the binary-upload target uses $(TARNAME)-$(OSTYPE)-$(ARCH).tar.xz as the
name to upload whereas it is created by the $(BINARYTAR) target as
$(BINARYNAME). Since BINARYNAME includes the optional VARIATION when
present this gets missed out int he binary-upload target, for example
during a release build for Alpine/musl. This commit changes the
binary-upload target to use the same variable for the tarball that is
used when the file is created.

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: #65282
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #62324
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Creates a SharedArrayBuffer from externally managed memory.

Fixes: #62259
PR-URL: #62623
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #62961
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #62962
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #62810
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63110
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: umuoy1 <burningdian@gmail.com>
PR-URL: #62710
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #63375
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This is the [`certdata.txt`][0] from NSS 3.123.1.

This is the version of NSS that shipped in Firefox 151.0.1 on 2026-05-21

Certificates removed:
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- Izenpe.com
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB

[0]: https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_123_1_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #63527
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63515
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63938
Refs: nodejs/node-core-utils#1094
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Original commit message:

    Fixes #1056

    The commit
    c-ares/c-ares@1d1b3d4
    refactored the function to use wide strings, but didn't touch this
    check. Because an empty wide string would now be size 2 and not 1, the
    empty string would go on and cause the DNS domain list to be replaced
    with nothing.

    Signed-off-by: @dankmeme01

Refs: c-ares/c-ares@8ba37af
PR-URL: #64110
Fixes: #62347
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #64070
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #64259
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #64330
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Mark the session as receiving around nghttp2_session_mem_recv() and
defer RST_STREAM handling while receive is in progress. This prevents
closing a stream while nghttp2 still processes it and avoids
heap-use-after-free in nghttp2_session_mem_recv2().

Fixes: #64113
Signed-off-by: Evgeniy Gorbanev <gorbanev.es@gmail.com>
PR-URL: #64166
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #64588
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

This is the certdata.txt[0] from NSS 3.125.

This is the version of NSS that shipped in Firefox 153.0 on 2026-07-21.

Certificates removed:
- Entrust Root Certification Authority
- SecureSign Root CA12

[0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_125_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #64746
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's
corrected handling of NSS distrust-after metadata.

Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64753
Fixes: #64752
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #64651
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Hiroki Osame <hiroki.osame@gmail.com>
PR-URL: #65108
Fixes: #65104
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #65217
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com>

Notable changes:

crypto:
  * update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527

PR-URL: #65443