diff --git a/.gitattributes b/.gitattributes index 3f841bf7ca..e1ba3d54e3 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,4 @@ codex-rs/app-server-protocol/schema/** linguist-generated codex-rs/hooks/schema/generated/** linguist-generated third_party/voice/sources.json text eol=lf +patches/v8_array_sort_elements_kind.patch text eol=lf diff --git a/.github/scripts/test_v8_canary_changes.py b/.github/scripts/test_v8_canary_changes.py index a197a20af3..7bbfb1fd1a 100644 --- a/.github/scripts/test_v8_canary_changes.py +++ b/.github/scripts/test_v8_canary_changes.py @@ -69,6 +69,12 @@ version = "149.2.0" ) ) + def test_security_backport_changes_require_canary_and_source_build(self) -> None: + changed_files = {"patches/v8_array_sort_elements_kind.patch"} + + self.assertTrue(canary_required(changed_files, "152.2.0", "152.2.0")) + self.assertTrue(windows_source_required(changed_files, "152.2.0", "152.2.0")) + def test_changed_files_excludes_changes_made_only_on_base_branch(self) -> None: with tempfile.TemporaryDirectory() as temp_dir: root = Path(temp_dir) diff --git a/.github/scripts/v8_canary_changes.py b/.github/scripts/v8_canary_changes.py index e36e77316c..ee09b1bf39 100644 --- a/.github/scripts/v8_canary_changes.py +++ b/.github/scripts/v8_canary_changes.py @@ -49,6 +49,7 @@ WINDOWS_SOURCE_BUILD_PATHS = { ".github/scripts/v8_canary_changes.py", ".github/workflows/rusty-v8-release.yml", ".github/workflows/v8-canary.yml", + "patches/v8_array_sort_elements_kind.patch", } diff --git a/.github/workflows/rusty-v8-release.yml b/.github/workflows/rusty-v8-release.yml index 32ec3af836..aa53169610 100644 --- a/.github/workflows/rusty-v8-release.yml +++ b/.github/workflows/rusty-v8-release.yml @@ -318,6 +318,17 @@ jobs: submodules: recursive persist-credentials: false + - name: Download Chromium Windows build tools + shell: bash + working-directory: upstream-rusty-v8 + run: | + set -euo pipefail + # Upstream skips this submodule because its standalone mirror is unreliable. + revision="$(git rev-parse HEAD:tools/win)" + mkdir -p tools/win + curl -fsSL "https://chromium.googlesource.com/chromium/src/tools/win/+archive/${revision}.tar.gz" | + tar -xz -C tools/win + - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: @@ -350,10 +361,15 @@ jobs: path: | upstream-rusty-v8/target/sccache upstream-rusty-v8/target/${{ matrix.target }}/release/gn_out - key: rusty-v8-source-${{ matrix.target }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt') }} + key: rusty-v8-source-${{ matrix.target }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt', 'patches/v8_array_sort_elements_kind.patch') }} restore-keys: | rusty-v8-source-${{ matrix.target }}-sandbox- + - name: Apply V8 Array.sort backport + shell: bash + working-directory: upstream-rusty-v8/v8 + run: git apply -p3 "${GITHUB_WORKSPACE}/patches/v8_array_sort_elements_kind.patch" + - name: Install sccache uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2.62.49 with: diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml index 94f1aa0199..ed2c10c0ff 100644 --- a/.github/workflows/v8-canary.yml +++ b/.github/workflows/v8-canary.yml @@ -336,6 +336,17 @@ jobs: submodules: recursive persist-credentials: false + - name: Download Chromium Windows build tools + shell: bash + working-directory: upstream-rusty-v8 + run: | + set -euo pipefail + # Upstream skips this submodule because its standalone mirror is unreliable. + revision="$(git rev-parse HEAD:tools/win)" + mkdir -p tools/win + curl -fsSL "https://chromium.googlesource.com/chromium/src/tools/win/+archive/${revision}.tar.gz" | + tar -xz -C tools/win + - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: @@ -368,10 +379,15 @@ jobs: path: | ${{ steps.setup_ci.outputs.cargo-target-dir }}/sccache ${{ steps.setup_ci.outputs.cargo-target-dir }}/${{ matrix.target }}/release/gn_out - key: rusty-v8-source-${{ matrix.target }}-${{ matrix.runner }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt') }} + key: rusty-v8-source-${{ matrix.target }}-${{ matrix.runner }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt', 'patches/v8_array_sort_elements_kind.patch') }} restore-keys: | rusty-v8-source-${{ matrix.target }}-${{ matrix.runner }}-sandbox- + - name: Apply V8 Array.sort backport + shell: bash + working-directory: upstream-rusty-v8/v8 + run: git apply -p3 "${GITHUB_WORKSPACE}/patches/v8_array_sort_elements_kind.patch" + - name: Install sccache uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2.62.49 with: diff --git a/MODULE.bazel b/MODULE.bazel index 7854947538..211cb41cee 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -555,7 +555,7 @@ crate.annotation( }, crate = "v8", # Keep the Rust feature aligned with the source-built Bazel artifacts. - # Windows MSVC still consumes upstream non-sandboxed prebuilts. + # Windows MSVC consumes Codex sandbox release archives. crate_features_select = { "aarch64-apple-darwin": ["v8_enable_sandbox"], "aarch64-pc-windows-gnullvm": ["v8_enable_sandbox"], @@ -768,27 +768,28 @@ inject_repo(crate, "alsa_lib") ] ] -bazel_dep(name = "v8", version = "15.0.245.2") +bazel_dep(name = "v8", version = "15.2.124.1") archive_override( module_name = "v8", - integrity = "sha256-Fk89PgqLTAKjhtOojRsRM9N+XCC+Ajn+zc3eQUpDQNU=", + integrity = "sha256-aNN5G427qQbP/5o+NXONgXR8ZvS6mjf6mfAI6jtxyzI=", patch_strip = 3, patches = [ "//patches:v8_module_deps.patch", "//patches:v8_bazel_rules.patch", "//patches:v8_source_portability.patch", + "//patches:v8_array_sort_elements_kind.patch", ], - strip_prefix = "v8-15.0.245.2", - urls = ["https://github.com/v8/v8/archive/refs/tags/15.0.245.2.tar.gz"], + strip_prefix = "v8-15.2.124.1", + urls = ["https://github.com/v8/v8/archive/refs/tags/15.2.124.1.tar.gz"], ) http_archive( - name = "v8_crate_150_4_0", + name = "v8_crate_152_2_0", build_file = "//third_party/v8:v8_crate.BUILD.bazel", - sha256 = "42a978ff11f15b24e5c05a7123cf2b68f41e763546699781a924ef4e2cf43a49", - strip_prefix = "v8-150.4.0", + sha256 = "a10fe1a92da5c32c7c7f838ce36c0ccfcfd5edf0865b58bdde820aa64cea9888", + strip_prefix = "v8-152.2.0", type = "tar.gz", - urls = ["https://static.crates.io/crates/v8/v8-150.4.0.crate"], + urls = ["https://static.crates.io/crates/v8/v8-152.2.0.crate"], ) git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") @@ -796,7 +797,7 @@ git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "g git_repository( name = "rusty_v8_libcxx", build_file = "//third_party/v8:libcxx.BUILD.bazel", - commit = "5abc7f839700f0f17338434e1c1c6a8c87c00c11", + commit = "b16984ce99c702355a5b2b4c52574e82cec41fb9", remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git", ) @@ -810,10 +811,12 @@ git_repository( git_repository( name = "rusty_v8_llvm_libc", build_file = "//third_party/v8:llvm_libc.BUILD.bazel", - commit = "9309c117ebae84dd2f9df1ef99de4782162527d5", + commit = "75ae50cd48c8a9d70f552ccff040029968778da9", remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git", ) +# TODO: Replace these unused 150.4.0 pins with the 152.2.0 Windows sandbox +# artifacts and checksums produced by v8-canary before merging this candidate. http_file( name = "rusty_v8_150_4_0_aarch64_pc_windows_msvc_archive", downloaded_file_path = "rusty_v8_release_aarch64-pc-windows-msvc.lib.gz", diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index 55bde0a88c..5657108cd4 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -12,7 +12,6 @@ "https://bcr.bazel.build/modules/abseil-cpp/20240116.2/MODULE.bazel": "73939767a4686cd9a520d16af5ab440071ed75cec1a876bf2fcfaf1f71987a16", "https://bcr.bazel.build/modules/abseil-cpp/20250127.1/MODULE.bazel": "c4a89e7ceb9bf1e25cf84a9f830ff6b817b72874088bf5141b314726e46a57c1", "https://bcr.bazel.build/modules/abseil-cpp/20250512.1/MODULE.bazel": "d209fdb6f36ffaf61c509fcc81b19e81b411a999a934a032e10cd009a0226215", - "https://bcr.bazel.build/modules/abseil-cpp/20250814.0/MODULE.bazel": "c43c16ca2c432566cdb78913964497259903ebe8fb7d9b57b38e9f1425b427b8", "https://bcr.bazel.build/modules/abseil-cpp/20250814.1/MODULE.bazel": "51f2312901470cdab0dbdf3b88c40cd21c62a7ed58a3de45b365ddc5b11bcab2", "https://bcr.bazel.build/modules/abseil-cpp/20250814.1/source.json": "cea3901d7e299da7320700abbaafe57a65d039f10d0d7ea601c4a66938ea4b0c", "https://bcr.bazel.build/modules/alsa_lib/1.2.9.bcr.4/MODULE.bazel": "66842efc2b50b7c12274a5218d468119a5d6f9dc46a5164d9496fb517f64aba6", @@ -120,7 +119,6 @@ "https://bcr.bazel.build/modules/protobuf/23.1/MODULE.bazel": "88b393b3eb4101d18129e5db51847cd40a5517a53e81216144a8c32dfeeca52a", "https://bcr.bazel.build/modules/protobuf/24.4/MODULE.bazel": "7bc7ce5f2abf36b3b7b7c8218d3acdebb9426aeb35c2257c96445756f970eb12", "https://bcr.bazel.build/modules/protobuf/27.0/MODULE.bazel": "7873b60be88844a0a1d8f80b9d5d20cfbd8495a689b8763e76c6372998d3f64c", - "https://bcr.bazel.build/modules/protobuf/27.1/MODULE.bazel": "703a7b614728bb06647f965264967a8ef1c39e09e8f167b3ca0bb1fd80449c0d", "https://bcr.bazel.build/modules/protobuf/29.0-rc2/MODULE.bazel": "6241d35983510143049943fc0d57937937122baf1b287862f9dc8590fc4c37df", "https://bcr.bazel.build/modules/protobuf/29.0-rc3/MODULE.bazel": "33c2dfa286578573afc55a7acaea3cada4122b9631007c594bf0729f41c8de92", "https://bcr.bazel.build/modules/protobuf/29.1/MODULE.bazel": "557c3457560ff49e122ed76c0bc3397a64af9574691cb8201b4e46d4ab2ecb95", @@ -162,6 +160,7 @@ "https://bcr.bazel.build/modules/rules_cc/0.2.13/MODULE.bazel": "eecdd666eda6be16a8d9dc15e44b5c75133405e820f620a234acc4b1fdc5aa37", "https://bcr.bazel.build/modules/rules_cc/0.2.14/MODULE.bazel": "353c99ed148887ee89c54a17d4100ae7e7e436593d104b668476019023b58df8", "https://bcr.bazel.build/modules/rules_cc/0.2.16/MODULE.bazel": "9242fa89f950c6ef7702801ab53922e99c69b02310c39fb6e62b2bd30df2a1d4", + "https://bcr.bazel.build/modules/rules_cc/0.2.17/MODULE.bazel": "1849602c86cb60da8613d2de887f9566a6d354a6df6d7009f9d04a14402f9a84", "https://bcr.bazel.build/modules/rules_cc/0.2.18/MODULE.bazel": "4460ec36adc8f722a6a2a4ac9374cb91f2acebadaa93fc37966129afb3dece87", "https://bcr.bazel.build/modules/rules_cc/0.2.19/MODULE.bazel": "d5e0f05b63273281a16654eb6b1a8742a75ec153ac8b4f0419949d6e401e46f0", "https://bcr.bazel.build/modules/rules_cc/0.2.20/MODULE.bazel": "f5c07bce5ddcb99be21a0812ff5aadb439e688b7449c6542152363b2fd859c1a", @@ -209,7 +208,6 @@ "https://bcr.bazel.build/modules/rules_proto/5.3.0-21.7/MODULE.bazel": "e8dff86b0971688790ae75528fe1813f71809b5afd57facb44dad9e8eca631b7", "https://bcr.bazel.build/modules/rules_proto/6.0.0-rc1/MODULE.bazel": "1e5b502e2e1a9e825eef74476a5a1ee524a92297085015a052510b09a1a09483", "https://bcr.bazel.build/modules/rules_proto/6.0.2/MODULE.bazel": "ce916b775a62b90b61888052a416ccdda405212b6aaeb39522f7dc53431a5e73", - "https://bcr.bazel.build/modules/rules_proto/7.0.2/MODULE.bazel": "bf81793bd6d2ad89a37a40693e56c61b0ee30f7a7fdbaf3eabbf5f39de47dea2", "https://bcr.bazel.build/modules/rules_proto/7.1.0/MODULE.bazel": "002d62d9108f75bb807cd56245d45648f38275cb3a99dcd45dfb864c5d74cb96", "https://bcr.bazel.build/modules/rules_proto/7.1.0/source.json": "39f89066c12c24097854e8f57ab8558929f9c8d474d34b2c00ac04630ad8940e", "https://bcr.bazel.build/modules/rules_python/0.10.2/MODULE.bazel": "cc82bc96f2997baa545ab3ce73f196d040ffb8756fd2d66125a530031cd90e5f", @@ -220,7 +218,6 @@ "https://bcr.bazel.build/modules/rules_python/0.33.2/MODULE.bazel": "3e036c4ad8d804a4dad897d333d8dce200d943df4827cb849840055be8d2e937", "https://bcr.bazel.build/modules/rules_python/0.34.0/MODULE.bazel": "1d623d026e075b78c9fde483a889cda7996f5da4f36dffb24c246ab30f06513a", "https://bcr.bazel.build/modules/rules_python/0.4.0/MODULE.bazel": "9208ee05fd48bf09ac60ed269791cf17fb343db56c8226a720fbb1cdf467166c", - "https://bcr.bazel.build/modules/rules_python/1.0.0/MODULE.bazel": "898a3d999c22caa585eb062b600f88654bf92efb204fa346fb55f6f8edffca43", "https://bcr.bazel.build/modules/rules_python/1.2.0/MODULE.bazel": "5aeeb48b2a6c19d668b48adf2b8a2b209a6310c230db0ce77450f148a89846e4", "https://bcr.bazel.build/modules/rules_python/1.3.0/MODULE.bazel": "8361d57eafb67c09b75bf4bbe6be360e1b8f4f18118ab48037f2bd50aa2ccb13", "https://bcr.bazel.build/modules/rules_python/1.4.1/MODULE.bazel": "8991ad45bdc25018301d6b7e1d3626afc3c8af8aaf4bc04f23d0b99c938b73a6", @@ -934,7 +931,7 @@ "debugserver-types_0.5.0": "{\"dependencies\":[{\"name\":\"schemafy\",\"req\":\"^0.5.0\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"serde_json\",\"req\":\"^1.0\"}],\"features\":{}}", "deflate64_0.1.10": "{\"dependencies\":[{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"bytemuck\",\"req\":\"^1.13.1\"},{\"kind\":\"dev\",\"name\":\"proptest\",\"req\":\"^1.2.0\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.7.1\"}],\"features\":{}}", "deltae_0.3.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"clap\",\"req\":\"^4.2.1\"}],\"features\":{}}", - "deno_core_icudata_0.77.0": "{\"dependencies\":[],\"features\":{}}", + "deno_core_icudata_0.78.0": "{\"dependencies\":[],\"features\":{}}", "der-parser_10.0.0": "{\"dependencies\":[{\"name\":\"asn1-rs\",\"req\":\"^0.7\"},{\"name\":\"bitvec\",\"optional\":true,\"req\":\"^1.0\"},{\"name\":\"cookie-factory\",\"optional\":true,\"req\":\"^0.3.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"hex-literal\",\"req\":\"^0.4\"},{\"name\":\"nom\",\"req\":\"^7.0\"},{\"name\":\"num-bigint\",\"optional\":true,\"req\":\"^0.4\"},{\"name\":\"num-traits\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"pretty_assertions\",\"req\":\"^1.0\"},{\"name\":\"rusticata-macros\",\"req\":\"^4.0\"},{\"kind\":\"dev\",\"name\":\"test-case\",\"req\":\"^3.0\"}],\"features\":{\"as_bitvec\":[\"bitvec\"],\"bigint\":[\"num-bigint\"],\"default\":[\"std\"],\"serialize\":[\"std\",\"cookie-factory\"],\"std\":[],\"unstable\":[]}}", "der-parser_9.0.0": "{\"dependencies\":[{\"name\":\"asn1-rs\",\"req\":\"^0.6\"},{\"name\":\"cookie-factory\",\"optional\":true,\"req\":\"^0.3.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"hex-literal\",\"req\":\"^0.4\"},{\"name\":\"nom\",\"req\":\"^7.0\"},{\"name\":\"num-bigint\",\"optional\":true,\"req\":\"^0.4\"},{\"name\":\"num-traits\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"pretty_assertions\",\"req\":\"^1.0\"},{\"name\":\"rusticata-macros\",\"req\":\"^4.0\"},{\"kind\":\"dev\",\"name\":\"test-case\",\"req\":\"^3.0\"}],\"features\":{\"bigint\":[\"num-bigint\"],\"default\":[\"std\"],\"serialize\":[\"std\",\"cookie-factory\"],\"std\":[],\"unstable\":[]}}", "der_0.7.10": "{\"dependencies\":[{\"features\":[\"derive\"],\"name\":\"arbitrary\",\"optional\":true,\"req\":\"^1.3\"},{\"default_features\":false,\"name\":\"bytes\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"const-oid\",\"optional\":true,\"req\":\"^0.9.2\"},{\"name\":\"der_derive\",\"optional\":true,\"req\":\"^0.7.2\"},{\"name\":\"flagset\",\"optional\":true,\"req\":\"^0.4.3\"},{\"kind\":\"dev\",\"name\":\"hex-literal\",\"req\":\"^0.4.1\"},{\"features\":[\"alloc\"],\"name\":\"pem-rfc7468\",\"optional\":true,\"req\":\"^0.7\"},{\"kind\":\"dev\",\"name\":\"proptest\",\"req\":\"^1\"},{\"default_features\":false,\"name\":\"time\",\"optional\":true,\"req\":\"^0.3.4\"},{\"default_features\":false,\"name\":\"zeroize\",\"optional\":true,\"req\":\"^1.5\"}],\"features\":{\"alloc\":[\"zeroize?/alloc\"],\"arbitrary\":[\"dep:arbitrary\",\"const-oid?/arbitrary\",\"std\"],\"bytes\":[\"dep:bytes\",\"alloc\"],\"derive\":[\"dep:der_derive\"],\"oid\":[\"dep:const-oid\"],\"pem\":[\"dep:pem-rfc7468\",\"alloc\",\"zeroize\"],\"real\":[],\"std\":[\"alloc\"]}}", @@ -1959,7 +1956,7 @@ "utf8_iter_1.0.4": "{\"dependencies\":[],\"features\":{}}", "utf8parse_0.2.2": "{\"dependencies\":[],\"features\":{\"default\":[],\"nightly\":[]}}", "uuid_1.20.0": "{\"dependencies\":[{\"name\":\"arbitrary\",\"optional\":true,\"req\":\"^1.1.3\"},{\"default_features\":false,\"name\":\"atomic\",\"optional\":true,\"req\":\"^0.6\"},{\"default_features\":false,\"name\":\"borsh\",\"optional\":true,\"req\":\"^1\"},{\"default_features\":false,\"name\":\"borsh-derive\",\"optional\":true,\"req\":\"^1\"},{\"features\":[\"derive\"],\"name\":\"bytemuck\",\"optional\":true,\"req\":\"^1.20.0\"},{\"name\":\"getrandom\",\"optional\":true,\"req\":\"^0.3\",\"target\":\"cfg(not(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\"))))\"},{\"default_features\":false,\"name\":\"js-sys\",\"optional\":true,\"req\":\"^0.3\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\"), target_feature = \\\"atomics\\\"))\"},{\"default_features\":false,\"name\":\"md-5\",\"optional\":true,\"req\":\"^0.10\"},{\"name\":\"rand\",\"optional\":true,\"req\":\"^0.9\",\"target\":\"cfg(not(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\"))))\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.221\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.221\"},{\"kind\":\"dev\",\"name\":\"serde_derive\",\"req\":\"^1.0.221\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serde_test\",\"req\":\"^1.0.56\"},{\"default_features\":false,\"name\":\"sha1_smol\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"slog\",\"optional\":true,\"req\":\"^2\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.52\"},{\"name\":\"uuid-rng-internal-lib\",\"optional\":true,\"package\":\"uuid-rng-internal\",\"req\":\"^1.20.0\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"default_features\":false,\"features\":[\"msrv\"],\"name\":\"wasm-bindgen\",\"optional\":true,\"req\":\"^0.2\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen\",\"req\":\"^0.2\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"features\":[\"derive\"],\"name\":\"zerocopy\",\"optional\":true,\"req\":\"^0.8\"}],\"features\":{\"atomic\":[\"dep:atomic\"],\"borsh\":[\"dep:borsh\",\"dep:borsh-derive\"],\"default\":[\"std\"],\"fast-rng\":[\"rng\",\"dep:rand\"],\"js\":[\"dep:wasm-bindgen\",\"dep:js-sys\"],\"macro-diagnostics\":[],\"md5\":[\"dep:md-5\"],\"rng\":[\"dep:getrandom\"],\"rng-getrandom\":[\"rng\",\"dep:getrandom\",\"uuid-rng-internal-lib\",\"uuid-rng-internal-lib/getrandom\"],\"rng-rand\":[\"rng\",\"dep:rand\",\"uuid-rng-internal-lib\",\"uuid-rng-internal-lib/rand\"],\"serde\":[\"dep:serde_core\"],\"sha1\":[\"dep:sha1_smol\"],\"std\":[\"wasm-bindgen?/std\",\"js-sys?/std\"],\"v1\":[\"atomic\"],\"v3\":[\"md5\"],\"v4\":[\"rng\"],\"v5\":[\"sha1\"],\"v6\":[\"atomic\"],\"v7\":[\"rng\"],\"v8\":[]}}", - "v8_150.4.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"align-data\",\"req\":\"^0.1.0\"},{\"kind\":\"build\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"kind\":\"dev\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"name\":\"bitflags\",\"req\":\"^2.5\"},{\"kind\":\"dev\",\"name\":\"bytes\",\"req\":\"^1\"},{\"kind\":\"build\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"build\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"dev\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"build\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"dev\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"build\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"kind\":\"dev\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"name\":\"paste\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1\"},{\"features\":[\"zoneinfo64\"],\"name\":\"temporal_capi\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.96\"},{\"kind\":\"build\",\"name\":\"which\",\"req\":\"^6\"},{\"kind\":\"dev\",\"name\":\"which\",\"req\":\"^6\"}],\"features\":{\"default\":[\"use_custom_libcxx\"],\"simdutf\":[],\"use_custom_libcxx\":[],\"v8_enable_pointer_compression\":[],\"v8_enable_sandbox\":[\"v8_enable_pointer_compression\"],\"v8_enable_v8_checks\":[]}}", + "v8_152.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"align-data\",\"req\":\"^0.1.0\"},{\"kind\":\"build\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"kind\":\"dev\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"name\":\"bitflags\",\"req\":\"^2.5\"},{\"kind\":\"dev\",\"name\":\"bytes\",\"req\":\"^1\"},{\"kind\":\"build\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"build\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"dev\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"build\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"dev\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"build\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"kind\":\"dev\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"name\":\"paste\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1\"},{\"features\":[\"zoneinfo64\"],\"name\":\"temporal_capi\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.96\"},{\"kind\":\"build\",\"name\":\"which\",\"req\":\"^6\"},{\"kind\":\"dev\",\"name\":\"which\",\"req\":\"^6\"}],\"features\":{\"default\":[\"use_custom_libcxx\"],\"simdutf\":[],\"use_custom_libcxx\":[],\"v8_enable_pointer_compression\":[],\"v8_enable_sandbox\":[\"v8_enable_pointer_compression\"],\"v8_enable_v8_checks\":[]}}", "valuable_0.1.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.3\"},{\"name\":\"valuable-derive\",\"optional\":true,\"req\":\"=0.1.1\"}],\"features\":{\"alloc\":[],\"default\":[\"std\"],\"derive\":[\"valuable-derive\"],\"std\":[\"alloc\"]}}", "vcpkg_0.2.15": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"lazy_static\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"tempdir\",\"req\":\"^0.3.7\"}],\"features\":{}}", "version-compare_0.2.1": "{\"dependencies\":[],\"features\":{}}", diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock index 757328f641..b0ffa0bf4f 100644 --- a/codex-rs/Cargo.lock +++ b/codex-rs/Cargo.lock @@ -6137,9 +6137,9 @@ checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4" [[package]] name = "deno_core_icudata" -version = "0.77.0" +version = "0.78.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a9efff8990a82c1ae664292507e1a5c6749ddd2312898cdf9cd7cb1fd4bc64c6" +checksum = "b963d2d79672b4c379e4511acccd27bb35b4c1b32a93f596d52ff14a064293bc" [[package]] name = "der" @@ -16498,9 +16498,9 @@ dependencies = [ [[package]] name = "v8" -version = "150.4.0" +version = "152.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42a978ff11f15b24e5c05a7123cf2b68f41e763546699781a924ef4e2cf43a49" +checksum = "a10fe1a92da5c32c7c7f838ce36c0ccfcfd5edf0865b58bdde820aa64cea9888" dependencies = [ "bindgen", "bitflags 2.13.1", diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml index f4ecb1ce04..e68409b964 100644 --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml @@ -347,7 +347,7 @@ crossbeam-channel = "0.5.15" crypto_box = { version = "0.9.1", features = ["seal"] } crossterm = "0.29.0" ctor = "0.6.3" -deno_core_icudata = "0.77.0" +deno_core_icudata = "0.78.0" derive_more = "2" diffy = "0.4.2" dirs = "6" @@ -518,7 +518,7 @@ unicode-width = "0.2" url = "2" urlencoding = "2.1" uuid = "1" -v8 = "=150.4.0" +v8 = "=152.2.0" vt100 = "0.16.2" walkdir = "2.5.0" webbrowser = "1.2.2" diff --git a/codex-rs/code-mode-runtime/src/v8_init.rs b/codex-rs/code-mode-runtime/src/v8_init.rs index 016992c932..769ab262dd 100644 --- a/codex-rs/code-mode-runtime/src/v8_init.rs +++ b/codex-rs/code-mode-runtime/src/v8_init.rs @@ -40,7 +40,7 @@ pub(crate) fn ensure_v8_initialized() -> Result<(), String> { } fn initialize_v8_with_mode(jit_mode: V8JitMode) -> Result { - v8::icu::set_common_data_77(deno_core_icudata::ICU_DATA) + v8::icu::set_common_data_78(deno_core_icudata::ICU_DATA) .map_err(|error_code| format!("failed to initialize ICU data: {error_code}"))?; // The pinned V8 can inline Array.prototype.sort with incompatible element kinds. // Disable the affected paths in TurboFan and the Maglev/Turbolev frontend until diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel index 7b58251d8a..662f89dbc8 100644 --- a/patches/BUILD.bazel +++ b/patches/BUILD.bazel @@ -21,6 +21,7 @@ exports_files([ "tikv-jemalloc-sys_make_env.patch", "tikv-jemalloc-sys_dependency_flags.patch", "v8_bazel_rules.patch", + "v8_array_sort_elements_kind.patch", "v8_module_deps.patch", "v8_source_portability.patch", "webrtc-sys_hermetic_darwin_sysroot.patch", diff --git a/patches/rusty_v8_prebuilt_out_dir.patch b/patches/rusty_v8_prebuilt_out_dir.patch index 4242a29beb..282f95d473 100644 --- a/patches/rusty_v8_prebuilt_out_dir.patch +++ b/patches/rusty_v8_prebuilt_out_dir.patch @@ -4,14 +4,13 @@ --- a/build.rs +++ b/build.rs -@@ -543,10 +543,15 @@ +@@ -782,8 +782,13 @@ } fn static_lib_name(suffix: &str) -> String { -- let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap(); -- if target_os == "windows" { + let target = env::var("TARGET").unwrap(); -+ let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap(); + let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap(); +- if target_os == "windows" { + if target.contains("windows-gnullvm") { + // rustc looks for GNU-style archive names when bundling `-lstatic` on the + // gnullvm targets, even though the prebuilt release is a COFF `.lib`. @@ -20,9 +19,7 @@ format!("rusty_v8{suffix}.lib") } else { format!("librusty_v8{suffix}.a") - } - } -@@ -577,7 +577,23 @@ +@@ -961,7 +966,23 @@ path } @@ -46,7 +43,7 @@ build_dir().join("gn_out").join("obj") } -@@ -794,22 +810,23 @@ +@@ -1679,9 +1700,11 @@ } fn print_link_flags() { @@ -58,13 +55,7 @@ || env::var("GN_ARGS").is_ok_and(|gn_args| { gn_args .split_whitespace() - .any(|ba| ba == "use_custom_libcxx=false") - }); - - if should_dyn_link_libcxx { - // Based on https://github.com/alexcrichton/cc-rs/blob/fba7feded71ee4f63cfe885673ead6d7b4f2f454/src/lib.rs#L2462 - if let Ok(stdlib) = env::var("CXXSTDLIB") { - if !stdlib.is_empty() { +@@ -1695,7 +1718,6 @@ println!("cargo:rustc-link-lib=dylib={stdlib}"); } } else { diff --git a/patches/v8_array_sort_elements_kind.patch b/patches/v8_array_sort_elements_kind.patch new file mode 100644 index 0000000000..cb1a6927bc --- /dev/null +++ b/patches/v8_array_sort_elements_kind.patch @@ -0,0 +1,163 @@ +# What: backport CVE-2026-85046 to V8 15.2.124.1 by rejecting mixed +# elements kinds when inlining Array.prototype.sort. +# Scope: Maglev/TurboFan implementation guards and the upstream regression test. +# Upstream M152 fix: https://github.com/v8/v8/commit/94c34b200ae9caf83d06c167a070746a1c7e825c +# CVE advisory: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html + +diff --git a/orig/v8-15.2.124.1/src/compiler/js-call-reducer.cc b/mod/v8-15.2.124.1/src/compiler/js-call-reducer.cc +index e8707261d3e2..0e2d9bfd0a74 100644 +--- a/orig/v8-15.2.124.1/src/compiler/js-call-reducer.cc ++++ b/mod/v8-15.2.124.1/src/compiler/js-call-reducer.cc +@@ -4068,6 +4068,10 @@ class IteratingArrayBuiltinHelper { + return; + } + ++ all_elements_kinds_equal_ = std::all_of( ++ receiver_maps.begin(), receiver_maps.end(), ++ [&](MapRef map) { return map.elements_kind() == elements_kind_; }); ++ + // TODO(jgruber): May only be needed for holey elements kinds. + if (!dependencies->DependOnNoElementsProtector()) return; + +@@ -4083,10 +4087,13 @@ class IteratingArrayBuiltinHelper { + Control control() const { return control_; } + MapInference* inference() { return &inference_; } + ElementsKind elements_kind() const { return elements_kind_; } ++ // False when elements_kind() is a union over differing receiver kinds. ++ bool all_elements_kinds_equal() const { return all_elements_kinds_equal_; } + + private: + bool can_reduce_ = false; + bool has_stability_dependency_ = false; ++ bool all_elements_kinds_equal_ = false; + Node* receiver_; + Effect effect_; + Control control_; +@@ -4126,6 +4133,11 @@ Reduction JSCallReducer::ReduceArraySort(Node* node, + IteratingArrayBuiltinHelper h(node, broker(), jsgraph(), dependencies()); + if (!h.can_reduce()) return h.inference()->NoChange(); + ++ // The union kind is only an upper bound on each receiver's own kind. Loads ++ // through it widen and are sound; stores narrow and are not. Unlike the ++ // iterating builtins, sort writes its snapshot back into the receiver. ++ if (!h.all_elements_kinds_equal()) return h.inference()->NoChange(); ++ + // Only non-holey, non-double PACKED kinds are supported. Holey arrays need + // hole handling; double arrays need a FixedDoubleArray temp copy. + if (IsHoleyElementsKind(h.elements_kind())) return h.inference()->NoChange(); +diff --git a/orig/v8-15.2.124.1/src/maglev/maglev-graph-builder.cc b/mod/v8-15.2.124.1/src/maglev/maglev-graph-builder.cc +index c40cadb32d92..c6ae7f791267 100644 +--- a/orig/v8-15.2.124.1/src/maglev/maglev-graph-builder.cc ++++ b/mod/v8-15.2.124.1/src/maglev/maglev-graph-builder.cc +@@ -9797,6 +9797,16 @@ MaybeReduceResult MaglevGraphBuilder::TryReduceArrayPrototypeSort( + " array iteration"); + } + ++ // The union kind is only an upper bound on each receiver's own kind. Loads ++ // through it widen and are sound; stores narrow and are not. Unlike the ++ // iterating builtins, sort writes its snapshot back into the receiver. ++ if (std::any_of(possible_maps->begin(), possible_maps->end(), ++ [&](compiler::MapRef map) { ++ return map.elements_kind() != elements_kind; ++ })) { ++ FAIL(" to reduce Array.prototype.sort - receiver elements kinds disagree"); ++ } ++ + // Holey arrays require holes to be moved to the end of the sorted result + // (ECMA-262 23.1.3.30 step 5, skip-holes mode). The insertion sort does + // not implement this, so bail out for any holey kind. +diff --git a/orig/v8-15.2.124.1/test/mjsunit/regress/regress-crbug-542403045.js b/mod/v8-15.2.124.1/test/mjsunit/regress/regress-crbug-542403045.js +new file mode 100644 +index 000000000000..e60a974f8784 +--- /dev/null ++++ b/mod/v8-15.2.124.1/test/mjsunit/regress/regress-crbug-542403045.js +@@ -0,0 +1,89 @@ ++// Copyright 2026 the V8 project authors. All rights reserved. ++// Use of this source code is governed by a BSD-style license that can be ++// found in the LICENSE file. ++ ++// Flags: --allow-natives-syntax --maglev ++ ++// The inlined sort snapshots the receiver's elements, runs comparefn, then ++// copies the snapshot back specialized on the receiver's elements kind. With ++// polymorphic {PACKED_SMI,PACKED} feedback that kind is the union ++// PACKED_ELEMENTS, which no longer describes a receiver that comparefn has ++// narrowed back to PACKED_SMI_ELEMENTS. ++ ++function sort(a) { ++ function compare() { ++ a.fill(0); ++ return 0; ++ } ++ return a.sort(compare); ++} ++ ++%PrepareFunctionForOptimization(sort); ++for (let i = 0; i < 100; ++i) { ++ sort([1, 2]); ++ sort([{}, {}]); ++} ++%OptimizeMaglevOnNextCall(sort); ++sort([1, 2]); ++ ++const object = {}; ++const bad = [object, {}]; ++sort(bad); ++ ++// A Smi-elements array must never hold a HeapObject. ++assertFalse(%HasSmiElements(bad) && bad[0] === object); ++ ++// Mixed-kind feedback is not inlined, but still sorts correctly. ++function sortMixed(a) { ++ return a.sort((x, y) => x - y); ++} ++%PrepareFunctionForOptimization(sortMixed); ++for (let i = 0; i < 100; ++i) { ++ sortMixed([2, 1]); ++ sortMixed([{}, {}]); ++} ++%OptimizeMaglevOnNextCall(sortMixed); ++assertEquals([1, 2, 3], sortMixed([3, 1, 2])); ++ ++// Same via a Smi/double mix, whose union kind PACKED_DOUBLE_ELEMENTS is ++// rejected by the double bailout rather than the kind-agreement one. ++function sortDouble(a) { ++ function compare(x, y) { ++ a.fill(0); ++ return x - y; ++ } ++ return a.sort(compare); ++} ++%PrepareFunctionForOptimization(sortDouble); ++for (let i = 0; i < 100; ++i) { ++ sortDouble([2, 1]); ++ sortDouble([2.5, 1.5]); ++} ++%OptimizeMaglevOnNextCall(sortDouble); ++sortDouble([2, 1]); ++// The sort writes its snapshot back, so comparefn's fill is not observable. ++assertEquals([1.5, 2.5], sortDouble([2.5, 1.5])); ++ ++// Sites whose receiver kinds agree keep the inlined path, including when the ++// maps themselves differ. ++function withProperty() { ++ const a = [{}, {}]; ++ a.foo = 1; ++ return a; ++} ++function sortSameKind(a) { ++ return a.sort((x, y) => 0); ++} ++%PrepareFunctionForOptimization(sortSameKind); ++for (let i = 0; i < 100; ++i) { ++ sortSameKind([{}, {}]); ++ sortSameKind(withProperty()); ++} ++%OptimizeMaglevOnNextCall(sortSameKind); ++sortSameKind([{}, {}]); ++assertOptimized(sortSameKind); ++for (let i = 0; i < 100; ++i) { ++ sortSameKind([{}, {}]); ++ sortSameKind(withProperty()); ++} ++assertOptimized(sortSameKind); diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch index c907d32d21..e202051a16 100644 --- a/patches/v8_bazel_rules.patch +++ b/patches/v8_bazel_rules.patch @@ -3,20 +3,21 @@ # Scope: Bazel BUILD/defs/BUILD.icu integration only, including dependency # wiring, generated sources, and visibility; no standalone V8 source patching. -diff --git a/orig/v8-15.0.245.2/bazel/defs.bzl b/mod/v8-15.0.245.2/bazel/defs.bzl +diff --git a/orig/v8-15.2.124.1/bazel/defs.bzl b/mod/v8-15.2.124.1/bazel/defs.bzl index bbe1495..6673518 100644 ---- a/orig/v8-15.0.245.2/bazel/defs.bzl -+++ b/mod/v8-15.0.245.2/bazel/defs.bzl -@@ -33,9 +33,21 @@ _create_option_int = rule( +--- a/orig/v8-15.2.124.1/bazel/defs.bzl ++++ b/mod/v8-15.2.124.1/bazel/defs.bzl +@@ -42,9 +42,22 @@ _create_option_int = rule( ) def v8_flag(name, default = False): -- _create_option_flag(name = name, build_setting_default = default) +- _create_option_flag(name = name, build_setting_default = default, scope = "universal") - native.config_setting(name = "is_" + name, flag_values = {name: "True"}) - native.config_setting(name = "is_not_" + name, flag_values = {name: "False"}) + _create_option_flag( + name = name, + build_setting_default = default, ++ scope = "universal", + visibility = ["//visibility:public"], + ) + native.config_setting( @@ -31,7 +32,7 @@ index bbe1495..6673518 100644 + ) def v8_string(name, default = ""): - _create_option_string(name = name, build_setting_default = default) + _create_option_string(name = name, build_setting_default = default, scope = "universal") @@ -97,7 +109,13 @@ v8_config = rule( def _default_args(): @@ -154,10 +155,10 @@ index bbe1495..6673518 100644 suffix = suffix, target_os = select({ "@v8//bazel/config:is_macos": "mac", -diff --git a/orig/v8-15.0.245.2/BUILD.bazel b/mod/v8-15.0.245.2/BUILD.bazel +diff --git a/orig/v8-15.2.124.1/BUILD.bazel b/mod/v8-15.2.124.1/BUILD.bazel index b432f86..28c567b 100644 ---- a/orig/v8-15.0.245.2/BUILD.bazel -+++ b/mod/v8-15.0.245.2/BUILD.bazel +--- a/orig/v8-15.2.124.1/BUILD.bazel ++++ b/mod/v8-15.2.124.1/BUILD.bazel @@ -148,6 +148,10 @@ v8_flag(name = "v8_enable_trace_maps") v8_flag(name = "v8_enable_v8_checks") @@ -398,10 +399,10 @@ index b432f86..28c567b 100644 }), noicu_deps = [":v8_libshared_noicu"], noicu_srcs = [ -diff --git a/orig/v8-15.0.245.2/bazel/BUILD.icu b/mod/v8-15.0.245.2/bazel/BUILD.icu +diff --git a/orig/v8-15.2.124.1/bazel/BUILD.icu b/mod/v8-15.2.124.1/bazel/BUILD.icu index 5fda2f4..8c3c372 100644 ---- a/orig/v8-15.0.245.2/bazel/BUILD.icu -+++ b/mod/v8-15.0.245.2/bazel/BUILD.icu +--- a/orig/v8-15.2.124.1/bazel/BUILD.icu ++++ b/mod/v8-15.2.124.1/bazel/BUILD.icu @@ -1,3 +1,24 @@ +load("@rules_cc//cc:defs.bzl", "cc_library") + diff --git a/patches/v8_module_deps.patch b/patches/v8_module_deps.patch index d179617e63..770ec05e14 100644 --- a/patches/v8_module_deps.patch +++ b/patches/v8_module_deps.patch @@ -3,14 +3,14 @@ # Scope: upstream MODULE.bazel only; affects external repo resolution and Bazel # module wiring, not V8 source files. -diff --git a/orig/v8-15.0.245.2/MODULE.bazel b/mod/v8-15.0.245.2/MODULE.bazel +diff --git a/orig/v8-15.2.124.1/MODULE.bazel b/mod/v8-15.2.124.1/MODULE.bazel index b8bf8bd..573f463 100644 ---- a/orig/v8-15.0.245.2/MODULE.bazel -+++ b/mod/v8-15.0.245.2/MODULE.bazel -@@ -8,193 +8,67 @@ bazel_dep(name = "rules_cc", version = "0.2.0") - bazel_dep(name = "rules_python", version = "1.0.0") +--- a/orig/v8-15.2.124.1/MODULE.bazel ++++ b/mod/v8-15.2.124.1/MODULE.bazel +@@ -8,193 +8,67 @@ bazel_dep(name = "rules_cc", version = "0.2.17") + bazel_dep(name = "rules_python", version = "1.7.0") bazel_dep(name = "platforms", version = "1.0.0") - bazel_dep(name = "abseil-cpp", version = "20250814.0") + bazel_dep(name = "abseil-cpp", version = "20250814.1") -bazel_dep(name = "highway", version = "1.2.0") - -pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip") @@ -155,7 +155,7 @@ index b8bf8bd..573f463 100644 +git_repository( + name = "icu", + build_file = "@v8//:bazel/BUILD.icu", -+ commit = "a86a32e67b8d1384b33f8fa48c83a6079b86f8cd", ++ commit = "d578f2e8b7bd5938e21cfb6bf15c079e0aa5b738", + patch_cmds = ["find source -name BUILD.bazel | xargs rm"], + patch_cmds_win = ["Get-ChildItem -Path source -File -Include BUILD.bazel -Recurse | Remove-Item"], + remote = "https://chromium.googlesource.com/chromium/deps/icu.git", @@ -252,11 +252,11 @@ index b8bf8bd..573f463 100644 + ], ) +use_repo(pip, "v8_python_deps") -diff --git a/mod/v8-15.0.245.2/bazel/highway.patch b/mod/v8-15.0.245.2/bazel/highway.patch +diff --git a/mod/v8-15.2.124.1/bazel/highway.patch b/mod/v8-15.2.124.1/bazel/highway.patch new file mode 100644 index 0000000..5a13dd0 --- /dev/null -+++ b/mod/v8-15.0.245.2/bazel/highway.patch ++++ b/mod/v8-15.2.124.1/bazel/highway.patch @@ -0,0 +1,25 @@ +diff --git a/BUILD b/BUILD +--- a/BUILD diff --git a/patches/v8_source_portability.patch b/patches/v8_source_portability.patch index 6b6537cb9c..6002e042b8 100644 --- a/patches/v8_source_portability.patch +++ b/patches/v8_source_portability.patch @@ -2,10 +2,10 @@ # Scope: minimal source-level portability fixes only, such as libexecinfo guards, # weak glibc symbol handling, and warning annotations; no dependency # include-path rewrites or intentional V8 feature changes. -diff --git a/orig/v8-15.0.245.2/src/base/bits.h b/mod/v8-15.0.245.2/src/base/bits.h +diff --git a/orig/v8-15.2.124.1/src/base/bits.h b/mod/v8-15.2.124.1/src/base/bits.h index 179a10f..4791e96 100644 ---- a/orig/v8-15.0.245.2/src/base/bits.h -+++ b/mod/v8-15.0.245.2/src/base/bits.h +--- a/orig/v8-15.2.124.1/src/base/bits.h ++++ b/mod/v8-15.2.124.1/src/base/bits.h @@ -270,11 +270,17 @@ inline constexpr uint32_t RoundDownToPowerOfTwo32(uint32_t value) { } @@ -24,10 +24,10 @@ index 179a10f..4791e96 100644 inline constexpr uint32_t RotateLeft32(uint32_t value, uint32_t shift) { return (value << shift) | (value >> ((32 - shift) & 31)); } -diff --git a/orig/v8-15.0.245.2/src/base/debug/stack_trace_posix.cc b/mod/v8-15.0.245.2/src/base/debug/stack_trace_posix.cc +diff --git a/orig/v8-15.2.124.1/src/base/debug/stack_trace_posix.cc b/mod/v8-15.2.124.1/src/base/debug/stack_trace_posix.cc index 6176ed4..a02043d 100644 ---- a/orig/v8-15.0.245.2/src/base/debug/stack_trace_posix.cc -+++ b/mod/v8-15.0.245.2/src/base/debug/stack_trace_posix.cc +--- a/orig/v8-15.2.124.1/src/base/debug/stack_trace_posix.cc ++++ b/mod/v8-15.2.124.1/src/base/debug/stack_trace_posix.cc @@ -64,6 +64,7 @@ namespace { volatile sig_atomic_t in_signal_handler = 0; bool dump_stack_in_signal_handler = true; @@ -44,10 +44,10 @@ index 6176ed4..a02043d 100644 // Demangles C++ symbols in the given text. Example: // // "out/Debug/base_unittests(_ZN10StackTraceC1Ev+0x20) [0x817778c]" -diff --git a/orig/v8-15.0.245.2/src/base/export-template.h b/mod/v8-15.0.245.2/src/base/export-template.h +diff --git a/orig/v8-15.2.124.1/src/base/export-template.h b/mod/v8-15.2.124.1/src/base/export-template.h index 861cfe4..1e73954 100644 ---- a/orig/v8-15.0.245.2/src/base/export-template.h -+++ b/mod/v8-15.0.245.2/src/base/export-template.h +--- a/orig/v8-15.2.124.1/src/base/export-template.h ++++ b/mod/v8-15.2.124.1/src/base/export-template.h @@ -153,8 +153,10 @@ EXPORT_TEMPLATE_TEST(DEFAULT, ); @@ -59,10 +59,10 @@ index 861cfe4..1e73954 100644 #undef EXPORT_TEMPLATE_TEST #undef EXPORT_TEMPLATE_TEST_DEFAULT_DEFAULT -diff --git a/orig/v8-15.0.245.2/src/base/platform/platform-posix.cc b/mod/v8-15.0.245.2/src/base/platform/platform-posix.cc +diff --git a/orig/v8-15.2.124.1/src/base/platform/platform-posix.cc b/mod/v8-15.2.124.1/src/base/platform/platform-posix.cc index dfb30b6..6ce12a5 100644 ---- a/orig/v8-15.0.245.2/src/base/platform/platform-posix.cc -+++ b/mod/v8-15.0.245.2/src/base/platform/platform-posix.cc +--- a/orig/v8-15.2.124.1/src/base/platform/platform-posix.cc ++++ b/mod/v8-15.2.124.1/src/base/platform/platform-posix.cc @@ -95,7 +95,7 @@ extern int madvise(caddr_t, size_t, int); #endif @@ -82,10 +82,10 @@ index dfb30b6..6ce12a5 100644 DCHECK(MainThreadIsCurrentThread()); return __libc_stack_end; } -diff --git a/orig/v8-15.0.245.2/src/base/platform/platform-win32.cc b/mod/v8-15.0.245.2/src/base/platform/platform-win32.cc +diff --git a/orig/v8-15.2.124.1/src/base/platform/platform-win32.cc b/mod/v8-15.2.124.1/src/base/platform/platform-win32.cc index 11f9772..854a682 100644 ---- a/orig/v8-15.0.245.2/src/base/platform/platform-win32.cc -+++ b/mod/v8-15.0.245.2/src/base/platform/platform-win32.cc +--- a/orig/v8-15.2.124.1/src/base/platform/platform-win32.cc ++++ b/mod/v8-15.2.124.1/src/base/platform/platform-win32.cc @@ -20,7 +20,11 @@ #include @@ -144,10 +144,10 @@ index 11f9772..854a682 100644 } // namespace base } // namespace v8 + -diff --git a/orig/v8-15.0.245.2/src/base/platform/time.cc b/mod/v8-15.0.245.2/src/base/platform/time.cc +diff --git a/orig/v8-15.2.124.1/src/base/platform/time.cc b/mod/v8-15.2.124.1/src/base/platform/time.cc index 8c824e3..f8144d0 100644 ---- a/orig/v8-15.0.245.2/src/base/platform/time.cc -+++ b/mod/v8-15.0.245.2/src/base/platform/time.cc +--- a/orig/v8-15.2.124.1/src/base/platform/time.cc ++++ b/mod/v8-15.2.124.1/src/base/platform/time.cc @@ -782,12 +782,12 @@ bool ThreadTicks::IsSupported() { #elif defined(__PASE__) // Thread CPU time accounting is unavailable in PASE @@ -179,10 +179,10 @@ index 8c824e3..f8144d0 100644 #else UNREACHABLE(); #endif -diff --git a/orig/v8-15.0.245.2/src/heap/base/asm/x64/push_registers_masm.asm b/mod/v8-15.0.245.2/src/heap/base/asm/x64/push_registers_masm.asm +diff --git a/orig/v8-15.2.124.1/src/heap/base/asm/x64/push_registers_masm.asm b/mod/v8-15.2.124.1/src/heap/base/asm/x64/push_registers_masm.asm index d0d0563..f3f5952 100644 ---- a/orig/v8-15.0.245.2/src/heap/base/asm/x64/push_registers_masm.asm -+++ b/mod/v8-15.0.245.2/src/heap/base/asm/x64/push_registers_masm.asm +--- a/orig/v8-15.2.124.1/src/heap/base/asm/x64/push_registers_masm.asm ++++ b/mod/v8-15.2.124.1/src/heap/base/asm/x64/push_registers_masm.asm @@ -1,70 +1,47 @@ -;; Copyright 2020 the V8 project authors. All rights reserved. -;; Use of this source code is governed by a BSD-style license that can be @@ -301,10 +301,10 @@ index d0d0563..f3f5952 100644 + pop %rbp + ret +.seh_endproc -diff --git a/orig/v8-15.0.245.2/src/libplatform/default-thread-isolated-allocator.cc b/mod/v8-15.0.245.2/src/libplatform/default-thread-isolated-allocator.cc +diff --git a/orig/v8-15.2.124.1/src/libplatform/default-thread-isolated-allocator.cc b/mod/v8-15.2.124.1/src/libplatform/default-thread-isolated-allocator.cc index bda0e43..b44f1d9 100644 ---- a/orig/v8-15.0.245.2/src/libplatform/default-thread-isolated-allocator.cc -+++ b/mod/v8-15.0.245.2/src/libplatform/default-thread-isolated-allocator.cc +--- a/orig/v8-15.2.124.1/src/libplatform/default-thread-isolated-allocator.cc ++++ b/mod/v8-15.2.124.1/src/libplatform/default-thread-isolated-allocator.cc @@ -23,7 +23,7 @@ extern int pkey_free(int pkey) V8_WEAK; namespace { diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel index d874bce0e0..4144d153ff 100644 --- a/third_party/v8/BUILD.bazel +++ b/third_party/v8/BUILD.bazel @@ -29,74 +29,76 @@ config_setting( }, ) +# The candidate canary must produce the matching Windows sandbox archives +# before these repositories can be pinned in MODULE.bazel. alias( - name = "v8_150_4_0_x86_64_pc_windows_msvc", - actual = "@rusty_v8_150_4_0_x86_64_pc_windows_msvc_archive//file", + name = "v8_152_2_0_x86_64_pc_windows_msvc", + actual = "@rusty_v8_152_2_0_x86_64_pc_windows_msvc_archive//file", ) alias( - name = "v8_150_4_0_aarch64_pc_windows_msvc", - actual = "@rusty_v8_150_4_0_aarch64_pc_windows_msvc_archive//file", + name = "v8_152_2_0_aarch64_pc_windows_msvc", + actual = "@rusty_v8_152_2_0_aarch64_pc_windows_msvc_archive//file", ) alias( - name = "v8_150_4_0_aarch64_pc_windows_gnullvm", + name = "v8_152_2_0_aarch64_pc_windows_gnullvm", # `rusty_v8` only ships prebuilt Windows archives for MSVC. Build the # GNU-flavored archive in-tree so windows-gnullvm consumers can link # against a matching ABI instead of trying to reuse the MSVC release. - actual = ":v8_150_4_0_aarch64_pc_windows_gnullvm_bazel", + actual = ":v8_152_2_0_aarch64_pc_windows_gnullvm_bazel", ) alias( - name = "v8_150_4_0_x86_64_pc_windows_gnullvm", - actual = ":v8_150_4_0_x86_64_pc_windows_gnullvm_bazel", + name = "v8_152_2_0_x86_64_pc_windows_gnullvm", + actual = ":v8_152_2_0_x86_64_pc_windows_gnullvm_bazel", ) alias( - name = "src_binding_release_x86_64_pc_windows_gnullvm_150_4_0_release", + name = "src_binding_release_x86_64_pc_windows_gnullvm_152_2_0_release", # `rusty_v8` does not publish a Windows GNU binding file. The generated # binding only describes this V8 release's C++ API surface, so reuse the # Linux release binding while the windows-gnullvm archive build is still # experimental. - actual = ":src_binding_release_x86_64_unknown_linux_gnu_150_4_0_release", + actual = ":src_binding_release_x86_64_unknown_linux_gnu_152_2_0_release", ) alias( - name = "src_binding_release_aarch64_pc_windows_gnullvm_150_4_0_release", - actual = ":src_binding_release_aarch64_unknown_linux_gnu_150_4_0_release", + name = "src_binding_release_aarch64_pc_windows_gnullvm_152_2_0_release", + actual = ":src_binding_release_aarch64_unknown_linux_gnu_152_2_0_release", ) alias( name = "rusty_v8_archive_for_target", actual = select({ - "@rules_rs//rs/platforms/config:aarch64-apple-darwin": ":v8_150_4_0_aarch64_apple_darwin_bazel", - "@rules_rs//rs/platforms/config:aarch64-pc-windows-gnullvm": ":v8_150_4_0_aarch64_pc_windows_gnullvm", - "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":v8_150_4_0_aarch64_pc_windows_msvc", - "@rules_rs//rs/platforms/config:aarch64-unknown-linux-gnu": ":v8_150_4_0_aarch64_unknown_linux_gnu_bazel", - ":platform_aarch64_unknown_linux_musl": ":v8_150_4_0_aarch64_unknown_linux_musl_release_base", - "@rules_rs//rs/platforms/config:x86_64-apple-darwin": ":v8_150_4_0_x86_64_apple_darwin_bazel", - "@rules_rs//rs/platforms/config:x86_64-pc-windows-gnullvm": ":v8_150_4_0_x86_64_pc_windows_gnullvm", - "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":v8_150_4_0_x86_64_pc_windows_msvc", - "@rules_rs//rs/platforms/config:x86_64-unknown-linux-gnu": ":v8_150_4_0_x86_64_unknown_linux_gnu_bazel", - ":platform_x86_64_unknown_linux_musl": ":v8_150_4_0_x86_64_unknown_linux_musl_release", - "//conditions:default": ":v8_150_4_0_x86_64_unknown_linux_gnu_bazel", + "@rules_rs//rs/platforms/config:aarch64-apple-darwin": ":v8_152_2_0_aarch64_apple_darwin_bazel", + "@rules_rs//rs/platforms/config:aarch64-pc-windows-gnullvm": ":v8_152_2_0_aarch64_pc_windows_gnullvm", + "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":v8_152_2_0_aarch64_pc_windows_msvc", + "@rules_rs//rs/platforms/config:aarch64-unknown-linux-gnu": ":v8_152_2_0_aarch64_unknown_linux_gnu_bazel", + ":platform_aarch64_unknown_linux_musl": ":v8_152_2_0_aarch64_unknown_linux_musl_release_base", + "@rules_rs//rs/platforms/config:x86_64-apple-darwin": ":v8_152_2_0_x86_64_apple_darwin_bazel", + "@rules_rs//rs/platforms/config:x86_64-pc-windows-gnullvm": ":v8_152_2_0_x86_64_pc_windows_gnullvm", + "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":v8_152_2_0_x86_64_pc_windows_msvc", + "@rules_rs//rs/platforms/config:x86_64-unknown-linux-gnu": ":v8_152_2_0_x86_64_unknown_linux_gnu_bazel", + ":platform_x86_64_unknown_linux_musl": ":v8_152_2_0_x86_64_unknown_linux_musl_release", + "//conditions:default": ":v8_152_2_0_x86_64_unknown_linux_gnu_bazel", }), ) alias( name = "rusty_v8_binding_for_target", actual = select({ - "@rules_rs//rs/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin_150_4_0_release", - "@rules_rs//rs/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm_150_4_0_release", - "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc_150_4_0_release", - "@rules_rs//rs/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu_150_4_0_release", - ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl_150_4_0_release", - "@rules_rs//rs/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin_150_4_0_release", - "@rules_rs//rs/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm_150_4_0_release", - "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc_150_4_0_release", - "@rules_rs//rs/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu_150_4_0_release", - ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl_150_4_0_release", - "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu_150_4_0_release", + "@rules_rs//rs/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin_152_2_0_release", + "@rules_rs//rs/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm_152_2_0_release", + "@rules_rs//rs/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc_152_2_0_release", + "@rules_rs//rs/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu_152_2_0_release", + ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl_152_2_0_release", + "@rules_rs//rs/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin_152_2_0_release", + "@rules_rs//rs/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm_152_2_0_release", + "@rules_rs//rs/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc_152_2_0_release", + "@rules_rs//rs/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu_152_2_0_release", + ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl_152_2_0_release", + "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu_152_2_0_release", }), ) @@ -147,51 +149,51 @@ cc_library( ) genrule( - name = "binding_cc_150_4_0", - srcs = ["@v8_crate_150_4_0//:binding_cc"], - outs = ["binding_150_4_0.cc"], + name = "binding_cc_152_2_0", + srcs = ["@v8_crate_152_2_0//:binding_cc"], + outs = ["binding_152_2_0.cc"], cmd = " ".join([ "sed", "-e '/#include \"v8\\/src\\/flags\\/flags.h\"/d'", "-e 's|\"v8/src/libplatform/default-platform.h\"|\"src/libplatform/default-platform.h\"|'", - "-e 's|#include \"support.h\"|#include \"support_150_4_0.h\"|'", + "-e 's|#include \"support.h\"|#include \"support_152_2_0.h\"|'", "-e 's| namespace i = v8::internal;| (void)usage;|'", "-e '/using HelpOptions = i::FlagList::HelpOptions;/d'", "-e '/HelpOptions help_options = HelpOptions(HelpOptions::kExit, usage);/d'", "-e 's| i::FlagList::SetFlagsFromCommandLine(argc, argv, true, help_options);| v8::V8::SetFlagsFromCommandLine(argc, argv, true);|'", - "$(location @v8_crate_150_4_0//:binding_cc)", + "$(location @v8_crate_152_2_0//:binding_cc)", ">", '"$@"', ]), ) genrule( - name = "crdtp_binding_cc_150_4_0", - srcs = ["@v8_crate_150_4_0//:crdtp_binding_cc"], - outs = ["crdtp_binding_150_4_0.cc"], + name = "crdtp_binding_cc_152_2_0", + srcs = ["@v8_crate_152_2_0//:crdtp_binding_cc"], + outs = ["crdtp_binding_152_2_0.cc"], cmd = " ".join([ "sed", - "-e 's|#include \"support.h\"|#include \"support_150_4_0.h\"|'", + "-e 's|#include \"support.h\"|#include \"support_152_2_0.h\"|'", "-e 's|\"v8/third_party/inspector_protocol/|\"third_party/inspector_protocol/|g'", - "$(location @v8_crate_150_4_0//:crdtp_binding_cc)", + "$(location @v8_crate_152_2_0//:crdtp_binding_cc)", ">", '"$@"', ]), ) copy_file( - name = "support_h_150_4_0", - src = "@v8_crate_150_4_0//:support_h", - out = "support_150_4_0.h", + name = "support_h_152_2_0", + src = "@v8_crate_152_2_0//:support_h", + out = "support_152_2_0.h", ) cc_library( - name = "v8_150_4_0_binding", + name = "v8_152_2_0_binding", srcs = [ - ":binding_cc_150_4_0", - ":crdtp_binding_cc_150_4_0", + ":binding_cc_152_2_0", + ":crdtp_binding_cc_152_2_0", ], - hdrs = [":support_h_150_4_0"], + hdrs = [":support_h_152_2_0"], copts = V8_COPTS + V8_CUSTOM_LIBCXX_COPTS, deps = [ "@v8//:core_lib_icu", @@ -206,49 +208,49 @@ cc_library( ) cc_static_library( - name = "v8_150_4_0_aarch64_apple_darwin_bazel", + name = "v8_152_2_0_aarch64_apple_darwin_bazel", features = V8_STATIC_LIBRARY_FEATURES, deps = [ ":rusty_v8_custom_libcxx_runtime", - ":v8_150_4_0_binding", + ":v8_152_2_0_binding", ], ) cc_static_library( - name = "v8_150_4_0_aarch64_unknown_linux_gnu_bazel", + name = "v8_152_2_0_aarch64_unknown_linux_gnu_bazel", features = V8_STATIC_LIBRARY_FEATURES, deps = [ ":rusty_v8_custom_libcxx_runtime", - ":v8_150_4_0_binding", + ":v8_152_2_0_binding", ], ) cc_static_library( - name = "v8_150_4_0_aarch64_pc_windows_gnullvm_bazel", + name = "v8_152_2_0_aarch64_pc_windows_gnullvm_bazel", features = V8_STATIC_LIBRARY_FEATURES, - deps = [":v8_150_4_0_binding"], + deps = [":v8_152_2_0_binding"], ) cc_static_library( - name = "v8_150_4_0_aarch64_unknown_linux_musl_release_base", + name = "v8_152_2_0_aarch64_unknown_linux_musl_release_base", features = V8_STATIC_LIBRARY_FEATURES, deps = [ ":rusty_v8_custom_libcxx_runtime", - ":v8_150_4_0_binding", + ":v8_152_2_0_binding", ], ) genrule( - name = "v8_150_4_0_aarch64_unknown_linux_musl_release", + name = "v8_152_2_0_aarch64_unknown_linux_musl_release", srcs = [ - ":v8_150_4_0_aarch64_unknown_linux_musl_release_base", + ":v8_152_2_0_aarch64_unknown_linux_musl_release_base", "@llvm//runtimes/compiler-rt:clang_rt.builtins.static", ], - outs = ["libv8_150_4_0_aarch64_unknown_linux_musl.a"], + outs = ["libv8_152_2_0_aarch64_unknown_linux_musl.a"], cmd = """ cat > "$(@D)/merge.mri" <<'EOF' create $@ -addlib $(location :v8_150_4_0_aarch64_unknown_linux_musl_release_base) +addlib $(location :v8_152_2_0_aarch64_unknown_linux_musl_release_base) addlib $(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static) save end @@ -263,186 +265,186 @@ EOF ) cc_static_library( - name = "v8_150_4_0_x86_64_apple_darwin_bazel", + name = "v8_152_2_0_x86_64_apple_darwin_bazel", features = V8_STATIC_LIBRARY_FEATURES, deps = [ ":rusty_v8_custom_libcxx_runtime", - ":v8_150_4_0_binding", + ":v8_152_2_0_binding", ], ) cc_static_library( - name = "v8_150_4_0_x86_64_unknown_linux_gnu_bazel", + name = "v8_152_2_0_x86_64_unknown_linux_gnu_bazel", features = V8_STATIC_LIBRARY_FEATURES, deps = [ ":rusty_v8_custom_libcxx_runtime", - ":v8_150_4_0_binding", + ":v8_152_2_0_binding", ], ) cc_static_library( - name = "v8_150_4_0_x86_64_pc_windows_gnullvm_bazel", + name = "v8_152_2_0_x86_64_pc_windows_gnullvm_bazel", features = V8_STATIC_LIBRARY_FEATURES, - deps = [":v8_150_4_0_binding"], + deps = [":v8_152_2_0_binding"], ) cc_static_library( - name = "v8_150_4_0_x86_64_unknown_linux_musl_release", + name = "v8_152_2_0_x86_64_unknown_linux_musl_release", features = V8_STATIC_LIBRARY_FEATURES, deps = [ ":rusty_v8_custom_libcxx_runtime", - ":v8_150_4_0_binding", + ":v8_152_2_0_binding", ], ) filegroup( - name = "src_binding_release_aarch64_apple_darwin_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_aarch64_apple_darwin"], + name = "src_binding_release_aarch64_apple_darwin_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_aarch64_apple_darwin"], ) filegroup( - name = "src_binding_release_x86_64_apple_darwin_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_x86_64_apple_darwin"], + name = "src_binding_release_x86_64_apple_darwin_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_x86_64_apple_darwin"], ) filegroup( - name = "src_binding_release_aarch64_unknown_linux_gnu_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_aarch64_unknown_linux_gnu"], + name = "src_binding_release_aarch64_unknown_linux_gnu_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_aarch64_unknown_linux_gnu"], ) filegroup( - name = "src_binding_release_x86_64_unknown_linux_gnu_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_x86_64_unknown_linux_gnu"], + name = "src_binding_release_x86_64_unknown_linux_gnu_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_x86_64_unknown_linux_gnu"], ) filegroup( - name = "src_binding_release_aarch64_unknown_linux_musl_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_aarch64_unknown_linux_gnu"], + name = "src_binding_release_aarch64_unknown_linux_musl_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_aarch64_unknown_linux_gnu"], ) filegroup( - name = "src_binding_release_x86_64_unknown_linux_musl_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_x86_64_unknown_linux_gnu"], + name = "src_binding_release_x86_64_unknown_linux_musl_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_x86_64_unknown_linux_gnu"], ) filegroup( - name = "src_binding_release_aarch64_pc_windows_msvc_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_aarch64_pc_windows_msvc"], + name = "src_binding_release_aarch64_pc_windows_msvc_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_aarch64_pc_windows_msvc"], ) filegroup( - name = "src_binding_release_x86_64_pc_windows_msvc_150_4_0_release", - srcs = ["@v8_crate_150_4_0//:src_binding_release_x86_64_pc_windows_msvc"], + name = "src_binding_release_x86_64_pc_windows_msvc_152_2_0_release", + srcs = ["@v8_crate_152_2_0//:src_binding_release_x86_64_pc_windows_msvc"], ) filegroup( name = "rusty_v8_release_pair_x86_64_apple_darwin", srcs = [ - ":src_binding_release_x86_64_apple_darwin_150_4_0_release", - ":v8_150_4_0_x86_64_apple_darwin_bazel", + ":src_binding_release_x86_64_apple_darwin_152_2_0_release", + ":v8_152_2_0_x86_64_apple_darwin_bazel", ], ) filegroup( name = "rusty_v8_release_pair_aarch64_apple_darwin", srcs = [ - ":src_binding_release_aarch64_apple_darwin_150_4_0_release", - ":v8_150_4_0_aarch64_apple_darwin_bazel", + ":src_binding_release_aarch64_apple_darwin_152_2_0_release", + ":v8_152_2_0_aarch64_apple_darwin_bazel", ], ) filegroup( name = "rusty_v8_release_pair_x86_64_unknown_linux_gnu", srcs = [ - ":src_binding_release_x86_64_unknown_linux_gnu_150_4_0_release", - ":v8_150_4_0_x86_64_unknown_linux_gnu_bazel", + ":src_binding_release_x86_64_unknown_linux_gnu_152_2_0_release", + ":v8_152_2_0_x86_64_unknown_linux_gnu_bazel", ], ) filegroup( name = "rusty_v8_release_pair_aarch64_unknown_linux_gnu", srcs = [ - ":src_binding_release_aarch64_unknown_linux_gnu_150_4_0_release", - ":v8_150_4_0_aarch64_unknown_linux_gnu_bazel", + ":src_binding_release_aarch64_unknown_linux_gnu_152_2_0_release", + ":v8_152_2_0_aarch64_unknown_linux_gnu_bazel", ], ) filegroup( name = "rusty_v8_release_pair_x86_64_unknown_linux_musl", srcs = [ - ":src_binding_release_x86_64_unknown_linux_musl_150_4_0_release", - ":v8_150_4_0_x86_64_unknown_linux_musl_release", + ":src_binding_release_x86_64_unknown_linux_musl_152_2_0_release", + ":v8_152_2_0_x86_64_unknown_linux_musl_release", ], ) filegroup( name = "rusty_v8_release_pair_aarch64_unknown_linux_musl", srcs = [ - ":src_binding_release_aarch64_unknown_linux_musl_150_4_0_release", - ":v8_150_4_0_aarch64_unknown_linux_musl_release", + ":src_binding_release_aarch64_unknown_linux_musl_152_2_0_release", + ":v8_152_2_0_aarch64_unknown_linux_musl_release", ], ) filegroup( name = "rusty_v8_release_pair_x86_64_pc_windows_msvc", srcs = [ - ":src_binding_release_x86_64_pc_windows_msvc_150_4_0_release", - ":v8_150_4_0_x86_64_pc_windows_msvc", + ":src_binding_release_x86_64_pc_windows_msvc_152_2_0_release", + ":v8_152_2_0_x86_64_pc_windows_msvc", ], ) filegroup( name = "rusty_v8_release_pair_aarch64_pc_windows_msvc", srcs = [ - ":src_binding_release_aarch64_pc_windows_msvc_150_4_0_release", - ":v8_150_4_0_aarch64_pc_windows_msvc", + ":src_binding_release_aarch64_pc_windows_msvc_152_2_0_release", + ":v8_152_2_0_aarch64_pc_windows_msvc", ], ) filegroup( name = "rusty_v8_sandbox_release_pair_x86_64_apple_darwin", srcs = [ - ":src_binding_release_x86_64_apple_darwin_150_4_0_release", - ":v8_150_4_0_x86_64_apple_darwin_bazel", + ":src_binding_release_x86_64_apple_darwin_152_2_0_release", + ":v8_152_2_0_x86_64_apple_darwin_bazel", ], ) filegroup( name = "rusty_v8_sandbox_release_pair_aarch64_apple_darwin", srcs = [ - ":src_binding_release_aarch64_apple_darwin_150_4_0_release", - ":v8_150_4_0_aarch64_apple_darwin_bazel", + ":src_binding_release_aarch64_apple_darwin_152_2_0_release", + ":v8_152_2_0_aarch64_apple_darwin_bazel", ], ) filegroup( name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_gnu", srcs = [ - ":src_binding_release_x86_64_unknown_linux_gnu_150_4_0_release", - ":v8_150_4_0_x86_64_unknown_linux_gnu_bazel", + ":src_binding_release_x86_64_unknown_linux_gnu_152_2_0_release", + ":v8_152_2_0_x86_64_unknown_linux_gnu_bazel", ], ) filegroup( name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_gnu", srcs = [ - ":src_binding_release_aarch64_unknown_linux_gnu_150_4_0_release", - ":v8_150_4_0_aarch64_unknown_linux_gnu_bazel", + ":src_binding_release_aarch64_unknown_linux_gnu_152_2_0_release", + ":v8_152_2_0_aarch64_unknown_linux_gnu_bazel", ], ) filegroup( name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl", srcs = [ - ":src_binding_release_x86_64_unknown_linux_musl_150_4_0_release", - ":v8_150_4_0_x86_64_unknown_linux_musl_release", + ":src_binding_release_x86_64_unknown_linux_musl_152_2_0_release", + ":v8_152_2_0_x86_64_unknown_linux_musl_release", ], ) filegroup( name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl", srcs = [ - ":src_binding_release_aarch64_unknown_linux_musl_150_4_0_release", - ":v8_150_4_0_aarch64_unknown_linux_musl_release", + ":src_binding_release_aarch64_unknown_linux_musl_152_2_0_release", + ":v8_152_2_0_aarch64_unknown_linux_musl_release", ], ) diff --git a/third_party/v8/README.md b/third_party/v8/README.md index fc9879b80d..8b3f5881f2 100644 --- a/third_party/v8/README.md +++ b/third_party/v8/README.md @@ -3,7 +3,7 @@ This directory wires the `v8` crate to exact-version Bazel inputs. Bazel consumer builds use: -- upstream `denoland/rusty_v8` release archives on Windows MSVC +- Codex sandbox release archives on Windows MSVC - source-built V8 archives on Darwin, GNU Linux, musl Linux, and Windows GNU Local Cargo builds still use upstream prebuilt `rusty_v8` archives by default. @@ -13,13 +13,23 @@ sets those variables independently in `MODULE.bazel` to select source-built local archives and bindings for its consumer builds. The Bazel `v8` crate feature selection enables V8's in-process sandbox for -Darwin, Linux, and Windows GNU. Windows MSVC remains on upstream non-sandboxed -prebuilts. +Darwin, Linux, and Windows, including MSVC. Current pinned versions: -- Rust crate: `v8 = =150.4.0` -- Embedded upstream V8 source for Bazel-produced release builds: `15.0.245.2` +- Rust crate: `v8 = =152.2.0` +- Embedded upstream V8 source for Bazel-produced release builds: `15.2.124.1` + +Source builds apply the [M152 fix for CVE-2026-85046](https://github.com/v8/v8/commit/94c34b200ae9caf83d06c167a070746a1c7e825c) +from `patches/v8_array_sort_elements_kind.patch` in both Bazel and the Windows GN +workflows. It changes compiler internals and preserves the `152.2.0` bindings. +Use a patched Codex canary or release archive and its matching binding for local +Cargo validation; the default upstream archive does not contain this backport. + +The 152.2.0 candidate still needs published Windows sandbox archives. +Before merging, publish the matching Codex release and replace the old Windows +archive declarations and checksum manifest with the generated 152.2.0 pins. +The new Windows selectors deliberately require those exact-version repositories. ## Updating to a new `v8` release @@ -95,7 +105,7 @@ from upstream `rusty_v8` source. Those ABI-specific outputs cannot be produced by Codex's Bazel Windows GNU toolchain. The Bazel graph pins the same libc++, libc++abi, and llvm-libc source revisions -used by `rusty_v8 v150.4.0`, compiles published artifact targets with +used by `rusty_v8 v152.2.0`, compiles published artifact targets with `--config=rusty-v8-upstream-libcxx`, and folds the matching runtime objects into the final static archive so consumers can link it with the `v8` crate's default `use_custom_libcxx` feature. The config keeps the object files and the bundled @@ -111,9 +121,7 @@ add a real MSVC-targeting C++ toolchain to the Bazel graph. Release and CI Cargo builds for Darwin and Linux use `RUSTY_V8_ARCHIVE` plus a downloaded `RUSTY_V8_SRC_BINDING_PATH` to point at those `openai/codex` release -assets directly. We do not use `RUSTY_V8_MIRROR` because the upstream `v8` crate -hardcodes a `v` tag layout, while our artifacts are published -under `rusty-v8-v`. +assets directly, using the `rusty-v8-v` release tag. Do not mix artifacts across crate versions. The archive and binding must match the exact resolved `v8` crate version in `codex-rs/Cargo.lock`. diff --git a/third_party/v8/libcxx.BUILD.bazel b/third_party/v8/libcxx.BUILD.bazel index e5bdaa8c35..6421b207b0 100644 --- a/third_party/v8/libcxx.BUILD.bazel +++ b/third_party/v8/libcxx.BUILD.bazel @@ -111,7 +111,7 @@ cc_runtime_stage0_library( "//conditions:default": ["-fPIC"], }), defines = [ - "CR_LIBCXX_REVISION=5abc7f839700f0f17338434e1c1c6a8c87c00c11", + "CR_LIBCXX_REVISION=b16984ce99c702355a5b2b4c52574e82cec41fb9", "LIBCXX_BUILDING_LIBCXXABI", "LIBC_NAMESPACE=__llvm_libc_cr", "_LIBCPP_BUILDING_LIBRARY",