permission: keep explicit fs grants when dropping a covering directory

[RafaelGSS]

permission: keep explicit fs grants when dropping a covering directory

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.41%. Comparing base (fcfb7ec) to head (d830a67).
⚠️ Report is 119 commits behind head on main.

Files with missing lines	Patch %	Lines
src/permission/fs_permission.cc	93.75%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #66556   +/-   ##
=======================================
  Coverage   90.40%   90.41%           
=======================================
  Files         791      791           
  Lines      276226   276234    +8     
  Branches    53045    53046    +1     
=======================================
+ Hits       249732   249755   +23     
+ Misses      16899    16890    -9     
+ Partials     9595     9589    -6     

Files with missing lines	Coverage Δ
src/permission/fs_permission.cc	76.66% <93.75%> (+7.35%)	⬆️

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[RafaelGSS]

ping @marco-ippolito @UlisesGascon

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/78258/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/78287/

[nodejs-github-bot]

Commit Queue failed

This pull request has multiple commits, but no landing policy was selected.

Add commit-queue-squash PRs the Commit Queue should land as one squashed commit. to land it as one commit, or commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. to land the commits separately.

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

�[36m⠋�[39m Loading data for nodejs/node/pull/66556
�[36m⠋�[39m Loading data for nodejs/node/pull/66556
�[36m⠋�[39m Getting collaborator contacts from README of nodejs/node
�[36m⠋�[39m Getting PR from nodejs/node/pull/66556
�[36m⠋�[39m Getting reviews from nodejs/node/pull/66556
�[36m⠋�[39m Getting comments from nodejs/node/pull/66556
�[36m⠋�[39m Getting commits from nodejs/node/pull/66556
✔  Done loading data for nodejs/node/pull/66556
----------------------------------- PR info ------------------------------------
Title      permission: keep explicit fs grants when dropping a covering directory (#66556)
Author     Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS)
Branch     RafaelGSS:keep-explicit-fs-grants-when-dropping-a-covering-d -> nodejs:main
Labels     c++, author ready, needs-ci, commit-queue, permission, lacks-second-approval
Commits    2
 - permission: keep explicit fs grants when dropping a covering directory
 - permission: fix clang-format in GrantAccess
Committers 1
 - RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66556
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/66556
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Tue, 06 Oct 2026 10:36:57 GMT
   ✔  Approvals: 1
   ✔  - Ulises Gascón (@UlisesGascon): https://github.com/nodejs/node/pull/66556#pullrequestreview-5462030699
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-10-10T08:31:09Z: https://ci.nodejs.org/job/node-test-pull-request/78287/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78287/
�[36m⠙�[39m Querying data for job/node-test-pull-request/78287/
�[36m⠙�[39m Querying API for job/node-test-pull-request/78287/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
�[36m⠹�[39m Querying API for job/node-test-pull-request/78287/
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
�[36m⠹�[39m Querying API for job/node-test-pull-request/78287/
�[36m⠹�[39m Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
�[36m⠸�[39m Downloading patch for 66556
�[36m⠸�[39m Downloading patch for 66556
From https://github.com/nodejs/node
 * branch                  refs/pull/66556/merge -> FETCH_HEAD
✔  Fetched commits as c883ccf3b249..d830a6797c8b
--------------------------------------------------------------------------------
[main 86a76a6e90] permission: keep explicit fs grants when dropping a covering directory
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Tue Oct 6 06:36:43 2026 -0300
 2 files changed, 53 insertions(+), 8 deletions(-)
[main f14c4be54b] permission: fix clang-format in GrantAccess
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Tue Oct 6 07:50:28 2026 -0300
 1 file changed, 2 insertions(+), 3 deletions(-)
   ✔  Patches applied
There are 2 commits in the PR. Attempting autorebase.
(node:397) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Rebasing (2/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
permission: keep explicit fs grants when dropping a covering directory

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66556
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD fd24f06969] permission: keep explicit fs grants when dropping a covering directory
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Tue Oct 6 06:36:43 2026 -0300
 2 files changed, 53 insertions(+), 8 deletions(-)
Rebasing (3/4)
Rebasing (4/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
permission: fix clang-format in GrantAccess

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66556
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
--------------------------------------------------------------------------------
[detached HEAD 94431fd908] permission: fix clang-format in GrantAccess
 Author: RafaelGSS <rafael.nunu@hotmail.com>
 Date: Tue Oct 6 07:50:28 2026 -0300
 1 file changed, 2 insertions(+), 3 deletions(-)
Successfully rebased and updated refs/heads/main.
--------------------------------------------------------------------------------
   ℹ  Add `commit-queue-squash` label to land the PR as one commit, or `commit-queue-rebase` to land as separate commits.

View workflow run

[nodejs-github-bot]

Landed in 02bae37