René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"deps: clarify criteria for cherry-picking upstream LIEF fixes","articleBody":"Could we clarify when it is appropriate to cherry-pick upstream LIEF fixes into Node.js before an official LIEF release?\n\nThe [dependency maintenance guidelines](https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-dependencies.md#updating-dependencies) generally require changes to have landed upstream, but do not explicitly require an upstream release. In [#63934](https://github.com/nodejs/node/pull/63934#issuecomment-5493089494), inheriting fixes through a LIEF update was preferred over patching its bundled dependencies directly.\n\nThat seems like a reasonable default, but without a known release date, the timeline for resolving affected Node.js issues remains uncertain. Two examples are:\n\n- **#67048:** Generated SEAs fail on Linux arm64 with 16 KiB or 64 KiB pages. An upstream LIEF fix has been [tested successfully with Node.js v26.13.0](https://github.com/nodejs/node/issues/67048#issuecomment-6538441468).\n- **#66076:** A libc++ build failure in LIEF’s bundled frozen dependency. The fix was [incorporated into LIEF](https://github.com/lief-project/LIEF/pull/1386), but is awaiting a release.\n\nThese issues also affect Node.js 26, which has now entered LTS, although SEA remains at Stability 1.1 - Active development.\n\nWould case-by-case cherry-picks be appropriate when:\n\n- The fix has landed in LIEF upstream and addresses a significant Node.js regression or build failure.\n- The impact justifies carrying the fix rather than waiting for a release.\n- The patch can be adequately reviewed, tested, and tracked through subsequent LIEF updates.\n\nAre there additional LIEF-specific maintenance concerns we should consider?","author":{"url":"https://github.com/inoway46","@type":"Person","name":"inoway46"},"datePublished":"2026-10-31T16:44:53Z","url":"https://github.com/nodejs/node/issues/67164"}