fix: add buffer-length check in zip_dir_add.c

.clang-format

@@ -0,0 +1,4 @@
+# uses the same styling as V8
+BasedOnStyle: Google
+DerivePointerAlignment: false
+MaxEmptyLinesToKeep: 1

.clang-format-ignore

@@ -0,0 +1,12 @@
+# clang format doesn't work properly with * and **
+NativeScript/include/*
+NativeScript/include/*/*
+NativeScript/include/*/*/*
+NativeScript/include/*/*/*/*
+NativeScript/include/*/*/*/*/*
+NativeScript/ada/*
+NativeScript/inspector/third_party/*
+NativeScript/inspector/third_party/*/*
+NativeScript/inspector/third_party/*/*/*
+NativeScript/inspector/third_party/*/*/*/*
+NativeScript/third_party/*

.github/actions/collect-test-diagnostics/action.yml

@@ -0,0 +1,50 @@
+name: Collect test diagnostics
+description: >
+  Gather what a failed simulator test run leaves outside the xcresult bundle:
+  host-side crash reports (.ips), CoreSimulator logs, and — when a device is
+  still booted — a targeted slice of the unified log. The xcresult itself
+  already carries the app's stdout/stderr and testmanagerd logs
+  (xcrun xcresulttool export diagnostics), so none of that is duplicated here.
+inputs:
+  test-folder:
+    description: Folder the diagnostics directory is created in
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Collect crash reports and simulator logs
+      shell: bash
+      run: |
+        DIAG="${{ inputs.test-folder }}/diagnostics"
+        mkdir -p "$DIAG"
+        # Crashes of simulator apps land in the *host's* DiagnosticReports.
+        cp -R ~/Library/Logs/DiagnosticReports/. "$DIAG/DiagnosticReports/" 2>/dev/null || true
+        cp -R ~/Library/Logs/CoreSimulator/. "$DIAG/CoreSimulator/" 2>/dev/null || true
+        # Only a booted device can serve its unified log; never boot one
+        # post-mortem — a fresh boot may pick the wrong device and stalls the
+        # job for minutes on an already-degraded VM. The pipeline must not leak
+        # grep's exit status: this shell runs with -e -o pipefail.
+        UDID="$(xcrun simctl list devices booted | grep -oE '[0-9A-Fa-f-]{36}' | head -1 || true)"
+        if [ -n "$UDID" ]; then
+          echo "Collecting unified log slice from booted simulator $UDID"
+          # simctl blocks forever if CoreSimulatorService is wedged — the very
+          # state this step tends to run in — so hard-cap it.
+          xcrun simctl spawn "$UDID" log show --style compact --last 45m \
+            --predicate 'process CONTAINS "TestRunner"' \
+            > "$DIAG/simulator-unified.log" 2>/dev/null &
+          LOG_PID=$!
+          ( sleep 120 && kill -9 "$LOG_PID" ) 2>/dev/null &
+          KILLER_PID=$!
+          wait "$LOG_PID" || echo "log show failed or was killed after 120s"
+          kill "$KILLER_PID" 2>/dev/null || true
+        else
+          echo "No booted simulator; relying on the xcresult's captured app output."
+        fi
+        echo "Collected diagnostics:"
+        du -sh "$DIAG"/* 2>/dev/null || true
+    - name: Upload test diagnostics
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: test-diagnostics
+        path: ${{ inputs.test-folder }}/diagnostics
+        if-no-files-found: ignore

.github/actions/setup-build-env/action.yml

@@ -0,0 +1,35 @@
+name: Setup build environment
+description: Node + Python + native build dependencies shared by the workflow build/test jobs.
+inputs:
+  node-version:
+    description: Node.js version to install
+    default: "22"
+  registry-url:
+    description: npm registry URL to configure for publishing (optional)
+    default: ""
+  install-test-tools:
+    description: Also install xcparse and the JUnit report tools ("true"/"false")
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
+        # setup-node v6 enables dependency caching by default when it detects a
+        # package manager — a cache-poisoning vector for the release jobs (see
+        # npm_release.yml). Disabled everywhere; also keeps pre-v6 behavior.
+        package-manager-cache: false
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      with:
+        python-version: "3"
+    - name: Install dependencies
+      shell: bash
+      run: ./scripts/install-ci-deps.sh ${{ inputs.install-test-tools == 'true' && '--test-tools' || '' }}
+    # The V8 libraries and headers are not committed. build_nativescript.sh also
+    # calls this, but the test job drives xcodebuild directly, so it belongs in
+    # the shared setup rather than in one job. It is a no-op once installed.
+    - name: Fetch prebuilt V8
+      shell: bash
+      run: ./download_v8.sh

.github/dependabot.yml

@@ -0,0 +1,146 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+
+  - package-ecosystem: npm
+    directory: /AppWithModules/app
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared/Require/PackageJsonApp/io
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared/Require/PackageJsonAppNoMain/io
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared/Require/PackageJsonAppWithoutExtension/io
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared/Require/PackageJsonMainPointsToDir
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared/Require/PackageJsonSyntaxError/io
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared/Require/ResolveCanonicalPath
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tests/shared
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tns_modules/dummy-package
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tns_modules/tns-core-modules/shared/Require/PackageJsonTns/io
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /TestRunner/app/tns_modules/tns-core-modules/shared/Require/RequirePriority/dependency5
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+      time: "23:00"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0