotli block-switch decoding, zlib ZIP local headers,
+permission-model wildcard and `realpathSync` checks, and crypto snapshot
+random caches. It also updates c-ares to 1.34.9, undici to 8.12.2 and the
+root certificates to NSS 3.131.1, and reverts "module: synchronously load
+most ES modules".
+
+On top of this line, Android links a prebuilt OpenSSL 4.0.3 static tree
+([OPENSSL-4.md](OPENSSL-4.md)); iOS and the bundled-OpenSSL fallback are
+unchanged. The OpenSSL 4 ECH/H3 APIs and QUIC patches apply unchanged to
+26.12.1; rebuild and device validation remain required before switching an
+app to this runtime. Android takes OpenSSL from that prebuilt 4.0.3 tree, so
+this release's bundled-OpenSSL 3.5.9 update does not reach the Android
+runtime.
+
+## Previous 26.12 line
+
+`upstream-base.txt` pinned the official tag `v26.12.0`
+(`26e72d85a611e222e3f06025de8a3c496923bacd`), which follows the reviewed
+26.11.1 line described below. The rebase re-emitted the same 24 patches;
+only context/line-number changes and the workflow-removal patch's updated
+upstream file contents differ. The mobile version was `26.12.0-0`.
+
+## Previous 26.11 line
+
+The 26.11.1 base was `364593d0631def13e3043dd84f77ebca2c767ce5`. The
+rebase from the 26.11.0 proposal snapshot re-emitted 21 of 22 patches
+byte-identically; the workflow removal patch absorbed upstream's
+`modify/delete` edits and kept the deletion. Build run 38581872268
+validated the OpenSSL 4 combination (details in
+[OPENSSL-4.md](OPENSSL-4.md)).
This recipe previews official Node.js release proposal
[#66546](https://github.com/nodejs/node/pull/66546), titled
@@ -167,7 +209,9 @@ proposal, and the source tag records the SHA. See [RELEASING.md](RELEASING.md).
## Move to the official release
-After upstream publishes `v26.11.0`, compare its commit against this pin,
+This branch performed the move: it pins `v26.11.1`, the patch release that
+followed the snapshot. The procedure, retained for the record: after
+upstream publishes a release, compare its commit against this pin,
review any additional changes, update `upstream-base.txt` to the official tag,
regenerate the recipe and checksum, and rerun the platform/device gates.
Default Cut release and publication still reject SHA baselines. After the
diff --git a/docs/VERSION-LINES.md b/docs/VERSION-LINES.md
index 57a26d4f42..7f66b85612 100644
--- a/docs/VERSION-LINES.md
+++ b/docs/VERSION-LINES.md
@@ -7,12 +7,14 @@ versioned together on that branch.
| Branch | Upstream base | Purpose | Outputs |
| --- | --- | --- | --- |
| `recipe` | Node.js 24.21.0 | Stable Node 24 maintenance and releases | Android and iOS, full and lite |
-| `recipe-v26` | Node.js 26.11.0 proposal at a pinned SHA | Independent Node 26 maintenance and explicit upstream snapshot prereleases | Android and iOS, full and lite |
+| `recipe-v26` | Node.js 26.12.1 (official tag) | Independent Node 26 maintenance and releases | Android and iOS, full and lite |
-For Node 26.11, clone `recipe-v26`; the reviewed upgrade is merged and pins
-an immutable commit. Snapshot publication requires an explicit full-SHA
-input in both manual workflows and its reviewed release marker; default
-releases require an official upstream tag. See [26.11 provenance](UPSTREAM-26.11.md).
+For Node 26, clone `recipe-v26`; the line now pins the official
+`v26.12.1` tag, upstream's security release for this line. The earlier
+26.11.0 proposal snapshot — and the explicit full-SHA input its publication
+required — stays documented in [26 line provenance](UPSTREAM-26.11.md).
+Default releases require an official upstream tag and a reviewed release
+marker.
The authoritative base is always `upstream-base.txt` on the selected branch.
Updating Node 26 does not change the Node 24 recipe or replace its published
@@ -46,8 +48,12 @@ partition and expected source-tree checksum.
The Node 26 line uses Android NDK r29 (`29.0.14206865`) and Clang 19 for
Linux host tools. Node 24 keeps its existing NDK r27d configuration.
+Android also links a prebuilt static OpenSSL 4.0.3 tree instead of the
+bundled 3.5.x line. The fork also exposes mandatory `echConfigList` client
+options in TLS and QUIC and enables Android native H3; see
+[OPENSSL-4.md](OPENSSL-4.md) for the API and validation record.
-This Node 26.11 preview’s full builds enable V8 Temporal and the experimental `node:ffi`
+This Node 26 line’s full builds enable V8 Temporal and the experimental `node:ffi`
module on Android and iOS, with complete ICU data (`--with-intl=full-icu`)
for named time zones. small-ICU cannot load Temporal timezone information
in this upstream version. The build requires Rust **1.86.0** and its standard
@@ -94,7 +100,7 @@ run URL with the downloaded files; do not mix platform slices or flavors
from different runs. Versioned preview packages additionally contain
`BUILD-INFO.json` and are accompanied by `SHA256SUMS`.
-This preview reports `process.version` as `v26.11.0`; `process.versions.mobile` identifies
+The line reports `process.version` as `v26.12.1`; `process.versions.mobile` identifies
the mobile build revision. A CI preview is not a published release. **Cut release** also supports
`recipe-v26`; its reviewed PR arms a specific version; after merge, manually run **Build**
with `operation=prerelease` and that exact mobile version. Push/PR builds do
diff --git a/expected-tree.txt b/expected-tree.txt
index 1547f16ce6..15fcb348f1 100644
--- a/expected-tree.txt
+++ b/expected-tree.txt
@@ -14,4 +14,4 @@
# run prepare.sh (or regenerate-patches.py, which prints the hash) and
# update the value below in the same commit. If you forget, CI fails and
# prints the hash it got.
-366de32e0018c646ea07608448b694716229b35b
+13d9529a0c8066f4150137187ac1e79f123a44b4
diff --git a/mobile-src/src/crypto/crypto_ech.h b/mobile-src/src/crypto/crypto_ech.h
new file mode 100644
index 0000000000..3e6082d3df
--- /dev/null
+++ b/mobile-src/src/crypto/crypto_ech.h
@@ -0,0 +1,50 @@
+#pragma once
+
+#include
+#include
+#include
+
+#if OPENSSL_VERSION_NUMBER >= 0x40000000L && !defined(OPENSSL_NO_ECH)
+#include
+#define NODE_HAVE_ECH 1
+#else
+#define NODE_HAVE_ECH 0
+#endif
+
+namespace node::crypto {
+
+// Supplying an ECHConfigList always requires authenticated ECH. OpenSSL's
+// ECH_REQUIRED alert handles rejection; neither TLS nor QUIC may retry with
+// cleartext SNI. Verify inside OpenSSL as well as in JS so the outer server
+// cannot authenticate retry configs using Node's permissive verify callback.
+inline bool ConfigureECH(SSL* ssl, const uint8_t* config, size_t length) {
+#if NODE_HAVE_ECH
+ if (SSL_set1_ech_config_list(ssl, config, length) != 1 ||
+ SSL_set_min_proto_version(ssl, TLS1_3_VERSION) != 1) {
+ return false;
+ }
+ SSL_set_verify(ssl, SSL_VERIFY_PEER, nullptr);
+ return true;
+#else
+ (void)ssl;
+ (void)config;
+ (void)length;
+ return false;
+#endif
+}
+
+inline int GetECHStatus(SSL* ssl) {
+#if NODE_HAVE_ECH
+ char* inner = nullptr;
+ char* outer = nullptr;
+ const int status = SSL_ech_get1_status(ssl, &inner, &outer);
+ OPENSSL_free(inner);
+ OPENSSL_free(outer);
+ return status;
+#else
+ (void)ssl;
+ return -103; // SSL_ECH_STATUS_NOT_CONFIGURED
+#endif
+}
+
+} // namespace node::crypto
diff --git a/mobile-src/src/node_mobile_version.h b/mobile-src/src/node_mobile_version.h
index 4dd80bfb8f..21dcb4ed5a 100644
--- a/mobile-src/src/node_mobile_version.h
+++ b/mobile-src/src/node_mobile_version.h
@@ -4,8 +4,8 @@
#include "node_version.h"
#define NODE_MOBILE_MAJOR_VERSION 26
-#define NODE_MOBILE_MINOR_VERSION 11
-#define NODE_MOBILE_PATCH_VERSION 0
+#define NODE_MOBILE_MINOR_VERSION 12
+#define NODE_MOBILE_PATCH_VERSION 1
// Mobile rebuild revision of the same upstream Node version: the -R in the
// vX.Y.Z-R release tag. Computed and bumped by the Cut release workflow
diff --git a/mobile-src/test/parallel/test-mobile-ech.js b/mobile-src/test/parallel/test-mobile-ech.js
new file mode 100644
index 0000000000..d1b852f22f
--- /dev/null
+++ b/mobile-src/test/parallel/test-mobile-ech.js
@@ -0,0 +1,60 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+const assert = require('assert');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+const { generateKeyPairSync } = require('crypto');
+
+assert.strictEqual(typeof tls.ECH_SUPPORTED, 'boolean');
+assert.strictEqual(typeof tls.TLSSocket.prototype.getECHStatus, 'function');
+if (process.platform === 'android' && /^4\./.test(process.versions.openssl)) {
+ assert.strictEqual(tls.ECH_SUPPORTED, true);
+ assert.strictEqual(String(process.config.variables.node_use_quic), 'true');
+}
+assert.throws(() => tls.connect({ echConfigList: 'invalid' }),
+ { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => tls.connect({ echConfigList: Buffer.alloc(0) }),
+ { code: 'ERR_INVALID_ARG_VALUE' });
+
+if (!tls.ECH_SUPPORTED) {
+ assert.throws(() => tls.connect({
+ servername: 'localhost', echConfigList: Buffer.from([0, 0]),
+ }), { code: 'ERR_INVALID_ARG_VALUE' });
+} else {
+ // RFC 9849 ECHConfigList with a fresh public key. The ordinary local TLS
+ // server has no ECH key: the client MUST fail without sending application
+ // bytes, even when the caller queues a write before secureConnect.
+ const { publicKey } = generateKeyPairSync('x25519');
+ const key = publicKey.export({ type: 'spki', format: 'der' }).subarray(-32);
+ const name = Buffer.from('localhost');
+ const content = Buffer.concat([
+ Buffer.from([1, 0, 32, 0, 32]), key,
+ Buffer.from([0, 4, 0, 1, 0, 1, 0, name.length]), name,
+ Buffer.from([0, 0]),
+ ]);
+ const config = Buffer.concat([
+ Buffer.from([0, content.length + 4, 0xfe, 0x0d, 0, content.length]), content,
+ ]);
+ assert.throws(() => tls.connect({ servername: 'localhost',
+ rejectUnauthorized: false, echConfigList: config }),
+ { code: 'ERR_INVALID_ARG_VALUE' });
+ const server = tls.createServer({
+ key: fixtures.readKey('agent1-key.pem'),
+ cert: fixtures.readKey('agent1-cert.pem'),
+ }, (socket) => {
+ socket.on('data', common.mustNotCall('ECH rejection leaked application data'));
+ socket.on('error', () => {});
+ });
+ server.on('tlsClientError', () => {});
+ server.listen(0, '127.0.0.1', common.mustCall(() => {
+ const socket = tls.connect({
+ host: '127.0.0.1', port: server.address().port, servername: 'localhost',
+ ca: fixtures.readKey('agent1-cert.pem'), echConfigList: config,
+ }, common.mustNotCall('ECH rejection emitted secureConnect'));
+ socket.write('must stay encrypted to the intended ECH server', () => {});
+ socket.once('error', common.mustCall(() => server.close()));
+ socket.setTimeout(5000, () => socket.destroy(new Error('ECH test timed out')));
+ }));
+}
diff --git a/mobile-src/tools/android_build.sh b/mobile-src/tools/android_build.sh
index 6efc2ffcd0..cce10df816 100755
--- a/mobile-src/tools/android_build.sh
+++ b/mobile-src/tools/android_build.sh
@@ -22,11 +22,23 @@ ANDROID_NDK_PATH=${PWD}
cd "$SCRIPT_DIR"
cd ../
+# Keep RELRO padding and load segments compatible with 16 KB devices, including
+# local builds that do not inherit the CI job's linker flags.
+export LDFLAGS="${LDFLAGS:-} -Wl,-z,max-page-size=16384 -Wl,-z,common-page-size=16384"
+
BUILD_ARCH() {
# Clean previous compilation
make clean
rm -rf android-toolchain/
+ # Android links a prebuilt static OpenSSL 4.x tree (see docs/OPENSSL-4.md
+ # on the recipe branch). NODEJS_MOBILE_ANDROID_OPENSSL=0 keeps the bundled
+ # 3.5.x path for comparison builds.
+ if [ "${NODEJS_MOBILE_ANDROID_OPENSSL:-1}" != "0" ]; then
+ NODEJS_MOBILE_ANDROID_OPENSSL_DIR=$(bash "$SCRIPT_DIR/android_openssl.sh" "$ANDROID_NDK_PATH" "$ANDROID_SDK_VERSION" "$TARGET_ARCH")
+ export NODEJS_MOBILE_ANDROID_OPENSSL_DIR
+ fi
+
# Compile
eval '"./android-configure" "$ANDROID_NDK_PATH" $ANDROID_SDK_VERSION $TARGET_ARCH'
make -j $(getconf _NPROCESSORS_ONLN)
@@ -51,11 +63,17 @@ BUILD_ARCH() {
echo "Could not find libnode.so file after compilation"
exit 1
fi
+ if [ "${NODEJS_MOBILE_ANDROID_OPENSSL:-1}" != "0" ]; then
+ # Prove the artifact really carries the external OpenSSL line.
+ grep -a -o -m1 'OpenSSL 4\.0\.[0-9]*' "out_android/$TARGET_ARCH_FOLDER/libnode.so" \
+ || { echo "libnode.so does not embed the external OpenSSL 4.x build" >&2; exit 1; }
+ fi
# Keep the linked build output for debugging; only trim the copied lite SDK.
if [ "${NODEJS_MOBILE_FLAVOR:-full}" = "lite" ]; then
python3 tools/strip-android-runtime.py --ndk "$ANDROID_NDK_PATH" \
"out_android/$TARGET_ARCH_FOLDER/libnode.so"
fi
+ python3 tools/check-android-elf.py "out_android/$TARGET_ARCH_FOLDER/libnode.so"
}
if [ $# -eq 2 ]; then
diff --git a/mobile-src/tools/android_openssl.sh b/mobile-src/tools/android_openssl.sh
new file mode 100755
index 0000000000..687309a40a
--- /dev/null
+++ b/mobile-src/tools/android_openssl.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Build a static OpenSSL 4.x tree for one Android ABI and print its prefix.
+#
+# The Android nodejs-mobile build links libnode.so against this tree through
+# --shared-openssl (android_configure.py reads NODEJS_MOBILE_ANDROID_OPENSSL_DIR).
+# Upstream Node bundles the OpenSSL 3.5.x line; 4.x is the prerequisite for
+# ECH-capable runtimes (docs/OPENSSL-4.md on the recipe branch).
+#
+# Usage: tools/android_openssl.sh
+#
+# Environment overrides:
+# OPENSSL4_VERSION OpenSSL version to build (default 4.0.3)
+# OPENSSL4_SHA256 Expected tarball checksum (default: 4.0.3 release asset)
+# OPENSSL4_ROOT Build root (default: /../openssl4-android)
+set -euo pipefail
+
+OPENSSL4_VERSION=${OPENSSL4_VERSION:-4.0.3}
+OPENSSL4_SHA256=${OPENSSL4_SHA256:-325b5c806167c13b40b1ffeadfe0248197c00eccc4cf123ec1e28d2d2fd216d9}
+
+NDK=${1:?usage: android_openssl.sh }
+API=${2:?usage: android_openssl.sh }
+ARCH=${3:?usage: android_openssl.sh }
+
+case "$ARCH" in
+ arm) TARGET=android-arm ;;
+ arm64) TARGET=android-arm64 ;;
+ x86_64) TARGET=android-x86_64 ;;
+ *) echo "unsupported arch: $ARCH" >&2; exit 1 ;;
+esac
+
+ROOT=${OPENSSL4_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)/../openssl4-android}
+SRC="$ROOT/src/$ARCH/openssl-$OPENSSL4_VERSION"
+PREFIX="$ROOT/prefix/$ARCH-$OPENSSL4_VERSION"
+STAMP="$PREFIX/.openssl-$OPENSSL4_VERSION.built"
+
+if [ -f "$PREFIX/lib/libssl.a" ] && [ -f "$STAMP" ]; then
+ echo "$PREFIX"
+ exit 0
+fi
+
+TOOLCHAIN="$NDK/toolchains/llvm/prebuilt/linux-x86_64"
+[ -d "$TOOLCHAIN" ] || TOOLCHAIN="$NDK/toolchains/llvm/prebuilt/darwin-x86_64"
+[ -d "$TOOLCHAIN" ] || { echo "no NDK LLVM toolchain under $NDK" >&2; exit 1; }
+
+mkdir -p "$ROOT/src/$ARCH"
+if [ ! -d "$SRC" ]; then
+ TARBALL="$ROOT/openssl-$OPENSSL4_VERSION.tar.gz"
+ if [ ! -f "$TARBALL" ]; then
+ echo "Fetching OpenSSL $OPENSSL4_VERSION..." >&2
+ curl -fsSL --retry 3 --retry-delay 2 -o "$TARBALL.download" \
+ "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL4_VERSION/openssl-$OPENSSL4_VERSION.tar.gz"
+ mv "$TARBALL.download" "$TARBALL"
+ fi
+ echo "$OPENSSL4_SHA256 $TARBALL" | sha256sum -c - >&2
+ tar -xzf "$TARBALL" -C "$ROOT/src/$ARCH"
+fi
+
+cd "$SRC"
+export ANDROID_NDK_ROOT="$NDK"
+export PATH="$TOOLCHAIN/bin:$PATH"
+
+# no-asm mirrors the bundled builds this replaces; -fPIC because the static
+# archives are linked into libnode.so; no-module/no-tests/no-docs keep the
+# tree minimal. --libdir=lib: OpenSSL would otherwise install into lib64 on
+# some hosts.
+./Configure "$TARGET" -D__ANDROID_API__="$API" \
+ no-shared no-module no-tests no-docs no-asm \
+ -fPIC --libdir=lib --prefix="$PREFIX" --openssldir="$PREFIX/ssl" >&2
+make -j"$(getconf _NPROCESSORS_ONLN)" >&2
+make install_sw >&2
+touch "$STAMP"
+echo "$PREFIX"
diff --git a/mobile-src/tools/check-android-elf.py b/mobile-src/tools/check-android-elf.py
new file mode 100644
index 0000000000..d0f35469bd
--- /dev/null
+++ b/mobile-src/tools/check-android-elf.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Check Android shared libraries' LOAD and RELRO alignment using ELF headers."""
+import pathlib
+import struct
+import sys
+
+
+def check(path):
+ data = path.read_bytes()
+ if data[:4] != b'\x7fELF' or data[4] not in (1, 2) or data[5] != 1:
+ raise ValueError('expected a little-endian ELF32/ELF64 library')
+ is64 = data[4] == 2
+ phoff = struct.unpack_from(' len(data):
+ raise ValueError('invalid program header table')
+ loads = 0
+ for index in range(count):
+ fields = struct.unpack_from(' {
+ sessions.push(session);
+ session.closed.catch(() => {});
+ session.onstream = (stream) => stream.closed.catch(() => {});
+ }, {
+ sni: { '*': { keys: [key], certs: [cert] } },
+ onheaders(headers) {
+ assert.equal(headers[':method'], 'GET');
+ this.sendHeaders({ ':status': '200', 'content-type': 'text/plain' });
+ this.writer.writeSync(Buffer.from('native-h3'));
+ this.writer.endSync();
+ },
+ });
+ client = await connect(endpoint.address, {
+ servername: 'localhost', ca: cert, verifyPeer: 'strict',
+ keepAlive: 0, enableEarlyData: false,
+ });
+ client.closed.catch(() => {});
+ assert.equal((await client.opened).protocol, 'h3');
+ let resolveHeaders;
+ const received = new Promise((resolve) => { resolveHeaders = resolve; });
+ const stream = await client.createBidirectionalStream({
+ headers: { ':method': 'GET', ':scheme': 'https', ':authority': 'localhost', ':path': '/' },
+ onheaders(headers) { resolveHeaders(headers); },
+ });
+ assert.equal((await received)[':status'], 200);
+ const chunks = [];
+ for await (const batch of stream) {
+ for (const chunk of Array.isArray(batch) ? batch : [batch]) chunks.push(Buffer.from(chunk));
+ }
+ assert.equal(Buffer.concat(chunks).toString(), 'native-h3');
+ console.log('NODEJS_MOBILE_QUIC_H3_OK');
+ } finally {
+ const clientEndpoint = client?.endpoint;
+ client?.destroy();
+ await clientEndpoint?.close();
+ for (const session of sessions) session.destroy();
+ await endpoint?.close();
+ }
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
diff --git a/mobile-src/tools/mobile-test/smoke/run-android-quic-smoke.sh b/mobile-src/tools/mobile-test/smoke/run-android-quic-smoke.sh
new file mode 100755
index 0000000000..c4dc2bd22c
--- /dev/null
+++ b/mobile-src/tools/mobile-test/smoke/run-android-quic-smoke.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Device-only H3 regression: the first server Initial must not use an old clock.
+set -euo pipefail
+EMBEDDER=$1
+LIBNODE=$2
+LIBCXX=$3
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+DEST=/data/local/tmp/nm-quic-smoke
+adb shell "mkdir -p $DEST"
+adb push "$EMBEDDER" "$DEST/node_smoke" >/dev/null
+adb push "$LIBNODE" "$DEST/libnode.so" >/dev/null
+adb push "$LIBCXX" "$DEST/libc++_shared.so" >/dev/null
+adb push "$SCRIPT_DIR/quic-h3.js" "$DEST/quic-h3.js" >/dev/null
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
+ -subj /CN=localhost -addext subjectAltName=DNS:localhost \
+ -keyout "$RUNNER_TEMP/quic-key.pem" -out "$RUNNER_TEMP/quic-cert.pem" -days 1
+adb push "$RUNNER_TEMP/quic-key.pem" "$DEST/key.pem" >/dev/null
+adb push "$RUNNER_TEMP/quic-cert.pem" "$DEST/cert.pem" >/dev/null
+adb shell "chmod 755 $DEST/node_smoke"
+OUTPUT=$(adb shell "cd $DEST && LD_LIBRARY_PATH=$DEST TMPDIR=$DEST timeout 30 ./node_smoke --experimental-quic quic-h3.js; echo QUIC_EXIT:\$?")
+echo "$OUTPUT"
+grep -q NODEJS_MOBILE_QUIC_H3_OK <<< "$OUTPUT"
+grep -q QUIC_EXIT:0 <<< "$OUTPUT"
diff --git a/patches/build-Android-iOS-dest-os-and-toolchain-configure.py.patch b/patches/build-Android-iOS-dest-os-and-toolchain-configure.py.patch
index d5358b0de8..e1760eee6c 100644
--- a/patches/build-Android-iOS-dest-os-and-toolchain-configure.py.patch
+++ b/patches/build-Android-iOS-dest-os-and-toolchain-configure.py.patch
@@ -26,15 +26,15 @@ Co-authored-by: Vincent Breitmoser
Signed-off-by: fogtape
Assisted-by: Codex
---
- android_configure.py | 76 +++++++++++++++++++++++++++++++++++---------
- configure.py | 8 +++++
- 2 files changed, 69 insertions(+), 15 deletions(-)
+ android_configure.py | 98 +++++++++++++++++++++++++++++++++++++-------
+ configure.py | 16 ++++++++
+ 2 files changed, 99 insertions(+), 15 deletions(-)
diff --git a/android_configure.py b/android_configure.py
-index 5cea0393f4..c76ec94c8f 100644
+index 5cea0393f4..b1a1c6f827 100644
--- a/android_configure.py
+++ b/android_configure.py
-@@ -1,25 +1,14 @@
+@@ -1,25 +1,15 @@
import platform
import sys
import os
@@ -46,6 +46,7 @@ index 5cea0393f4..c76ec94c8f 100644
- if platform.system() == "Linux":
- os.system('patch -f ./deps/v8/src/trap-handler/trap-handler.h < ./android-patches/trap-handler.h.patch')
- print("\033[92mInfo: \033[0m" + "Tried to patch.")
++import shlex
+import shutil
if platform.system() != "Linux" and platform.system() != "Darwin":
@@ -62,7 +63,7 @@ index 5cea0393f4..c76ec94c8f 100644
sys.exit(1)
if not os.path.exists(sys.argv[1]) or not os.listdir(sys.argv[1]):
-@@ -55,7 +44,7 @@ else:
+@@ -55,7 +45,7 @@ else:
print("\033[92mInfo: \033[0m" + "Configuring for " + DEST_CPU + "...")
if platform.system() == "Darwin":
@@ -71,7 +72,7 @@ index 5cea0393f4..c76ec94c8f 100644
toolchain_path = android_ndk_path + "/toolchains/llvm/prebuilt/darwin-x86_64"
elif platform.system() == "Linux":
-@@ -65,13 +54,70 @@ elif platform.system() == "Linux":
+@@ -65,13 +55,91 @@ elif platform.system() == "Linux":
os.environ['PATH'] += os.pathsep + toolchain_path + "/bin"
os.environ['CC'] = toolchain_path + "/bin/" + TOOLCHAIN_PREFIX + android_sdk_version + "-" + "clang"
os.environ['CXX'] = toolchain_path + "/bin/" + TOOLCHAIN_PREFIX + android_sdk_version + "-" + "clang++"
@@ -137,14 +138,35 @@ index 5cea0393f4..c76ec94c8f 100644
+ # from it, and two parallel tests branch on it).
+ if arch in ("arm64", "x64"):
+ extra_flags += " --experimental-enable-pointer-compression"
++
++# Android OpenSSL line selection:
++# - default: the bundled OpenSSL tree (3.5.x) with --openssl-no-asm, as before.
++# - NODEJS_MOBILE_ANDROID_OPENSSL_DIR set (tools/android_build.sh builds the
++# tree via tools/android_openssl.sh): link the prebuilt static OpenSSL 4.x
++# tree. configure.py adds only its include directory (patched
++# configure_library); the -L/-l flags travel through GYP_DEFINES and are
++# applied by node.gypi to the node/libnode targets, because global
++# libraries would also reach host tools and non-node targets (node_js2c
++# and nop link before libnode does). --openssl-no-asm is a bundled-tree
++# option and is incompatible with --shared-openssl, so it is dropped on
++# this path.
++openssl_flags = " --openssl-no-asm"
++openssl_dir = os.environ.get("NODEJS_MOBILE_ANDROID_OPENSSL_DIR", "").strip()
++if openssl_dir:
++ if not os.path.isdir(openssl_dir):
++ print("\033[91mError: \033[0m" + "NODEJS_MOBILE_ANDROID_OPENSSL_DIR is not a directory: " + openssl_dir)
++ sys.exit(1)
++ GYP_DEFINES += " nodejs_mobile_openssl_libpath=" + openssl_dir + "/lib"
++ openssl_flags = (" --experimental-quic --shared-openssl"
++ " --shared-openssl-includes=" + shlex.quote(openssl_dir + "/include"))
+
os.environ['GYP_DEFINES'] = GYP_DEFINES
if os.path.exists("./configure"):
- os.system("./configure --dest-cpu=" + DEST_CPU + " --dest-os=android --openssl-no-asm --cross-compiling")
-+ sys.exit(os.system("./configure --dest-cpu=" + DEST_CPU + " --dest-os=android --openssl-no-asm --with-intl=" + intl + extra_flags + " --cross-compiling --shared") >> 8)
++ sys.exit(os.system("./configure --dest-cpu=" + DEST_CPU + " --dest-os=android --with-intl=" + intl + extra_flags + openssl_flags + " --cross-compiling --shared") >> 8)
diff --git a/configure.py b/configure.py
-index acda6a16c9..c44509883d 100755
+index a3769ff2d8..c052538d46 100755
--- a/configure.py
+++ b/configure.py
@@ -1304,6 +1304,11 @@ parser.add_argument('-C',
@@ -169,3 +191,18 @@ index acda6a16c9..c44509883d 100755
if options.dest_os == 'android':
o['variables']['OS'] = 'android'
o['variables']['node_enable_experimentals'] = b(options.enable_all_experimentals)
+@@ -2201,6 +2209,14 @@ def configure_library(lib, output, pkgname=None, libraries_key='libraries'):
+ libraries = output[libraries_key]
+
+ if getattr(options, shared_lib):
++ # nodejs-mobile: the Android build links the external OpenSSL tree from
++ # node.gypi, scoped to the node targets. Adding -L/-l here would put them
++ # into the global libraries, which gyp applies to host tools and every
++ # other target (node_js2c, nop). Only the include directory is global.
++ if lib == 'openssl' and os.environ.get('NODEJS_MOBILE_ANDROID_OPENSSL_DIR'):
++ if options.shared_openssl_includes:
++ output['include_dirs'] += [options.shared_openssl_includes]
++ return
+ (pkg_libs, pkg_cflags, pkg_libpath, _) = pkg_config(pkgname or lib)
+
+ if options.__dict__[shared_lib + '_includes']:
diff --git a/patches/build-mobile-platform-settings-in-common.gypi.patch b/patches/build-mobile-platform-settings-in-common.gypi.patch
index 6e9e0f6483..a64aa551ad 100644
--- a/patches/build-mobile-platform-settings-in-common.gypi.patch
+++ b/patches/build-mobile-platform-settings-in-common.gypi.patch
@@ -23,7 +23,7 @@ Co-authored-by: João Matos
1 file changed, 118 insertions(+), 7 deletions(-)
diff --git a/common.gypi b/common.gypi
-index de80a68f49..fd3394b5cb 100644
+index 2967d1e63a..9c9c39fb75 100644
--- a/common.gypi
+++ b/common.gypi
@@ -111,7 +111,7 @@
diff --git a/patches/build-mobile-targets-in-node.gyp-node.gypi.patch b/patches/build-mobile-targets-in-node.gyp-node.gypi.patch
index 2f72b2f2e5..04d224db26 100644
--- a/patches/build-mobile-targets-in-node.gyp-node.gypi.patch
+++ b/patches/build-mobile-targets-in-node.gyp-node.gypi.patch
@@ -22,15 +22,27 @@ Co-authored-by: Julia Samól
Signed-off-by: fogtape
Assisted-by: Codex
---
- node.gyp | 18 +++++++++++++++---
- node.gypi | 22 ++++++++++++++++++----
- 2 files changed, 33 insertions(+), 7 deletions(-)
+ node.gyp | 23 ++++++++++++++++++++---
+ node.gypi | 51 +++++++++++++++++++++++++++++++++++++++++++--------
+ 2 files changed, 63 insertions(+), 11 deletions(-)
diff --git a/node.gyp b/node.gyp
-index 587df5cace..c1d6e6735f 100644
+index 5334b8a746..ca26defa34 100644
--- a/node.gyp
+++ b/node.gyp
-@@ -77,6 +77,11 @@
+@@ -29,6 +29,11 @@
+ 'node_shared_nbytes%': 'false',
+ 'node_shared_nghttp2%': 'false',
+ 'node_shared_openssl%': 'false',
++ # nodejs-mobile: lib directory of an external OpenSSL tree to link into
++ # the node targets (empty = bundled OpenSSL). android_configure.py sets it
++ # through GYP_DEFINES; node.gypi applies the -L/-l flags so that host
++ # tools never see the target ABI's archives.
++ 'nodejs_mobile_openssl_libpath%': '',
+ 'node_shared_perfetto%': 'false',
+ 'node_shared_sqlite%': 'false',
+ 'node_shared_ffi%': 'false',
+@@ -78,6 +83,11 @@
'deps/acorn/acorn/dist/acorn.js',
'deps/acorn/acorn-walk/dist/walk.js',
'deps/minimatch/index.js',
@@ -42,7 +54,7 @@ index 587df5cace..c1d6e6735f 100644
'<@(node_builtin_shareable_builtins)',
],
'node_sources': [
-@@ -580,6 +585,11 @@
+@@ -581,6 +591,11 @@
['OS=="linux" and clang==1', {
'libraries': ['-latomic'],
}],
@@ -54,7 +66,7 @@ index 587df5cace..c1d6e6735f 100644
],
},
-@@ -1427,8 +1437,9 @@
+@@ -1428,8 +1443,9 @@
['OS=="solaris"', {
'ldflags': [ '-I<(SHARED_INTERMEDIATE_DIR)' ]
}],
@@ -66,7 +78,7 @@ index 587df5cace..c1d6e6735f 100644
'type': 'none',
}],
[ 'node_shared=="true"', {
-@@ -1652,7 +1663,8 @@
+@@ -1653,7 +1669,8 @@
[ 'node_shared_libuv=="false"', {
'dependencies': [ 'deps/uv/uv.gyp:libuv#host' ],
}],
@@ -77,7 +89,7 @@ index 587df5cace..c1d6e6735f 100644
}],
[ 'debug_node=="true"', {
diff --git a/node.gypi b/node.gypi
-index 9eb972adc4..67d8100fa5 100644
+index 9eb972adc4..56a8f45516 100644
--- a/node.gypi
+++ b/node.gypi
@@ -280,6 +280,11 @@
@@ -120,7 +132,51 @@ index 9eb972adc4..67d8100fa5 100644
# -force_load or --whole-archive are not applicable for
# the static library
[ 'force_load=="true"', {
-@@ -484,5 +493,10 @@
+@@ -445,6 +454,22 @@
+ ],
+ }],
+ ]
++ }, {
++ # nodejs-mobile patch: link an external OpenSSL tree (see
++ # tools/android_openssl.sh). node.gypi is included only by the
++ # node/libnode targets, so the host tools never see these target
++ # archives; a global --shared-openssl-libpath would break their
++ # link lines. The path is set through GYP_DEFINES by
++ # android_configure.py.
++ 'conditions': [
++ [ 'nodejs_mobile_openssl_libpath!=""', {
++ 'libraries': [
++ '-L<(nodejs_mobile_openssl_libpath)',
++ '-lssl',
++ '-lcrypto',
++ ],
++ }],
++ ],
+ }],
+ ]
+ }, {
+@@ -472,17 +497,27 @@
+ }],
+ [ 'node_use_quic=="true"', {
+ 'conditions': [
+- [ 'node_shared_openssl=="false"', {
++ [ 'node_shared_openssl=="false" or (OS=="android" and nodejs_mobile_openssl_libpath!="")', {
+ 'dependencies': [
+ './deps/ngtcp2/ngtcp2.gyp:ngtcp2',
+ './deps/ngtcp2/ngtcp2.gyp:nghttp3',
+
+- # For tests
+- './deps/ngtcp2/ngtcp2.gyp:ngtcp2_test_server',
+- './deps/ngtcp2/ngtcp2.gyp:ngtcp2_test_client',
++ ],
++ 'conditions': [
++ [ 'OS not in "android ios"', {
++ 'dependencies': [
++ './deps/ngtcp2/ngtcp2.gyp:ngtcp2_test_server',
++ './deps/ngtcp2/ngtcp2.gyp:ngtcp2_test_client',
++ ],
++ }],
+ ],
}],
],
}],
diff --git a/patches/ci-remove-upstream-only-workflows-and-config.patch b/patches/ci-remove-upstream-only-workflows-and-config.patch
index b30c929ea4..630bff5adf 100644
--- a/patches/ci-remove-upstream-only-workflows-and-config.patch
+++ b/patches/ci-remove-upstream-only-workflows-and-config.patch
@@ -27,7 +27,7 @@ is read only from the default branch and is left untouched.
.github/workflows/auto-start-ci.yml | 93 -----
.github/workflows/benchmark.yml | 271 -------------
.github/workflows/build-shared.yml | 93 -----
- .github/workflows/build-tarball.yml | 137 -------
+ .github/workflows/build-tarball.yml | 132 -------
.github/workflows/close-stalled.yml | 36 --
.github/workflows/codeql.yml | 44 ---
.github/workflows/comment-labeled.yml | 57 ---
@@ -38,7 +38,7 @@ is read only from the default branch and is left untouched.
.github/workflows/coverage-linux.yml | 90 -----
.github/workflows/coverage-windows.yml | 106 -----
.github/workflows/create-release-proposal.yml | 81 ----
- .github/workflows/daily-wpt-fyi.yml | 163 --------
+ .github/workflows/daily-wpt-fyi.yml | 164 --------
.github/workflows/daily.yml | 30 --
.github/workflows/doc.yml | 41 --
.../workflows/find-inactive-collaborators.yml | 50 ---
@@ -60,7 +60,7 @@ is read only from the default branch and is left untouched.
.github/workflows/stress-test.yml | 114 ------
.github/workflows/test-internet.yml | 70 ----
.github/workflows/test-linux-perfetto.yml | 73 ----
- .github/workflows/test-linux-quic.yml | 80 ----
+ .github/workflows/test-linux-quic.yml | 81 ----
.github/workflows/test-linux.yml | 100 -----
.github/workflows/test-macos.yml | 142 -------
.github/workflows/test-shared.yml | 273 -------------
@@ -69,7 +69,7 @@ is read only from the default branch and is left untouched.
.github/workflows/update-openssl.yml | 69 ----
.github/workflows/update-v8.yml | 57 ---
.github/workflows/update-wpt.yml | 95 -----
- 49 files changed, 4758 deletions(-)
+ 49 files changed, 4755 deletions(-)
delete mode 100644 .github/ISSUE_TEMPLATE/config.yml
delete mode 100644 .github/SUPPORT.md
delete mode 100644 .github/label-pr-config.yml
@@ -570,7 +570,7 @@ index 85f3e92f2f..0000000000
- MAX_WORKLOAD: ${{ vars.AUTO_START_CI_MAX_WORKLOAD || '15' }}
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
deleted file mode 100644
-index 0e901de78d..0000000000
+index 9f4ed58447..0000000000
--- a/.github/workflows/benchmark.yml
+++ /dev/null
@@ -1,271 +0,0 @@
@@ -716,7 +716,7 @@ index 0e901de78d..0000000000
- --arg withPerfetto ${{ matrix.perfetto || false }} \
- --arg ccache '(import {}).sccache' \
- --run '
-- make build-ci -j4 V=1
+- make build-ci -j4 V=1 ${{ contains(format(' {0} ', inputs.category), ' napi ') && '&& make bench-addons-build' || '' }}
- ' tools/nix/ci-shell.nix
- env:
- SCCACHE_LOCAL_RW_MODE: READ_ONLY
@@ -946,10 +946,10 @@ index 73f7ec6afb..0000000000
- ' "$TAR_DIR/tools/nix/ci-shell.nix"
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
deleted file mode 100644
-index 53e625ef88..0000000000
+index b3ac6aad47..0000000000
--- a/.github/workflows/build-tarball.yml
+++ /dev/null
-@@ -1,137 +0,0 @@
+@@ -1,132 +0,0 @@
-name: Build from tarball
-
-on:
@@ -1016,10 +1016,9 @@ index 53e625ef88..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
-- NODE_VERSION: lts/*
-
-permissions:
- contents: read
@@ -1037,10 +1036,6 @@ index 53e625ef88..0000000000
- with:
- python-version: ${{ env.PYTHON_VERSION }}
- allow-prereleases: true
-- - name: Use Node.js ${{ env.NODE_VERSION }}
-- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-- with:
-- node-version: ${{ env.NODE_VERSION }}
- - name: Make tarball
- run: |
- export DISTTYPE=nightly
@@ -1662,7 +1657,7 @@ index 4035ea9320..0000000000
- gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
deleted file mode 100644
-index 9b8f8e2fd8..0000000000
+index 4ab6975305..0000000000
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ /dev/null
@@ -1,90 +0,0 @@
@@ -1702,7 +1697,7 @@ index 9b8f8e2fd8..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
- CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -1753,12 +1748,12 @@ index 9b8f8e2fd8..0000000000
- - name: Clean tmp
- run: rm -rf coverage/tmp && rm -rf out
- - name: Upload
-- uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
+- uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
- with:
- directory: ./coverage
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
deleted file mode 100644
-index 0c7fc292d3..0000000000
+index a642c0fada..0000000000
--- a/.github/workflows/coverage-linux.yml
+++ /dev/null
@@ -1,90 +0,0 @@
@@ -1798,7 +1793,7 @@ index 0c7fc292d3..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
- CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -1849,12 +1844,12 @@ index 0c7fc292d3..0000000000
- - name: Clean tmp
- run: rm -rf coverage/tmp && rm -rf out
- - name: Upload
-- uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
+- uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
- with:
- directory: ./coverage
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
deleted file mode 100644
-index a4db4ccc08..0000000000
+index c2ce5c3401..0000000000
--- a/.github/workflows/coverage-windows.yml
+++ /dev/null
@@ -1,106 +0,0 @@
@@ -1920,7 +1915,7 @@ index a4db4ccc08..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- RUSTC_VERSION: '1.86'
-
@@ -1961,7 +1956,7 @@ index a4db4ccc08..0000000000
- - name: Clean tmp
- run: npx rimraf ./coverage/tmp
- - name: Upload
-- uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
+- uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
- with:
- directory: ./coverage
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
@@ -2053,10 +2048,10 @@ index 735b15ffd1..0000000000
- BOT_TOKEN: ${{ secrets.GH_USER_TOKEN }}
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
deleted file mode 100644
-index d15f21010c..0000000000
+index b16b640a08..0000000000
--- a/.github/workflows/daily-wpt-fyi.yml
+++ /dev/null
-@@ -1,163 +0,0 @@
+@@ -1,164 +0,0 @@
-# This workflow runs every night and tests various releases of Node.js
-# (latest nightly, current, and two latest LTS release lines) against the
-# `epochs/daily` branch of WPT.
@@ -2072,6 +2067,7 @@ index d15f21010c..0000000000
- - cron: 30 0 * * *
-
-env:
+- # WPT's pywebsocket3 still uses CGIHTTPRequestHandler, removed in Python 3.15.
- PYTHON_VERSION: '3.14'
-
-permissions:
@@ -2488,7 +2484,7 @@ index 35d780ae66..0000000000
- run: gh issue edit "$NUMBER" --repo "$GITHUB_REPOSITORY" --add-label "$LABELS"
diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
deleted file mode 100644
-index 03aa1fa9a8..0000000000
+index 3c50701224..0000000000
--- a/.github/workflows/label-pr.yml
+++ /dev/null
@@ -1,18 +0,0 @@
@@ -2506,7 +2502,7 @@ index 03aa1fa9a8..0000000000
- runs-on: ubuntu-slim
-
- steps:
-- - uses: nodejs/node-pr-labeler@d4cf1b8b9f23189c37917000e5e17e796c770a6b # v1
+- - uses: nodejs/node-pr-labeler@dfe5eb3b099a487644e32567a482744620876ab3 # v1
- with:
- repo-token: ${{ secrets.GH_USER_TOKEN }}
- configuration-path: .github/label-pr-config.yml
@@ -2556,7 +2552,7 @@ index 3bdf3fc31d..0000000000
- labels: meta
diff --git a/.github/workflows/lint-release-proposal.yml b/.github/workflows/lint-release-proposal.yml
deleted file mode 100644
-index 027aee336a..0000000000
+index 9652eea91b..0000000000
--- a/.github/workflows/lint-release-proposal.yml
+++ /dev/null
@@ -1,119 +0,0 @@
@@ -2572,7 +2568,7 @@ index 027aee336a..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- NODE_VERSION: lts/*
-
-permissions:
@@ -2681,7 +2677,7 @@ index 027aee336a..0000000000
- GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
deleted file mode 100644
-index 9afdb2ef5a..0000000000
+index a4997b3d4c..0000000000
--- a/.github/workflows/linters.yml
+++ /dev/null
@@ -1,278 +0,0 @@
@@ -2701,7 +2697,7 @@ index 9afdb2ef5a..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- NODE_VERSION: lts/*
-
-permissions:
@@ -3590,7 +3586,7 @@ index eb5921edb9..0000000000
- remove-stale-when-updated: true
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
deleted file mode 100644
-index 17393eb571..0000000000
+index e47c114d2f..0000000000
--- a/.github/workflows/stress-test.yml
+++ /dev/null
@@ -1,114 +0,0 @@
@@ -3629,7 +3625,7 @@ index 17393eb571..0000000000
- type: string
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- XCODE_VERSION: '16.4'
- CLANG_VERSION: '19'
- RUSTC_VERSION: '1.86'
@@ -3710,7 +3706,7 @@ index 17393eb571..0000000000
- "$TEST_PATH"
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
deleted file mode 100644
-index 43d71f5f31..0000000000
+index 09f52ed2aa..0000000000
--- a/.github/workflows/test-internet.yml
+++ /dev/null
@@ -1,70 +0,0 @@
@@ -3747,7 +3743,7 @@ index 43d71f5f31..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
- CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -3786,7 +3782,7 @@ index 43d71f5f31..0000000000
- run: make test-internet -j4 V=1;
diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml
deleted file mode 100644
-index d2bfbfbd68..0000000000
+index befb170070..0000000000
--- a/.github/workflows/test-linux-perfetto.yml
+++ /dev/null
@@ -1,73 +0,0 @@
@@ -3812,7 +3808,7 @@ index d2bfbfbd68..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
- CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -3865,10 +3861,10 @@ index d2bfbfbd68..0000000000
- run: git add -A && git diff --name-only --exit-code --staged
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
deleted file mode 100644
-index 0eded996fe..0000000000
+index f9ccef8597..0000000000
--- a/.github/workflows/test-linux-quic.yml
+++ /dev/null
-@@ -1,80 +0,0 @@
+@@ -1,81 +0,0 @@
-name: Test Linux (with QUIC)
-
-on:
@@ -3879,6 +3875,7 @@ index 0eded996fe..0000000000
- - configure.py
- - node.gyp
- - node.gypi
+- - deps/v8/**
- - deps/ngtcp2/**
- - deps/nghttp3/**
- - deps/openssl/**
@@ -3901,7 +3898,7 @@ index 0eded996fe..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
- CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -3951,7 +3948,7 @@ index 0eded996fe..0000000000
- run: git add -A && git diff --name-only --exit-code --staged
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
deleted file mode 100644
-index 74dc45ae8c..0000000000
+index cf10c65467..0000000000
--- a/.github/workflows/test-linux.yml
+++ /dev/null
@@ -1,100 +0,0 @@
@@ -3996,7 +3993,7 @@ index 74dc45ae8c..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- FLAKY_TESTS: keep_retrying
- CLANG_VERSION: '19'
- CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -4057,7 +4054,7 @@ index 74dc45ae8c..0000000000
- DIR: dir%20with $unusual"chars?'åß∂ƒ©∆¬…`
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
deleted file mode 100644
-index 6954112115..0000000000
+index 22292f2112..0000000000
--- a/.github/workflows/test-macos.yml
+++ /dev/null
@@ -1,142 +0,0 @@
@@ -4128,7 +4125,7 @@ index 6954112115..0000000000
- cancel-in-progress: true
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
- XCODE_VERSION: '16.4'
- FLAKY_TESTS: keep_retrying
- RUSTC_VERSION: '1.86'
@@ -4564,7 +4561,7 @@ index abe4516db4..0000000000
- update-pull-request-title-and-body: true
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
deleted file mode 100644
-index 497a5c1230..0000000000
+index 8e4c279475..0000000000
--- a/.github/workflows/tools.yml
+++ /dev/null
@@ -1,365 +0,0 @@
@@ -4618,7 +4615,7 @@ index 497a5c1230..0000000000
- - zstd
-
-env:
-- PYTHON_VERSION: '3.14'
+- PYTHON_VERSION: '3.15'
-
-permissions:
- contents: read
diff --git a/patches/files.map b/patches/files.map
index 219ba50d38..4c65489b3b 100644
--- a/patches/files.map
+++ b/patches/files.map
@@ -36,9 +36,11 @@ test-mobile-test-harness.patch tools/test.py
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/parallel.status
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-bench-stream.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-common-wpt-inspect.js
+test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-crypto-x509.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-dgram-bind-fd.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-dgram-membership.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-dgram-socket-buffer-size.js
+test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-fastutf8stream-flush-mocks.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-fs-copyfile.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-fs-lchmod.js
test-skip-adapt-parallel-and-sequential-tests-for-mo.patch test/parallel/test-fs-mkdir.js
@@ -138,3 +140,14 @@ build-profile-ICU-data-for-danmu_api-lite-runtimes.patch deps/icu-small/source/t
build-profile-ICU-data-for-danmu_api-lite-runtimes.patch tools/icu/danmu-lite.json
build-profile-ICU-data-for-danmu_api-lite-runtimes.patch tools/icu/icu-generic.gyp
build-profile-ICU-data-for-danmu_api-lite-runtimes.patch tools/icu/prepare-mobile-icu.py
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch deps/ngtcp2/ngtcp2.gyp
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch lib/internal/quic/quic.js
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch lib/internal/tls/wrap.js
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch lib/tls.js
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch src/crypto/crypto_tls.cc
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch src/crypto/crypto_tls.h
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch src/quic/bindingdata.h
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch src/quic/session.cc
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch src/quic/tlscontext.cc
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch src/quic/tlscontext.h
+src-fix-QUIC-receive-time-after-session-creation.patch src/quic/endpoint.cc
diff --git a/patches/lib-install-a-WebAssembly-polyfill-when-the-engine-h.patch b/patches/lib-install-a-WebAssembly-polyfill-when-the-engine-h.patch
index 1eaa3de85e..ed8a8ccbc2 100644
--- a/patches/lib-install-a-WebAssembly-polyfill-when-the-engine-h.patch
+++ b/patches/lib-install-a-WebAssembly-polyfill-when-the-engine-h.patch
@@ -15,7 +15,7 @@ jitless/frozen-intrinsics host gates in smoke-host.
2 files changed, 113 insertions(+)
diff --git a/LICENSE b/LICENSE
-index 67cd2feb69..994885b996 100644
+index fc7b8c7d21..53440510b5 100644
--- a/LICENSE
+++ b/LICENSE
@@ -2921,3 +2921,26 @@ The externally maintained libraries used by Node.js are:
@@ -46,7 +46,7 @@ index 67cd2feb69..994885b996 100644
+ SOFTWARE.
+ """
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
-index 2111579151..9a1b965e5c 100644
+index 96c6a5c757..626dec351b 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -10,6 +10,7 @@ const {
@@ -65,7 +65,7 @@ index 2111579151..9a1b965e5c 100644
setupTraceCategoryState();
setupInspectorHooks();
setupNetworkInspection();
-@@ -451,6 +453,94 @@ function setupEventsource() {
+@@ -449,6 +451,94 @@ function setupEventsource() {
}
}
diff --git a/patches/series b/patches/series
index 6ce282ba2b..5b20bc840a 100644
--- a/patches/series
+++ b/patches/series
@@ -20,3 +20,5 @@ ci-remove-upstream-only-workflows-and-config.patch
lib-install-a-WebAssembly-polyfill-when-the-engine-h.patch
build-mobile-Temporal-Rust-toolsets-and-libffi-iOS-c.patch
build-profile-ICU-data-for-danmu_api-lite-runtimes.patch
+src-expose-required-ECH-for-TLS-and-QUIC-clients.patch
+src-fix-QUIC-receive-time-after-session-creation.patch
diff --git a/patches/src-crypto-mobile-adjustment-in-crypto_context.cc.patch b/patches/src-crypto-mobile-adjustment-in-crypto_context.cc.patch
index 5118d3f36b..7539e8d09c 100644
--- a/patches/src-crypto-mobile-adjustment-in-crypto_context.cc.patch
+++ b/patches/src-crypto-mobile-adjustment-in-crypto_context.cc.patch
@@ -19,10 +19,10 @@ Co-authored-by: Julia Samól
1 file changed, 17 insertions(+)
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
-index 823d87e7f2..5559b421ce 100644
+index 64be71541f..9f8be60740 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
-@@ -328,6 +328,9 @@ bool isSelfIssued(X509* cert) {
+@@ -323,6 +323,9 @@ bool isSelfIssued(X509* cert) {
#ifdef __APPLE__
TrustStatus IsTrustDictionaryTrustedForPolicy(CFDictionaryRef trust_dict,
bool is_self_issued) {
@@ -32,7 +32,7 @@ index 823d87e7f2..5559b421ce 100644
// Trust settings may be scoped to a single application
// skip as this is not supported
if (CFDictionaryContainsKey(trust_dict, kSecTrustSettingsApplication)) {
-@@ -419,6 +422,10 @@ TrustStatus IsTrustDictionaryTrustedForPolicy(CFDictionaryRef trust_dict,
+@@ -414,6 +417,10 @@ TrustStatus IsTrustDictionaryTrustedForPolicy(CFDictionaryRef trust_dict,
return (trust_settings_result == kSecTrustSettingsResultTrustAsRoot)
? TrustStatus::TRUSTED
: TrustStatus::UNSPECIFIED;
@@ -43,7 +43,7 @@ index 823d87e7f2..5559b421ce 100644
}
TrustStatus IsTrustSettingsTrustedForPolicy(CFArrayRef trust_settings,
-@@ -490,6 +497,8 @@ bool IsCertificateTrustedForPolicy(X509* cert, SecCertificateRef ref) {
+@@ -485,6 +492,8 @@ bool IsCertificateTrustedForPolicy(X509* cert, SecCertificateRef ref) {
bool trust_evaluated = false;
bool is_self_issued = isSelfIssued(cert);
@@ -52,7 +52,7 @@ index 823d87e7f2..5559b421ce 100644
// Evaluate user trust domain, then admin. User settings can override
// admin (and both override the system domain, but we don't check that).
for (const auto& trust_domain :
-@@ -528,6 +537,14 @@ bool IsCertificateTrustedForPolicy(X509* cert, SecCertificateRef ref) {
+@@ -523,6 +532,14 @@ bool IsCertificateTrustedForPolicy(X509* cert, SecCertificateRef ref) {
CFRelease(trust_settings);
}
}
diff --git a/patches/src-expose-required-ECH-for-TLS-and-QUIC-clients.patch b/patches/src-expose-required-ECH-for-TLS-and-QUIC-clients.patch
new file mode 100644
index 0000000000..d30846f2e8
--- /dev/null
+++ b/patches/src-expose-required-ECH-for-TLS-and-QUIC-clients.patch
@@ -0,0 +1,381 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: fogtape
+Date: Thu, 15 Oct 2026 12:00:00 +0800
+Subject: [PATCH] src: expose required ECH for TLS and QUIC clients
+
+Expose echConfigList and authenticated acceptance without plaintext-SNI
+fallback. Use OpenSSL native peer verification for ECH, suppress QUIC
+0-RTT, and build the vendored QUIC adapter with Android external OpenSSL.
+
+Assisted-by: Codex
+---
+ deps/ngtcp2/ngtcp2.gyp | 2 +-
+ lib/internal/quic/quic.js | 15 ++++++++++++---
+ lib/internal/tls/wrap.js | 29 +++++++++++++++++++++++++++++
+ lib/tls.js | 3 +++
+ src/crypto/crypto_tls.cc | 27 +++++++++++++++++++++++++++
+ src/crypto/crypto_tls.h | 2 ++
+ src/quic/bindingdata.h | 1 +
+ src/quic/session.cc | 8 +++++++-
+ src/quic/tlscontext.cc | 26 +++++++++++++++++++++++++-
+ src/quic/tlscontext.h | 4 ++++
+ 10 files changed, 111 insertions(+), 6 deletions(-)
+
+diff --git a/deps/ngtcp2/ngtcp2.gyp b/deps/ngtcp2/ngtcp2.gyp
+index 7ae6279248..3dcd7278a1 100644
+--- a/deps/ngtcp2/ngtcp2.gyp
++++ b/deps/ngtcp2/ngtcp2.gyp
+@@ -169,7 +169,7 @@
+ # here then we can use that adapter and also set the
+ # QUIC_NGTCP2_USE_BORINGSSL define (the guard in quic/guard.h
+ # would need to be updated to check for this define).
+- ['node_shared_openssl=="false" and openssl_version >= 0x3050001f', {
++ ['(node_shared_openssl=="false" or (OS=="android" and nodejs_mobile_openssl_libpath!="")) and openssl_version >= 0x3050001f', {
+ 'sources': [
+ '<@(ngtcp2_sources_ossl)',
+ ],
+diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
+index d163311dc1..e3e5d0f1fc 100644
+--- a/lib/internal/quic/quic.js
++++ b/lib/internal/quic/quic.js
+@@ -823,13 +823,13 @@ setCallbacks({
+ validationErrorReason,
+ validationErrorCode,
+ earlyDataAttempted,
+- earlyDataAccepted) {
++ earlyDataAccepted, echAccepted) {
+ debug('session handshake callback', servername, protocol, cipher, cipherVersion,
+ validationErrorReason, validationErrorCode,
+ earlyDataAttempted, earlyDataAccepted);
+ this[kOwner][kHandshake](servername, protocol, cipher, cipherVersion,
+ validationErrorReason, validationErrorCode,
+- earlyDataAttempted, earlyDataAccepted);
++ earlyDataAttempted, earlyDataAccepted, echAccepted);
+ },
+
+ /**
+@@ -4217,7 +4217,7 @@ class QuicSession {
+ * @param {number} validationErrorCode
+ */
+ [kHandshake](servername, protocol, cipher, cipherVersion, validationErrorReason,
+- validationErrorCode, earlyDataAttempted, earlyDataAccepted) {
++ validationErrorCode, earlyDataAttempted, earlyDataAccepted, echAccepted) {
+ const inner = this.#inner;
+ if (this.destroyed || !inner.pendingOpen.resolve) return;
+
+@@ -4236,6 +4236,7 @@ class QuicSession {
+ cipherVersion,
+ validationErrorReason,
+ validationErrorCode,
++ echAccepted,
+ earlyDataAttempted,
+ earlyDataAccepted,
+ };
+@@ -5239,6 +5240,7 @@ function processIdentityOptions(identity, label) {
+ function processTlsOptions(tls, forServer) {
+ const {
+ servername,
++ echConfigList,
+ alpn,
+ ciphers = DEFAULT_CIPHERS,
+ groups = DEFAULT_GROUPS,
+@@ -5260,6 +5262,12 @@ function processTlsOptions(tls, forServer) {
+ if (servername !== undefined) {
+ validateString(servername, 'options.servername');
+ }
++ if (echConfigList !== undefined) {
++ if (!isArrayBufferView(echConfigList))
++ throw new ERR_INVALID_ARG_TYPE('options.echConfigList', 'ArrayBufferView', echConfigList);
++ if (forServer || !servername || echConfigList.byteLength === 0 || tls.verifyPeer === 'manual')
++ throw new ERR_INVALID_ARG_VALUE('options.echConfigList', undefined, 'ECH requires a client servername and certificate verification');
++ }
+ if (ciphers !== undefined) {
+ validateString(ciphers, 'options.ciphers');
+ }
+@@ -5372,6 +5380,7 @@ function processTlsOptions(tls, forServer) {
+ const shared = {
+ __proto__: null,
+ servername,
++ echConfigList,
+ alpn: encodedAlpn,
+ ciphers,
+ groups,
+diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
+index 20f043e26c..d9673f3cb7 100644
+--- a/lib/internal/tls/wrap.js
++++ b/lib/internal/tls/wrap.js
+@@ -1770,6 +1770,16 @@ function normalizeConnectArgs(listArgs) {
+ return cb ? [options, cb] : [options];
+ }
+
++TLSSocket.prototype.getECHStatus = function() {
++ return this._handle?.getECHStatus();
++};
++
++ObjectDefineProperty(TLSSocket.prototype, 'echAccepted', {
++ configurable: true,
++ enumerable: true,
++ get() { return this.getECHStatus() === 1; },
++});
++
+ function onConnectSecure() {
+ const options = this[kConnectOptions];
+
+@@ -1819,6 +1829,10 @@ function onConnectSecure() {
+ this.authorized = true;
+ debug('client emit secureConnect. authorized:', this.authorized);
+ }
++ if (options.echConfigList !== undefined && !this.echAccepted) {
++ this.destroy(new ERR_TLS_INVALID_STATE('ECH was not accepted'));
++ return;
++ }
+ this.secureConnecting = false;
+ this.emit('secureConnect');
+
+@@ -1868,6 +1882,15 @@ exports.connect = function connect(...args) {
+ validateFunction(options.checkServerIdentity, 'options.checkServerIdentity');
+ validateNumber(options.minDHSize, 'options.minDHSize', 1);
+
++ if (options.echConfigList !== undefined) {
++ if (!isArrayBufferView(options.echConfigList))
++ throw new ERR_INVALID_ARG_TYPE('options.echConfigList', 'ArrayBufferView', options.echConfigList);
++ if (!tls.ECH_SUPPORTED || options.echConfigList.byteLength === 0)
++ throw new ERR_INVALID_ARG_VALUE('options.echConfigList', undefined, 'ECH requires OpenSSL 4 and a nonempty ECHConfigList');
++ if (!options.servername || options.rejectUnauthorized === false)
++ throw new ERR_INVALID_ARG_VALUE('options.echConfigList', undefined, 'ECH requires servername and certificate verification');
++ }
++
+ const context = options.secureContext || tls.createSecureContext(options);
+
+ if (options.servername && net.isIP(options.servername)) {
+@@ -1918,6 +1941,12 @@ exports.connect = function connect(...args) {
+ if (options.servername)
+ tlssock.setServername(options.servername);
+
++ if (options.echConfigList !== undefined &&
++ !tlssock._handle.setECHConfigList(options.echConfigList)) {
++ tlssock.destroy();
++ throw new ERR_INVALID_ARG_VALUE('options.echConfigList', undefined, 'Invalid ECHConfigList');
++ }
++
+ if (!options.socket) {
+ // If user provided the socket, it's their responsibility to manage its
+ // connectivity. If we created one internally, we connect it.
+diff --git a/lib/tls.js b/lib/tls.js
+index ba395be5eb..36cd0a16d1 100644
+--- a/lib/tls.js
++++ b/lib/tls.js
+@@ -21,6 +21,9 @@
+
+ 'use strict';
+
++// Fork API: library support, independent of any server's ECH policy.
++exports.ECH_SUPPORTED = !!internalBinding('tls_wrap').NODE_HAVE_ECH;
++
+ const {
+ Array,
+ ArrayIsArray,
+diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
+index ef258b0f33..8bd62cfe17 100644
+--- a/src/crypto/crypto_tls.cc
++++ b/src/crypto/crypto_tls.cc
+@@ -25,6 +25,7 @@
+ #include "crypto/crypto_bio.h"
+ #include "crypto/crypto_client_hello.h"
+ #include "crypto/crypto_common.h"
++#include "crypto/crypto_ech.h"
+ #include "crypto/crypto_context.h"
+ #include "crypto/crypto_util.h"
+ #include "debug_utils-inl.h"
+@@ -1482,6 +1483,27 @@ void TLSWrap::GetServername(const FunctionCallbackInfo& args) {
+ }
+ }
+
++void TLSWrap::SetECHConfigList(const FunctionCallbackInfo& args) {
++ TLSWrap* wrap;
++ ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
++ CHECK_EQ(args.Length(), 1);
++ CHECK(args[0]->IsArrayBufferView());
++ CHECK(!wrap->flags_.started);
++ CHECK(wrap->is_client());
++ CHECK(wrap->ssl_);
++ ArrayBufferViewContents config(args[0]);
++ args.GetReturnValue().Set(crypto::ConfigureECH(
++ wrap->ssl_.get(), config.data(), config.length()));
++}
++
++void TLSWrap::GetECHStatus(const FunctionCallbackInfo& args) {
++ TLSWrap* wrap;
++ ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
++ if (wrap->ssl_) {
++ args.GetReturnValue().Set(crypto::GetECHStatus(wrap->ssl_.get()));
++ }
++}
++
+ void TLSWrap::SetServername(const FunctionCallbackInfo& args) {
+ TLSWrap* wrap;
+ ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
+@@ -2317,6 +2339,7 @@ void TLSWrap::Initialize(
+ SetMethod(context, target, "wrap", TLSWrap::Wrap);
+
+ NODE_DEFINE_CONSTANT(target, HAVE_SSL_TRACE);
++ NODE_DEFINE_CONSTANT(target, NODE_HAVE_ECH);
+
+ Local t = AsyncWrap::MakeLazilyInitializedJSTemplate(env);
+ Local tlsWrapString =
+@@ -2355,6 +2378,8 @@ void TLSWrap::Initialize(
+ SetProtoMethod(isolate, t, "setKeyCert", SetKeyCert);
+ SetProtoMethod(isolate, t, "setOCSPResponse", SetOCSPResponse);
+ SetProtoMethod(isolate, t, "setServername", SetServername);
++ SetProtoMethod(isolate, t, "setECHConfigList", SetECHConfigList);
++ SetProtoMethod(isolate, t, "getECHStatus", GetECHStatus);
+ SetProtoMethod(isolate, t, "setSession", SetSession);
+ SetProtoMethod(isolate, t, "setVerifyMode", SetVerifyMode);
+ SetProtoMethod(isolate, t, "start", Start);
+@@ -2427,6 +2452,8 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+ registry->Register(SetALPNProtocols);
+ registry->Register(SetOCSPResponse);
+ registry->Register(SetServername);
++ registry->Register(SetECHConfigList);
++ registry->Register(GetECHStatus);
+ registry->Register(SetSession);
+ registry->Register(SetVerifyMode);
+ registry->Register(Start);
+diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
+index ab60240188..23b80c2154 100644
+--- a/src/crypto/crypto_tls.h
++++ b/src/crypto/crypto_tls.h
+@@ -277,6 +277,8 @@ class TLSWrap : public AsyncWrap,
+ static void SetKeyCert(const v8::FunctionCallbackInfo& args);
+ static void SetOCSPResponse(const v8::FunctionCallbackInfo& args);
+ static void SetServername(const v8::FunctionCallbackInfo& args);
++ static void SetECHConfigList(const v8::FunctionCallbackInfo& args);
++ static void GetECHStatus(const v8::FunctionCallbackInfo& args);
+ static void SetSession(const v8::FunctionCallbackInfo& args);
+ static void SetVerifyMode(const v8::FunctionCallbackInfo& args);
+ static void Start(const v8::FunctionCallbackInfo& args);
+diff --git a/src/quic/bindingdata.h b/src/quic/bindingdata.h
+index 7d424b9bf6..21e55af1f0 100644
+--- a/src/quic/bindingdata.h
++++ b/src/quic/bindingdata.h
+@@ -91,6 +91,7 @@ struct QuicAllocState;
+ V(disable_stateless_reset, "disableStatelessReset") \
+ V(draining_period_multiplier, "drainingPeriodMultiplier") \
+ V(enable_connect_protocol, "enableConnectProtocol") \
++ V(ech_config_list, "echConfigList") \
+ V(enable_early_data, "enableEarlyData") \
+ V(enable_datagrams, "enableDatagrams") \
+ V(enable_tls_trace, "tlsTrace") \
+diff --git a/src/quic/session.cc b/src/quic/session.cc
+index d83c1cbb89..e3257e40aa 100644
+--- a/src/quic/session.cc
++++ b/src/quic/session.cc
+@@ -3845,6 +3845,11 @@ bool Session::HandshakeCompleted() {
+ DCHECK(!is_destroyed());
+ DCHECK(!impl_->state()->handshake_completed);
+
++ if (!is_server() && tls_session().context().options().ech_config_list &&
++ !tls_session().ech_accepted()) {
++ return false;
++ }
++
+ Debug(this, "Session handshake completed");
+ impl_->state()->handshake_completed = 1;
+ // This implies fully completing a handshake without setting hello_processed
+@@ -4127,7 +4132,8 @@ void Session::EmitHandshakeComplete() {
+ Undefined(isolate), // Validation error reason
+ Undefined(isolate), // Validation error code
+ Boolean::New(isolate, tls_session().early_data_was_attempted()),
+- Boolean::New(isolate, tls_session().early_data_was_accepted())};
++ Boolean::New(isolate, tls_session().early_data_was_accepted()),
++ Boolean::New(isolate, tls_session().ech_accepted())};
+
+ auto& tls = tls_session();
+ auto peerVerifyError = tls.VerifyPeerIdentity(env());
+diff --git a/src/quic/tlscontext.cc b/src/quic/tlscontext.cc
+index 081af891b9..c8b9a6a54e 100644
+--- a/src/quic/tlscontext.cc
++++ b/src/quic/tlscontext.cc
+@@ -4,6 +4,7 @@
+ #include
+ #include
+ #include
++#include
+ #include
+ #include
+ #include
+@@ -796,6 +797,14 @@ Maybe TLSContext::Options::From(Environment* env,
+ return Nothing();
+ }
+
++ Local ech;
++ if (!params->Get(env->context(), state.ech_config_list_string()).ToLocal(&ech))
++ return Nothing();
++ if (!ech->IsUndefined()) {
++ if (!ech->IsArrayBufferView() ||
++ !Store::From(ech.As()).To(&options.ech_config_list))
++ return Nothing();
++ }
+ return Just(options);
+ }
+
+@@ -836,6 +845,7 @@ void TLSContext::Options::MemoryInfo(MemoryTracker* tracker) const {
+ tracker->TrackField("certs", certs);
+ tracker->TrackField("ca", ca);
+ tracker->TrackField("crl", crl);
++ tracker->TrackField("ech_config_list", ech_config_list);
+ }
+
+ const TLSContext::Options TLSContext::Options::kDefault = {};
+@@ -937,7 +947,17 @@ void TLSSession::Initialize(
+ }
+ }
+
+- if (maybeSessionTicket.has_value()) {
++ if (options.ech_config_list) {
++ const ngtcp2_vec config = options.ech_config_list;
++ if (!crypto::ConfigureECH(ossl_context_, config.base, config.len)) {
++ validation_error_ = "ECH requires OpenSSL 4 and a valid ECHConfigList";
++ ossl_context_.reset();
++ return;
++ }
++ }
++
++ // ECH must be authenticated before application data, including 0-RTT.
++ if (!options.ech_config_list && maybeSessionTicket.has_value()) {
+ const auto& sessionTicket = *maybeSessionTicket;
+ uv_buf_t buf = sessionTicket.ticket();
+ SSLSessionPointer ticket = crypto::GetTLSSession(
+@@ -1008,6 +1028,10 @@ TLSSession::VerifyPeerIdentity(Environment* env) {
+ return PeerIdentityValidationError{reason, code};
+ }
+
++bool TLSSession::ech_accepted() const {
++ return crypto::GetECHStatus(ossl_context_) == 1;
++}
++
+ MaybeLocal