"4da3f3bb53a042be1331b360aee87554f8d94f86": "path: port Node v26 win32 device-root and reserved-name handling\n\npath.win32 was still on the Node v21.6.1 algorithm and was missing three\nupstream changes.\n\nDevice roots. \\\\.\\X and \\\\?\\X are device roots, not UNC shares, so\nresolve() and normalize() must not append a trailing separator:\npath.win32.resolve('\\\\\\\\?\\\\foo') returned '\\\\\\\\?\\\\foo\\\\'\nwhere Node returns '\\\\\\\\?\\\\foo'. toNamespacedPath inherited the same\nextra separator through resolve.\n\nCVE-2024-36139. path.win32.normalize('test/../C:/Windows') returned\n'C:\\\\Windows' - a relative path normalizing into a different drive root.\nNode returns '.\\\\C:\\\\Windows'. normalize now applies the same guard: when\nthe input is relative, has no device, and contains a colon, the result is\nprefixed with '.\\\\'.\n\nReserved device names. CON, PRN, AUX, NUL, COM1-9 and LPT1-9 (including the\nsuperscript COM\\u00b9 spellings) are recognised in normalize's root match and\nin join, which skips normalization entirely when any joined segment is a\nreserved name so that '..' after 'CON:' is not resolved away.\n\nRestores four upstream tests to verbatim v26.3.0: test-path-normalize,\ntest-path-makelong, test-path-join, test-url-urltooptions.\n\nurlToHttpOptions now rejects non-objects with ERR_INVALID_ARG_TYPE, matching\nNode's validateObject(url, 'url', kValidateObjectAllowObjects).\n\nThe Bun-owned to-namespaced-path test asserted the old trailing separator;\nits two expectations now match real Node output.",
0 commit comments