nodejs · nodejs-github-bot · Jun 14, 2026
diff --git a/deps/acorn/acorn/CHANGELOG.md b/deps/acorn/acorn/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 8.17.0 (2026-06-11)
+
+### New features
+
+The new `strict` option can be used to start script sources in strict mode.
+
+### Bug fixes
+
+Fix a number of corner case bugs when `using` or `await using` appear in `for` loop specs.
+
+Disallow `new super()` expressions.
+
+Don't allow the conditional in a ternary expression to be a (naked) arrow function.
+
 ## 8.16.0 (2026-02-19)
 
 ### New features

diff --git a/deps/acorn/acorn/README.md b/deps/acorn/acorn/README.md
@@ -86,6 +86,9 @@ required):
   will be valid, even if `ecmaVersion` is less than 6. If set to `"commonjs"`,
   it is the same as `"script"` except that the top-level scope behaves like a function.
 
+- **strict**: When set to true, enable strict parsing mode even if
+  `sourceType` is `"script"`.
+
 - **onInsertedSemicolon**: If given a callback, that callback will be
   called whenever a missing semicolon is inserted by the parser. The
   callback will be given the character offset of the point where the

diff --git a/deps/acorn/acorn/dist/acorn.d.mts b/deps/acorn/acorn/dist/acorn.d.mts
@@ -619,6 +619,12 @@ export interface Options {
    */
   sourceType?: "script" | "module" | "commonjs"
 
+  /**
+   * When set to true, enable strict parsing mode even if `sourceType`
+   * is `"script"`.
+   */
+  strict?: boolean
+
   /**
    * a callback that will be called when a semicolon is automatically inserted.
    * @param lastTokEnd the position of the comma as an offset

diff --git a/deps/acorn/acorn/dist/acorn.d.ts b/deps/acorn/acorn/dist/acorn.d.ts
@@ -619,6 +619,12 @@ export interface Options {
    */
   sourceType?: "script" | "module" | "commonjs"
 
+  /**
+   * When set to true, enable strict parsing mode even if `sourceType`
+   * is `"script"`.
+   */
+  strict?: boolean
+
   /**
    * a callback that will be called when a semicolon is automatically inserted.
    * @param lastTokEnd the position of the comma as an offset

diff --git a/deps/acorn/acorn/dist/acorn.js b/deps/acorn/acorn/dist/acorn.js
@@ -342,6 +342,9 @@
     // Can be either `"script"`, `"module"` or `"commonjs"`. This influences global
     // strict mode and parsing of `import` and `export` declarations.
     sourceType: "script",
+    // When set to true, enable strict parsing mode even if `sourceType`
+    // is `"script"`.
+    strict: false,
     // `onInsertedSemicolon` can be a callback that will be called when
     // a semicolon is automatically inserted. It will be passed the
     // position of the inserted semicolon as an offset, and if
@@ -568,7 +571,7 @@
 
     // Figure out if it's a module code.
     this.inModule = options.sourceType === "module";
-    this.strict = this.inModule || this.strictDirective(this.pos);
+    this.strict = this.inModule || options.strict === true || this.strictDirective(this.pos);
 
     // Used to signify the start of a potential arrow function
     this.potentialArrowAt = -1;
@@ -606,9 +609,11 @@
   var prototypeAccessors = { inFunction: { configurable: true },inGenerator: { configurable: true },inAsync: { configurable: true },canAwait: { configurable: true },allowReturn: { configurable: true },allowSuper: { configurable: true },allowDirectSuper: { configurable: true },treatFunctionsAsVar: { configurable: true },allowNewDotTarget: { configurable: true },allowUsing: { configurable: true },inClassStaticBlock: { configurable: true } };
 
   Parser.prototype.parse = function parse () {
+      var this$1$1 = this;
+
     var node = this.options.program || this.startNode();
     this.nextToken();
-    return this.parseTopLevel(node)
+    return this.catchStackOverflow(function () { return this$1$1.parseTopLevel(node); })
   };
 
   prototypeAccessors.inFunction.get = function () { return (this.currentVarScope().flags & SCOPE_FUNCTION) > 0 };
@@ -747,6 +752,17 @@
     return true
   };
 
+  pp$9.catchStackOverflow = function(f) {
+    try {
+      return f()
+    } catch (e) {
+      if (e instanceof Error && (/\bstack\b.*\b(exceeded|overflow)\b/i.test(e.message) || /\btoo much recursion\b/i.test(e.message)))
+        { this.raise(this.start, "Not enough stack space to parse input"); }
+      else
+        { throw e }
+    }
+  };
+
   // Asserts that following token is given contextual keyword.
 
   pp$9.expectContextual = function(name) {
@@ -850,10 +866,10 @@
   // to its body instead of creating a new node.
 
   pp$8.parseTopLevel = function(node) {
-    var exports = Object.create(null);
+    var exports$1 = Object.create(null);
     if (!node.body) { node.body = []; }
     while (this.type !== types$1.eof) {
-      var stmt = this.parseStatement(null, true, exports);
+      var stmt = this.parseStatement(null, true, exports$1);
       node.body.push(stmt);
     }
     if (this.inModule)
@@ -942,7 +958,18 @@
     while (isIdentifierChar(ch = this.fullCharCodeAt(next)))
     if (ch === 92) { return true }
     var id = this.input.slice(idStart, next);
-    if (keywordRelationalOperator.test(id) || isFor && id === "of") { return false }
+    if (keywordRelationalOperator.test(id)) { return false }
+    if (isFor && !isAwaitUsing && id === "of") {
+      // Look ahead for using declaration with initializer, i.e., `for (using of = ...)`
+      skipWhiteSpace.lastIndex = next;
+      var skipAfterOf = skipWhiteSpace.exec(this.input);
+      next = next + skipAfterOf[0].length;
+      if (this.input.charCodeAt(next) !== 61 /* '=' */ ||
+        // Check for ==, === and => operators
+        (ch = this.input.charCodeAt(next + 1)) === 61 /* '=' */ || ch === 62 /* '>' */) {
+        return false
+      }
+    }
     return true
   };
 
@@ -961,7 +988,7 @@
   // `if (foo) /blah/.exec(foo)`, where looking at the previous token
   // does not help.
 
-  pp$8.parseStatement = function(context, topLevel, exports) {
+  pp$8.parseStatement = function(context, topLevel, exports$1) {
     var starttype = this.type, node = this.startNode(), kind;
 
     if (this.isLet(context)) {
@@ -1016,7 +1043,7 @@
         if (!this.inModule)
           { this.raise(this.start, "'import' and 'export' may appear only with 'sourceType: module'"); }
       }
-      return starttype === types$1._import ? this.parseImport(node) : this.parseExport(node, exports)
+      return starttype === types$1._import ? this.parseImport(node) : this.parseExport(node, exports$1)
 
       // If the statement does not start with a statement keyword or a
       // brace, it's an ExpressionStatement or LabeledStatement. We
@@ -1035,6 +1062,10 @@
         if (!this.allowUsing) {
           this.raise(this.start, "Using declaration cannot appear in the top level when source type is `script` or in the bare case statement");
         }
+        if (context) {
+          // Cases like `for (;;) using x = ...;`, `if (true) await using x = ...;`, etc. are not allowed.
+          this.raise(this.start, "Using declaration is not allowed in single-statement positions");
+        }
         if (usingKind === "await using") {
           if (!this.canAwait) {
             this.raise(this.start, "Await using cannot appear outside of async function");
@@ -1168,11 +1199,12 @@
   // Helper method to parse for loop after variable initialization
   pp$8.parseForAfterInit = function(node, init, awaitAt) {
     if ((this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of"))) && init.declarations.length === 1) {
-      if (this.options.ecmaVersion >= 9) {
-        if (this.type === types$1._in) {
-          if (awaitAt > -1) { this.unexpected(awaitAt); }
-        } else { node.await = awaitAt > -1; }
-      }
+      if (this.type === types$1._in) {
+        if ((init.kind === "using" || init.kind === "await using") && !init.declarations[0].init) {
+          this.raise(this.start, "Using declaration is not allowed in for-in loops");
+        }
+        if (this.options.ecmaVersion >= 9 && awaitAt > -1) { this.unexpected(awaitAt); }
+      } else if (this.options.ecmaVersion >= 9) { node.await = awaitAt > -1; }
       return this.parseForIn(node, init)
     }
     if (awaitAt > -1) { this.unexpected(awaitAt); }
@@ -1777,11 +1809,11 @@
 
   // Parses module export declaration.
 
-  pp$8.parseExportAllDeclaration = function(node, exports) {
+  pp$8.parseExportAllDeclaration = function(node, exports$1) {
     if (this.options.ecmaVersion >= 11) {
       if (this.eatContextual("as")) {
         node.exported = this.parseModuleExportName();
-        this.checkExport(exports, node.exported, this.lastTokStart);
+        this.checkExport(exports$1, node.exported, this.lastTokStart);
       } else {
         node.exported = null;
       }
@@ -1795,31 +1827,31 @@
     return this.finishNode(node, "ExportAllDeclaration")
   };
 
-  pp$8.parseExport = function(node, exports) {
+  pp$8.parseExport = function(node, exports$1) {
     this.next();
     // export * from '...'
     if (this.eat(types$1.star)) {
-      return this.parseExportAllDeclaration(node, exports)
+      return this.parseExportAllDeclaration(node, exports$1)
     }
     if (this.eat(types$1._default)) { // export default ...
-      this.checkExport(exports, "default", this.lastTokStart);
+      this.checkExport(exports$1, "default", this.lastTokStart);
       node.declaration = this.parseExportDefaultDeclaration();
       return this.finishNode(node, "ExportDefaultDeclaration")
     }
     // export var|const|let|function|class ...
     if (this.shouldParseExportStatement()) {
       node.declaration = this.parseExportDeclaration(node);
       if (node.declaration.type === "VariableDeclaration")
-        { this.checkVariableExport(exports, node.declaration.declarations); }
+        { this.checkVariableExport(exports$1, node.declaration.declarations); }
       else
-        { this.checkExport(exports, node.declaration.id, node.declaration.id.start); }
+        { this.checkExport(exports$1, node.declaration.id, node.declaration.id.start); }
       node.specifiers = [];
       node.source = null;
       if (this.options.ecmaVersion >= 16)
         { node.attributes = []; }
     } else { // export { x, y as z } [from '...']
       node.declaration = null;
-      node.specifiers = this.parseExportSpecifiers(exports);
+      node.specifiers = this.parseExportSpecifiers(exports$1);
       if (this.eatContextual("from")) {
         if (this.type !== types$1.string) { this.unexpected(); }
         node.source = this.parseExprAtom();
@@ -1869,47 +1901,47 @@
     }
   };
 
-  pp$8.checkExport = function(exports, name, pos) {
-    if (!exports) { return }
+  pp$8.checkExport = function(exports$1, name, pos) {
+    if (!exports$1) { return }
     if (typeof name !== "string")
       { name = name.type === "Identifier" ? name.name : name.value; }
-    if (hasOwn(exports, name))
+    if (hasOwn(exports$1, name))
       { this.raiseRecoverable(pos, "Duplicate export '" + name + "'"); }
-    exports[name] = true;
+    exports$1[name] = true;
   };
 
-  pp$8.checkPatternExport = function(exports, pat) {
+  pp$8.checkPatternExport = function(exports$1, pat) {
     var type = pat.type;
     if (type === "Identifier")
-      { this.checkExport(exports, pat, pat.start); }
+      { this.checkExport(exports$1, pat, pat.start); }
     else if (type === "ObjectPattern")
       { for (var i = 0, list = pat.properties; i < list.length; i += 1)
         {
           var prop = list[i];
 
-          this.checkPatternExport(exports, prop);
+          this.checkPatternExport(exports$1, prop);
         } }
     else if (type === "ArrayPattern")
       { for (var i$1 = 0, list$1 = pat.elements; i$1 < list$1.length; i$1 += 1) {
         var elt = list$1[i$1];
 
-          if (elt) { this.checkPatternExport(exports, elt); }
+          if (elt) { this.checkPatternExport(exports$1, elt); }
       } }
     else if (type === "Property")
-      { this.checkPatternExport(exports, pat.value); }
+      { this.checkPatternExport(exports$1, pat.value); }
     else if (type === "AssignmentPattern")
-      { this.checkPatternExport(exports, pat.left); }
+      { this.checkPatternExport(exports$1, pat.left); }
     else if (type === "RestElement")
-      { this.checkPatternExport(exports, pat.argument); }
+      { this.checkPatternExport(exports$1, pat.argument); }
   };
 
-  pp$8.checkVariableExport = function(exports, decls) {
-    if (!exports) { return }
+  pp$8.checkVariableExport = function(exports$1, decls) {
+    if (!exports$1) { return }
     for (var i = 0, list = decls; i < list.length; i += 1)
       {
       var decl = list[i];
 
-      this.checkPatternExport(exports, decl.id);
+      this.checkPatternExport(exports$1, decl.id);
     }
   };
 
@@ -1924,21 +1956,21 @@
 
   // Parses a comma-separated list of module exports.
 
-  pp$8.parseExportSpecifier = function(exports) {
+  pp$8.parseExportSpecifier = function(exports$1) {
     var node = this.startNode();
     node.local = this.parseModuleExportName();
 
     node.exported = this.eatContextual("as") ? this.parseModuleExportName() : node.local;
     this.checkExport(
-      exports,
+      exports$1,
       node.exported,
       node.exported.start
     );
 
     return this.finishNode(node, "ExportSpecifier")
   };
 
-  pp$8.parseExportSpecifiers = function(exports) {
+  pp$8.parseExportSpecifiers = function(exports$1) {
     var nodes = [], first = true;
     // export { x, y as z } [from '...']
     this.expect(types$1.braceL);
@@ -1948,7 +1980,7 @@
         if (this.afterTrailingComma(types$1.braceR)) { break }
       } else { first = false; }
 
-      nodes.push(this.parseExportSpecifier(exports));
+      nodes.push(this.parseExportSpecifier(exports$1));
     }
     return nodes
   };
@@ -2679,15 +2711,19 @@
   // delayed syntax error at correct position).
 
   pp$5.parseExpression = function(forInit, refDestructuringErrors) {
-    var startPos = this.start, startLoc = this.startLoc;
-    var expr = this.parseMaybeAssign(forInit, refDestructuringErrors);
-    if (this.type === types$1.comma) {
-      var node = this.startNodeAt(startPos, startLoc);
-      node.expressions = [expr];
-      while (this.eat(types$1.comma)) { node.expressions.push(this.parseMaybeAssign(forInit, refDestructuringErrors)); }
-      return this.finishNode(node, "SequenceExpression")
-    }
-    return expr
+    var this$1$1 = this;
+
+    return this.catchStackOverflow(function () {
+      var startPos = this$1$1.start, startLoc = this$1$1.startLoc;
+      var expr = this$1$1.parseMaybeAssign(forInit, refDestructuringErrors);
+      if (this$1$1.type === types$1.comma) {
+        var node = this$1$1.startNodeAt(startPos, startLoc);
+        node.expressions = [expr];
+        while (this$1$1.eat(types$1.comma)) { node.expressions.push(this$1$1.parseMaybeAssign(forInit, refDestructuringErrors)); }
+        return this$1$1.finishNode(node, "SequenceExpression")
+      }
+      return expr
+    })
   };
 
   // Parse an assignment expression. This includes applications of
@@ -2752,7 +2788,7 @@
     var startPos = this.start, startLoc = this.startLoc;
     var expr = this.parseExprOps(forInit, refDestructuringErrors);
     if (this.checkExpressionErrors(refDestructuringErrors)) { return expr }
-    if (this.eat(types$1.question)) {
+    if (!(expr.type === "ArrowFunctionExpression" && expr.start === startPos) && this.eat(types$1.question)) {
       var node = this.startNodeAt(startPos, startLoc);
       node.test = expr;
       node.consequent = this.parseMaybeAssign();
@@ -3304,6 +3340,8 @@
     }
     var startPos = this.start, startLoc = this.startLoc;
     node.callee = this.parseSubscripts(this.parseExprAtom(null, false, true), startPos, startLoc, true, false);
+    if (node.callee.type === "Super")
+      { this.raiseRecoverable(startPos, "Invalid use of 'super'"); }
     if (this.eat(types$1.parenL)) { node.arguments = this.parseExprList(types$1.parenR, this.options.ecmaVersion >= 8, false); }
     else { node.arguments = empty; }
     return this.finishNode(node, "NewExpression")
@@ -6220,7 +6258,7 @@
   // [ghbt]: https://github.com/acornjs/acorn/issues
 
 
-  var version = "8.16.0";
+  var version = "8.17.0";
 
   Parser.acorn = {
     Parser: Parser,