deps: update libuv to 1.53.0

[nodejs-github-bot]

This is an automated update of libuv to 1.53.0.

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[panva]

This should also fix the SmartOS test-worker-init-failure flake in the reliability report, introduced by #65796.

Switching V8's entropy source to uv_random() made worker initialization open /dev/urandom on SmartOS. Under the test's deliberate file-descriptor exhaustion, that can abort the entire process instead of reporting a worker initialization error. libuv/libuv#5187 (part of this release) switches to getrandom(2), removing that descriptor dependency.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/77900/

[richardlau]

https://github.com/nodejs/node/actions/runs/36140009857/job/108087238784?pr=66282#step:6:4886

lld-link : error : undefined symbol: WaitOnAddress [D:\a\node\node\node_js2c.vcxproj]
  >>> referenced by D:\a\node\node\deps\uv\src\win\pipe.c:1066
  >>>               libuv.lib(pipe.obj):(uv__pipe_cancel_synchronous_io)
  
lld-link : error : undefined symbol: WakeByAddressSingle [D:\a\node\node\node_js2c.vcxproj]
  >>> referenced by D:\a\node\node\deps\uv\src\win\pipe.c:1450
  >>>               libuv.lib(pipe.obj):(uv__pipe_begin_synchronous_io)
  >>> referenced by D:\a\node\node\deps\uv\src\win\pipe.c:1460
  >>>               libuv.lib(pipe.obj):(uv__pipe_begin_synchronous_io)

[aduh95]

---
duration_ms: 221.414
exitcode: 1
severity: fail
stack: |-
  node:internal/assert/utils:146
    throw error;
    ^

  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:

  true !== false

      at Object.<anonymous> (/home/iojs/build/workspace/node/test/parallel/test-blocklist.js:891:10)
      at Module._compile (node:internal/modules/cjs/loader:1956:14)
      at Object..js (node:internal/modules/cjs/loader:2096:10)
      at Module.load (node:internal/modules/cjs/loader:1678:32)
      at Module._load (node:internal/modules/cjs/loader:1470:12)
      at wrapModuleLoad (node:internal/modules/cjs/loader:261:19)
      at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:171:5)
      at node:internal/main/run_main_module:33:47 {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: true,
    expected: false,
    operator: 'strictEqual',
    diff: 'simple'
  }

  Node.js v27.0.0-pre
...

[jonathanlindsay]

This release includes libuv/libuv#5181, which fixes spawn with 'pipe'/'ipc' hanging inside a Windows AppContainer. Requesting it for v24.x as well once it lands: #66374.

[ywkuno]

Hi, I looked into the two CI failures on this PR and have fixes on a branch, in case they're useful:
actions/tools-update-libuv...ywkuno:node:libuv-1.53-followups

Windows link failure. libuv 1.53's pipe code now calls WaitOnAddress / WakeByAddressSingle, which live in Synchronization.lib. Node's uv.gyp doesn't link that library, so the build fails with LNK2019 for both symbols (from libuv.lib(pipe.obj)), then LNK1120 in node_js2c.exe. I reproduced this at d44f17a with VS 17.14 / MSVC 19.44.
50a0710 deps: link Synchronization.lib in uv.gyp
b559a3a deps: link Synchronization.lib in uv GN build. This is the corresponding change for unofficial.gni; I haven't built with GN yet.
With these, node.exe links and process.versions.uv is 1.53.0.

test-blocklist failure on Linux. libuv 1.53 includes the change from 6179e7af, which replaces the hard-coded IPv6 address buffer size in uv_ip6_addr() with INET6_ADDRSTRLEN. Longer zoned IPv6 address parts are therefore parsed instead of being truncated at the old limit. FastCheckString() still rejects address parts of 40+ characters, so the fast and slow BlockList paths disagree for the same string. That's the test-blocklist.js:891 failure. I reproduced it on Fedora 44 / GCC 16.2.
59eedfa net: align BlockList fast path with uv_ip6_addr. It truncates the address part to INET6_ADDRSTRLEN - 1, matching uv_ip6_addr(), updates the test-blocklist expectation, and adds a fast-API test comparing both paths. It depends on the libuv 1.53 behavior, so it belongs with this update.
test-blocklist.js and test-blocklist-fast-api.js pass; make lint-js, lint-cpp and format-cpp are clean; core-validate-commit passes.

I used a closed-source coding agent to help investigate and draft these. I reviewed the changes, reproduced both failures and verified the fixes myself, and I'm happy to explain or adjust anything. Feel free to cherry-pick or adapt them into this PR, or let me know if you'd rather have a separate PR.