Aug 31, 2026

fix(process): clear supplementary groups before changing identityRust · 303 + / 24 −

Introduces 14 new declarations in ext/process/lib.rs.

Adds new language design rather than adjusting what was there. Tests changed with it, with code of their own.

ext/process/lib.rs ↗ · 2 files

@@ -2270,3 +2394,158 @@ mod deprecated {     kill(pid, &signal)   } }++#[cfg(all(test, unix))]+mod tests {+  use std::ffi::CString;++  use super::UnixChildSetupStep;+  use super::apply_unix_child_setup;+  use super::check_identity_syscall_result;+  use super::should_change_cwd_in_pre_exec;+  use super::should_clear_supplementary_groups;+  use super::unix_child_effective_identity_will_change;++  #[test]+  fn supplementary_groups_are_only_cleared_for_identity_options() {+    assert!(!should_clear_supplementary_groups(None, None));+    assert!(should_clear_supplementary_groups(Some(1000), None));+    assert!(should_clear_supplementary_groups(None, Some(1000)));+    assert!(should_clear_supplementary_groups(Some(1000), Some(1000)));+    assert!(!should_change_cwd_in_pre_exec(None, None, true));+    assert!(!should_change_cwd_in_pre_exec(Some(1000), None, false));+    assert!(should_change_cwd_in_pre_exec(Some(1000), None, true));+    assert!(should_change_cwd_in_pre_exec(None, Some(1000), true));++    // SAFETY: getegid and geteuid are async-signal-safe and cannot fail.+    let (current_uid, current_gid) =+      unsafe { (libc::geteuid() as u32, libc::getegid() as u32) };+    assert!(!unix_child_effective_identity_will_change(+      Some(current_uid),+      Some(current_gid)+    ));

Add intrinsics for integer minimum and maximumRust · 119 + / 1 −

Introduces 4 new declarations in library/core/src/cmp.rs.

Adds new language design rather than adjusting what was there. Tests changed with it, with code of their own.

library/core/src/cmp.rs ↗ · 10 files

@@ -2298,8 +2298,37 @@ mod impls {      partial_ord_impl! { f16 f32 f64 f128 } +    macro_rules! min_max_impl {+        (char) => {+            #[inline]+            fn min(self, other: Self) -> Self {+                let c = u32::min(self as u32, other as u32);+                // SAFETY: it's one of the inputs+                unsafe { char::from_u32_unchecked(c) }+            }++            #[inline]+            fn max(self, other: Self) -> Self {+                let c = u32::max(self as u32, other as u32);+                // SAFETY: it's one of the inputs+                unsafe { char::from_u32_unchecked(c) }+            }+        };+        ($t:ident) => {+            #[inline]+            fn min(self, other: Self) -> Self {+                crate::intrinsics::integer_min(self, other)+            }++            #[inline]+            fn max(self, other: Self) -> Self {+                crate::intrinsics::integer_max(self, other)+            }+        };+    }+     macro_rules! ord_impl {

tls: read the peer certificate chain without consuming itC++ · 61 + / 25 −

Reworks 55 lines of existing logic in src/crypto/crypto_x509.cc.

Changes how existing runtime behaves. Tests changed with it, with code of their own.

src/crypto/crypto_x509.cc ↗ · 6 files

@@ -937,20 +945,23 @@ MaybeLocal<Object> X509Certificate::New(Environment* env,     return MaybeLocal<Object>();   } -  Local<Object> issuer_chain_obj;-  if (issuer_chain != nullptr && sk_X509_num(issuer_chain)) {-    X509Pointer cert(X509_dup(sk_X509_value(issuer_chain, 0)));-    sk_X509_delete(issuer_chain, 0);-    auto maybeObj =-        sk_X509_num(issuer_chain)-            ? X509Certificate::New(env, std::move(cert), issuer_chain)-            : X509Certificate::New(env, std::move(cert));-    if (!maybeObj.ToLocal(&issuer_chain_obj)) [[unlikely]] {+  Local<Object> issuer;+  if (issuer_chain != nullptr && start < sk_X509_num(issuer_chain)) {+    X509Pointer issuer_cert =+        X509View(sk_X509_value(issuer_chain, start)).clone();+    if (!issuer_cert) [[unlikely]] {+      return MaybeLocal<Object>();+    }+    if (!NewWithIssuers(env,+                        std::make_shared<ManagedX509>(std::move(issuer_cert)),+                        issuer_chain,+                        start + 1)+             .ToLocal(&issuer)) [[unlikely]] {       return MaybeLocal<Object>();     }   } -  new X509Certificate(env, obj, std::move(cert), issuer_chain_obj);+  new X509Certificate(env, obj, std::move(cert), issuer);   return scope.Escape(obj); } 

[DOM] Update HTML parser rules for new select parserJavaScript · 4 + / 16 −

Reworks 17 lines of existing logic in packages/react-dom-bindings/src/client/validateDOMNesting.js.

Changes how existing language design behaves. Tests changed with it, with code of their own.

packages/react-dom-bindings/src/client/validateDOMNesting.js ↗ · 3 files

@@ -306,22 +307,6 @@ function isTagValidWithParent( ): boolean {   // First, let's check if we're in an unusual parsing mode...   switch (parentTag) {-    // https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inselect-    case 'select':-      return (-        tag === 'hr' ||-        tag === 'option' ||-        tag === 'optgroup' ||-        tag === 'script' ||-        tag === 'template' ||-        tag === '#text'-      );-    case 'optgroup':-      return tag === 'option' || tag === '#text';-    // Strictly speaking, seeing an <option> doesn't mean we're in a <select>-    // but-    case 'option':-      return tag === '#text';     // https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-intd     // https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-incaption     // No special behavior since these rules fall back to "in body" mode for

Rename endpoint_slice_controller_changes to add _total suffixGo · 21 + / 2 −

Reworks 14 lines of existing logic in staging/src/k8s.io/endpointslice/metrics/metrics.go.

Changes how existing systems design behaves. Tests changed with it, with code of their own.

staging/src/k8s.io/endpointslice/metrics/metrics.go ↗ · 6 files

@@ -84,10 +84,25 @@ var ( 	)  	// EndpointSliceChanges tracks the number of changes to Endpoint Slices.+	//+	// Deprecated: use EndpointSliceChangesTotal. The old name lacks the+	// conventional _total suffix required for counters. 	EndpointSliceChanges = metrics.NewCounterVec(+		&metrics.CounterOpts{+			Subsystem:         EndpointSliceSubsystem,+			Name:              "changes",+			Help:              "Number of EndpointSlice changes. Deprecated in favor of endpoint_slice_controller_changes_total.",+			StabilityLevel:    metrics.ALPHA,+			DeprecatedVersion: "1.38.0",+		},+		[]string{"operation"},+	)++	// EndpointSliceChangesTotal tracks the number of changes to Endpoint Slices.+	EndpointSliceChangesTotal = metrics.NewCounterVec( 		&metrics.CounterOpts{ 			Subsystem:      EndpointSliceSubsystem,-			Name:           "changes",+			Name:           "changes_total", 			Help:           "Number of EndpointSlice changes", 			StabilityLevel: metrics.ALPHA, 		},