CI: https://ci.nodejs.org/job/node-test-pull-request/58423/

No security reverts should exist on the main branch.

It seems to me that this was done correctly by @bnoordhuis in nodejs-private/node-private#565 but that commit somehow didn't end up on the main branch in this repository.

That was on purpose. That's why I left https://github.com/nodejs-private/node-private/pull/565 open, otherwise, I would need to avoid this commit somehow in the last sync for Node.js 22 (which is basically a git reset --hard upstream/main). I was planning to include it as soon as v22.x arrises.

@RafaelGSS Should I rebase #52365 then and then later rebase this PR on top of that or should I consider both blocked? I wasn't aware that we can't merge non-v22 commits into main at this point.

@RafaelGSS Should I rebase #52365 then and then later rebase this PR on top of that or should I consider both blocked? I wasn't aware that we can't merge non-v22 commits into main at this point.

Technically, we can... but it makes our process of a semver-major release slightly harder. For instance, you can add a dont-land-on-v22.x label, but it will require some adjustments in our sync that might result in conflicts. At this point, we are not planning any further sync to v22.x (except including V8 commit). I have added the blocked label just in case a sync is necessary (which is unlikely).

I think a rebase is not necessary, #52365 can land without issues.

No security reverts should exist on the main branch.
It seems to me that this was done correctly by @bnoordhuis in nodejs-private/node-private#565 but that commit somehow didn't end up on the main branch in this repository.

That was on purpose. That's why I left nodejs-private/node-private#565 open, otherwise, I would need to avoid this commit somehow in the last sync for Node.js 22 (which is basically a git reset --hard upstream/main). I was planning to include it as soon as v22.x arrises.

I don't understand why the revert is included for Node.js 22 -- we haven't had any releases of that yet and we should release Node.js 22 without any security reverts.

No security reverts should exist on the main branch.
It seems to me that this was done correctly by @bnoordhuis in nodejs-private/node-private#565 but that commit somehow didn't end up on the main branch in this repository.

That was on purpose. That's why I left nodejs-private/node-private#565 open, otherwise, I would need to avoid this commit somehow in the last sync for Node.js 22 (which is basically a git reset --hard upstream/main). I was planning to include it as soon as v22.x arrises.

I don't understand why the revert is included for Node.js 22 -- we haven't had any releases of that yet and we should release Node.js 22 without any security reverts.

I have included it because a backport specifically to Node.js 22 was created: https://github.com/nodejs-private/node-private/pull/560.

I suppose a backport was created because the branch existed.

If you all agree, let's merge it then. I can pull directly into v22.x.

Landed in 3790d52