Merge remote-tracking branch 'origin/current' into refactor_v6_1

Author: metcoder95

.github/workflows/docs-test.yml

@@ -14,7 +14,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/docs.yml

@@ -16,7 +16,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/nodejs.yml

@@ -20,7 +20,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -48,7 +48,7 @@ jobs:
 
     runs-on: ${{matrix.os}}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -80,6 +80,6 @@ jobs:
       pull-requests: write
     steps:
       - name: Merge Dependabot PR
-        uses: fastify/github-action-merge-dependabot@30c3f8f14a4f7b315ba38dbc1b793d27128fef82 # v3.12.0
+        uses: fastify/github-action-merge-dependabot@73ec4cbb5e56df5591eae286972d5b2201ffe90f # v3.15.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

CONTRIBUTING.md

@@ -25,7 +25,7 @@ Declaring formal releases remains the prerogative of the project maintainer.
 ## Previous Versions
 Every version of Piscina has its own branch. All Piscina related changes should be based on the corresponding branch.
 
-Piscina's adhere to one active release line and a maintanance release line within a single year, rotating on a yearly basis.
+Piscina's adhere to one active release line and a maintenance release line within a single year, rotating on a yearly basis.
 
 Version	| Branch | Status
 ------- | ------ | ------

README.md

@@ -419,10 +419,10 @@ This class extends [`EventEmitter`][] from Node.js.
   - `atomics`: (`sync` | `async` | `disabled`) Use the [`Atomics`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Atomics) API for faster communication
     between threads. This is on by default. You can disable `Atomics` globally by
     setting the environment variable `PISCINA_DISABLE_ATOMICS` to `1` .
-    If `atomics` is `sync`, it will cause to pause threads (stoping all execution)
+    If `atomics` is `sync`, it will cause to pause threads (stopping all execution)
     between tasks. Ideally, threads should wait for all operations to finish before
     returning control to the main thread (avoid having open handles within a thread). If still want to have the possibility
-    of having open handles or handle asynchrnous tasks, you can set the environment variable `PISCINA_ENABLE_ASYNC_ATOMICS` to `1` or setting `options.atomics` to `async`.
+    of having open handles or handle asynchronous tasks, you can set the environment variable `PISCINA_ENABLE_ASYNC_ATOMICS` to `1` or setting `options.atomics` to `async`.
 
   > **Note**: The `async` mode comes with performance penalties and can lead to undesired behaviour if open handles are not tracked correctly.
 
@@ -690,8 +690,8 @@ Provides the current version of this library as a semver string.
 
 By default, any value returned by a worker function will be cloned when
 returned back to the Piscina pool, even if that object is capable of
-being transfered. The `Piscina.move()` method can be used to wrap and
-mark transferable values such that they will by transfered rather than
+being transferred. The `Piscina.move()` method can be used to wrap and
+mark transferable values such that they will be transferred rather than
 cloned.
 
 The `value` may be any object supported by Node.js to be transferable
@@ -710,7 +710,7 @@ The `move()` method will throw if the `value` is not transferable.
 
 The object returned by the `move()` method should not be set as a
 nested value in an object. If it is used, the `move()` object itself
-will be cloned as opposed to transfering the object it wraps.
+will be cloned as opposed to transferring the object it wraps.
 
 #### Interface: `Transferable`
 
@@ -991,12 +991,6 @@ Piscina development was initially sponsored by [NearForm Research][].
 
 Looking to support the development of Piscina? Consider sponsoring us on [Open Collective](https://opencollective.com/piscinajs). We appreciate all levels of support!
 
-### Bronze Sponsors
-
-<a href="https://testmu.ai/?utm_source=piscinajs&utm_medium=sponsor" target="_blank">
-<img src="https://assets.testmu.ai/resources/images/logos/black-logo.png" style="vertical-align: middle;" width="250" height="115" />
-</a>
-
 ## Resources
 
 [`Atomics`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Atomics

SECURITY.md

@@ -0,0 +1,54 @@
+# Security Policy
+
+## Supported Versions
+
+We prioritize the security of our users and ensure that our library is as secure as possible. Currently, we provide security updates primarily for the latest major version of Piscina. 
+
+Older versions might receive security updates depending on the severity of the vulnerability and the maintainers' bandwidth, but this is not guaranteed.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 6.x-rc     | ⚠️ |
+| 5.x     | :white_check_mark: |
+| 4.x     | :white_check_mark: |
+| 3.x     | :x:                |
+
+
+## Scope & Threat Model
+
+Piscina is a fast, efficient Node.js Worker Thread Pool implementation. Due to the nature of offloading tasks to separate threads, we are particularly interested in vulnerabilities related to:
+
+* **Thread Isolation Bypass:** Cross-thread data leakage or unexpected state sharing between separate worker threads.
+* **Arbitrary Code Execution (ACE):** Ability for an attacker to manipulate the `filename` or task execution parameters to run unauthorized code.
+* **Denial of Service (DoS):** Exploits capable of locking up the main thread, bypassing `maxQueue` constraints, or exhausting memory resources in ways the library intends to prevent.
+
+## Reporting a Vulnerability
+
+👮 **Responsible Disclosure**
+
+**Do not open public issues that might have security implications.** It is critical that security-related issues are reported privately so we have time to address them before they become public knowledge.
+
+Individuals who find potential vulnerabilities in Piscina are invited to report them privately using the following channels:
+
+1. **GitHub Security Advisories:** You can privately report a vulnerability directly via the [GitHub Security Advisory feature](https://github.com/piscinajs/piscina/security/advisories/new) on the Piscina repository. 
+
+### What to Include in the Report
+
+To help us properly address the issue, please include the following in your report:
+
+- A detailed description of the vulnerability and its potential impact.
+- Steps to reproduce the issue (a minimal reproduction repository or code snippet is highly appreciated).
+- The version(s) of `piscina` and `Node.js` affected.
+- Any potential mitigation or workarounds you might have found.
+
+## Disclosure Policy
+
+When you report a vulnerability, we will strive to follow this process:
+
+1. **Acknowledgement:** We will acknowledge receipt of your vulnerability report within 3 working days.
+2. **Triage:** We will triage the issue, confirm the vulnerability, and determine its severity.
+3. **Patching:** We will work on a patch to address the vulnerability in a private fork.
+4. **Release:** A new version of the package will be released with the patch. 
+5. **Public Disclosure:** Once the fix is released, we will publish a public security advisory on GitHub, giving you proper credit for the discovery (unless you prefer to remain anonymous).
+
+We ask that you operate in good faith and refrain from sharing the vulnerability publicly until a fix has been released and the official advisory is published.

docs/docs/Introduction.md

@@ -31,10 +31,3 @@ With worker threads now a well-established feature in Node.js, Piscina aims to b
 ## Sponsors
 
 Looking to support the development of Piscina? Consider sponsoring us on [Open Collective](https://opencollective.com/piscinajs). We appreciate all levels of support!
-
-### Bronze Sponsors
-
-<a href="https://testmu.ai/?utm_source=piscinajs&utm_medium=sponsor" target="_blank" rel="noopener noreferrer">
-<img src="https://assets.testmu.ai/resources/images/logos/black-logo.png" alt="TestMu.ai logo" style={{ verticalAlign: "middle" }} width="250" height="110" className="img-dark"/>
-<img src="https://assets.testmu.ai/resources/images/logos/white-logo.png" alt="TestMu.ai logo" style={{ verticalAlign: "middle" }} width="250" height="110" className="img-light"/>
-</a>

docs/docs/api-reference/class.md

@@ -54,10 +54,10 @@ This class extends [`EventEmitter`](https://nodejs.org/api/events.html) from Nod
   - `atomics`: (`sync` | `async` | `disabled`) Use the [`Atomics`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Atomics) API for faster communication
     between threads. This is on by default. You can disable `Atomics` globally by
     setting the environment variable `PISCINA_DISABLE_ATOMICS` to `1` .
-    If `atomics` is `sync`, it will cause to pause threads (stoping all execution)
+    If `atomics` is `sync`, it will cause to pause threads (stopping all execution)
     between tasks. Ideally, threads should wait for all operations to finish before
     returning control to the main thread (avoid having open handles within a thread). If still want to have the possibility
-    of having open handles or handle asynchrnous tasks, you can set the environment variable `PISCINA_ENABLE_ASYNC_ATOMICS` to `1` or setting `options.atomics` to `async`.
+    of having open handles or handle asynchronous tasks, you can set the environment variable `PISCINA_ENABLE_ASYNC_ATOMICS` to `1` or setting `options.atomics` to `async`.
 
     :::info
     **Note**: The `async` mode comes with performance penalties and can lead to undesired behaviour if open handles are not tracked correctly.
@@ -113,7 +113,7 @@ This class extends [`EventEmitter`](https://nodejs.org/api/events.html) from Nod
 
 :::info
   **Note on Explicit Resource Management**: Piscina does has support for `Symbol.dispose` and `Symbol.asyncDispose` for explicit resource management for its usage with the `using` keyword.
-  This is only avaiable on Node.js 24 and higher.
+  This is only available on Node.js 24 and higher.
 
   For more information, see the [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management).
 :::

docs/docs/api-reference/static-property.md

@@ -15,8 +15,8 @@ Provides the current version of this library as a semver string.
 
 By default, any value returned by a worker function will be cloned when
 returned back to the Piscina pool, even if that object is capable of
-being transfered. The `Piscina.move()` method can be used to wrap and
-mark transferable values such that they will by transfered rather than
+being transferred. The `Piscina.move()` method can be used to wrap and
+mark transferable values such that they will be transferred rather than
 cloned.
 
 The `value` may be any object supported by Node.js to be transferable
@@ -35,4 +35,4 @@ The `move()` method will throw if the `value` is not transferable.
 
 The object returned by the `move()` method should not be set as a
 nested value in an object. If it is used, the `move()` object itself
-will be cloned as opposed to transfering the object it wraps.
+will be cloned as opposed to transferring the object it wraps.

docs/docs/examples/server.mdx

@@ -202,14 +202,14 @@ The reason `sync-sleep-pooled` and `async-sleep-pooled` yield identical results
 is because, in both cases, the main thread is doing identical work -- that is,
 receiving a request that is dispatched to a worker, waiting about 100 milliseconds,
 the returning the response. The main thread here does not care whether the workers
-are sleeping synchronously or asychronously.
+are sleeping synchronously or asynchronously.
 
 ## Tuning pool performance
 
 It is possible to tune the performance of the Piscina worker pool using a variety
 of options:
 
-* `minThreads` - The minimum number of threads always runnin
+* `minThreads` - The minimum number of threads always running
 * `maxThreads` - The maximum number of threads allowed
 * `idleTimeout` - The number of millisecondsa thread is permitted to remain idle
 * `maxQueue` -- The maximum number of pending work items
@@ -306,4 +306,4 @@ the event loop block.
 
 [`autocannon`]: https://www.npmjs.com/package/autocannon
 
-You can also check out this example on [github](https://github.com/piscinajs/piscina/tree/current/examples/server).
+You can also check out this example on [github](https://github.com/piscinajs/piscina/tree/current/examples/server).