src: remove erroneous CVE-2024-27980 revert option

[tniessen]

No security reverts should exist on the main branch.

It seems to me that this was done correctly by @bnoordhuis in https://github.com/nodejs-private/node-private/pull/565 but that commit somehow didn't end up on the main branch in this repository.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/58423/

[RafaelGSS]

No security reverts should exist on the main branch.

It seems to me that this was done correctly by @bnoordhuis in nodejs-private/node-private#565 but that commit somehow didn't end up on the main branch in this repository.

That was on purpose. That's why I left https://github.com/nodejs-private/node-private/pull/565 open, otherwise, I would need to avoid this commit somehow in the last sync for Node.js 22 (which is basically a git reset --hard upstream/main). I was planning to include it as soon as v22.x arrises.

[RafaelGSS]

LGTM.

Note, I would not merge it until v22.0.0 is out.

[tniessen]

@RafaelGSS Should I rebase #52365 then and then later rebase this PR on top of that or should I consider both blocked? I wasn't aware that we can't merge non-v22 commits into main at this point.

[RafaelGSS]

@RafaelGSS Should I rebase #52365 then and then later rebase this PR on top of that or should I consider both blocked? I wasn't aware that we can't merge non-v22 commits into main at this point.

Technically, we can... but it makes our process of a semver-major release slightly harder. For instance, you can add a dont-land-on-v22.x label, but it will require some adjustments in our sync that might result in conflicts. At this point, we are not planning any further sync to v22.x (except including V8 commit). I have added the blocked label just in case a sync is necessary (which is unlikely).

I think a rebase is not necessary, #52365 can land without issues.

[richardlau]

No security reverts should exist on the main branch.
It seems to me that this was done correctly by @bnoordhuis in nodejs-private/node-private#565 but that commit somehow didn't end up on the main branch in this repository.

That was on purpose. That's why I left nodejs-private/node-private#565 open, otherwise, I would need to avoid this commit somehow in the last sync for Node.js 22 (which is basically a git reset --hard upstream/main). I was planning to include it as soon as v22.x arrises.

I don't understand why the revert is included for Node.js 22 -- we haven't had any releases of that yet and we should release Node.js 22 without any security reverts.

[RafaelGSS]

No security reverts should exist on the main branch.
It seems to me that this was done correctly by @bnoordhuis in nodejs-private/node-private#565 but that commit somehow didn't end up on the main branch in this repository.

That was on purpose. That's why I left nodejs-private/node-private#565 open, otherwise, I would need to avoid this commit somehow in the last sync for Node.js 22 (which is basically a git reset --hard upstream/main). I was planning to include it as soon as v22.x arrises.

I don't understand why the revert is included for Node.js 22 -- we haven't had any releases of that yet and we should release Node.js 22 without any security reverts.

I have included it because a backport specifically to Node.js 22 was created: https://github.com/nodejs-private/node-private/pull/560.

[targos]

I suppose a backport was created because the branch existed.

[RafaelGSS]

If you all agree, let's merge it then. I can pull directly into v22.x.

[larson-carter]

I agree that these items need to be merged... LGTM

[nodejs-github-bot]

Landed in 3790d52