chore(deps): update node.js to v24.21.0 #223
No reviewers
Labels
No labels
Area
Editor
Area
Micropub
Compat
Breaking
Kind
Bug
Kind
Documentation
Kind
Enhancement
Kind
Feature
Kind
Infra
Kind
Security
Kind
Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
inhji/hajur!223
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/node-24.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
24.16.0→24.21.0Release Notes
nodejs/node (node)
v24.21.0: 2026-09-08, Version 24.21.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #639496274fccbd9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #6554253cba013c7] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #657890529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #6502441c7062b81] - (SEMVER-MINOR) net: improve performance ofnet.BlockList(James M Snell) #649745197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #6541635c635b032] - (SEMVER-MINOR) util: add non-throwingMIMEType.parse(James M Snell) #64965Commits
84d706cb9b] - assert: improve documentation wording (Kamal Rawal) #6495390d127db33] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416ad1d7884c3] - benchmark: add test-only and mock timers cases (Luan Muniz) #640971d8f045914] - benchmark: applyhighWaterMarkin webstreamspipe-to(Matteo Collina) #65138ed7ba3c993] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218c8837e1aa3] - benchmark: add test runner hooks and options (Luan Muniz) #637542ba8661e23] - buffer: prevent string write offset overflow (Matteo Collina) #65043cc9ee6c2ae] - buffer: treat detached ArrayBuffers as empty (Archkon) #645045a5d73e4c5] - build: pass target architecture to small-icu genccode (ulofiai) #65095273e72d1a5] - build: deprecate always enabled--enable-static(Chengzhong Wu) #6510389a67246e3] - build: check FIPS option value in node.gyp (Filip Skokan) #649822d21f41cd5] - build: handle malformed OpenSSL macros (Filip Skokan) #64982f62bc0f862] - build,win: add PGO workload scripts (Stefan Stojanovic) #6369633d0c7dc12] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #6451071106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495419af8b86d] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #652008029383f3f] - crypto: use available BoringSSL APIs (Filip Skokan) #65423a9bd780e19] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #654237defefad3f] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #651156ed1e38627] - crypto: fix disabling FIPS mode (Filip Skokan) #64982afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #639499b9dd6e9cf] - debugger: wait for target startup (Filip Skokan) #6519407faaeeffd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #6565353cba013c7] - deps: update undici to 7.29.1 (Node.js GitHub Bot) #657890268ca547c] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #655426274fccbd9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #655426bdcd121fa] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316c2aa446b6d] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #653183e58e48ea8] - deps: update googletest to49495ea(Node.js GitHub Bot) #65317670b3665c0] - deps: cherry-pick libuv/libuv@e640dc9(ulofiai) #65118ca1c67b021] - deps: float ICU-23262 patch for icu78 (René) #646784ad043b0aa] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #6513696b4af109b] - deps: update googletest tod89aac5(Node.js GitHub Bot) #65153774f663c56] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #6260294b118d62e] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #6531309788665bd] - dns: validate address type in lookupService (Lazizbek Ergashev) #6487815f95fc0e2] - dns: validate port range insetServers()(René) #6502137b9e9a154] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #65009cd6205fa0d] - doc: update AHAFS reference link (Taeuk Ha) #654810e6f9ae42e] - doc: fix property names in os.networkInterfaces() example (Jihwan) #65469034a827b41] - doc: fix broken links in cli.md (Donghoon Kang) #65412eb364621d4] - doc: remove outdated WASI version fallback (이혜미) #65303b13f425bf8] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #6541345c4011067] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) #64949fde6776c5f] - doc: fix broken TLS security level example (soreavis) #65391290c1fec04] - doc: clarify socket destroyed behavior (Dayun) #65395a7e8269947] - doc: update outdated nodejs.org guide links (Donghoon Kang) #653947809f11249] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) #6211764cd3a6e95] - doc: clarify how fs.Dirent file types are determined (soreavis) #645329b92fdce14] - doc: update security release prepare command (Rafael Gonzaga) #646996f9b9df3c1] - doc: clarify copyFile symlink behavior (T) #629412480acb550] - doc: document setRawMode write access on Windows (Erik Demaine) #63856a1e9c3a5db] - doc: add missing return types in fs.md (Chaseton Collins) #653074533572040] - doc: add missing return types in buffer.md (Yuya Inoue) #6530839ecedbbd2] - doc: fix lint clean command (greenhead) #652740b1fb8fcd8] - doc: fix typo in onboarding.md (서울민트초코) #652953165b5d38a] - doc: add missingadded:tags tofs.lchmod(Lazizbek Ergashev) #65283113b808e59] - doc: fix SQLite changeset constant descriptions (greenhead) #65265c3eb51d5a1] - doc: document open pull request limit (Matteo Collina) #65250d7accdcd52] - doc: document http2 header constants (Harjoth Khara) #64548f47111416f] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) #62105c3b120e737] - doc: update synopsis (Augustin Mauroy) #6517139f4c831fd] - doc: fix broken internal links (greenhead) #64901be25cdd69e] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) #648311bf7737810] - doc: fix permission documentation examples (greenhead) #64897b7932e68a1] - doc: document sqlite parameter binding (Guilherme Araújo) #650895234a5169c] - doc: finalize statements in sqlite examples (Guilherme Araújo) #6508839ea929da7] - doc: document quic stopSending() and resetStream() (Issac) #648882ba198db73] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) #62009314f9b200f] - doc: remove usage ofutil.inherits(Augustin Mauroy) #60817d82a61662c] - doc: fix grammar in worker_threads.md (이혜미) #6491344c0c8ff5b] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) #649829b2ca70e0d] - doc: remove--expose-gcflag from CLI documentation (Dario Piotrowicz) #58909a0a12397b9] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) #64976b48699e077] - doc: correct default highWaterMark values (Yilong Li) #646170312ee133c] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) #61951cd84d55c81] - esm: only register text format when enabled (Efe Karasakal) #64992c0a8ef611e] - esm: fix wasm import name in error message (이혜미) #64950e6c34f90c2] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) #644736ee4b40c91] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) #64473367549eed5] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) #653288a5b1ae4c2] - fs: fix realpath of namespaced drive paths (Jason Zhang) #65378c9233b950d] - fs: fix glob early return skipping sibling entries (Srinu desetti) #64895bc54dd8905] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) #62654fcb4333aca] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) #63886c35876154e] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) #64770b269616936] - fs: treatstd::errc::permission_deniedasEPERMerror (Kirill Saied) #64698212fe77e76] - fs: add windowsHandle option to file streams (Kirill Saied) #6385175df6cb435] - http: improve performance with known-length calls to end() (Tim Perry) #6546648d9cd4a28] - http: cache maxHeaderPairs per header section (GetThatCookie) #6498804785c8f43] - http: fix keylog listener setup on existing agent sockets (Shani Singh) #650664b90031534] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) #6499183a27559cd] - http2: adapt receive deferral for Node.js 24 (Matteo Collina) #65093f43bed0ecc] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166b42d664321] - inspector: avoid calling into JS from V8 interrupts (Joyee Cheung) #650286bf852197d] - lib: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) #61500151ca7e104] - lib: harden webidl dictionary member reads (Filip Skokan) #651157e8c2c9f44] - lib: use validateArray for array arguments (greenhead) #64959424fe2bc5a] - lib: add and test [EnforceRange] in webcrypto dictionaries (Filip Skokan) #650910529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024186e1b76e8] - meta: move targos to emeritus (Michaël Zasso) #65393b41b07c72a] - meta: add unified http api initiative (James M Snell) #65139f85b6ecd67] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #651828f3d01bdce] - meta: add Aviv Keller to.mailmap(Aviv Keller) #65048cfad1d5b28] - meta: update sccache to 0.17.0 (René) #64985349c53c441] - module: report unreadable package.json (Paul Bouchon) #65223bd21e6706e] - module: cache nearest parent package.json per directory (Shelley Vohr) #65326961bd04370] - module: fix --check on ambiguous ESM files (Paul Bouchon) #65203f45ef73420] - net: handle undefined parent in _unrefTimer and _destroy (Shivay-98) #6464441c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #649745197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #654161722ddac28] - permission: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) #65432dff2b675db] - process: validate resource stats array offsets (Archkon) #65098f277983e7b] - quic: changes for nghttp3_conn_close_stream2 (Marten Richter) #64574a4c770c78e] - quic: mark drain promise handled (James M Snell) #653192460b171c5] - quic: reset rejected HTTP/3 request streams with H3_REQUEST_REJECTED (trivenay) #6544218a7ccf302] - quic: write desired size needs update on maxstream (Marten Richter) #647689017f4a780] - quic: do not destroy incoming streams that have a consumer (trivenay) #65335ddc41c1ef4] - quic: fix wake up blob (Marten Richter) #6404488bee43d7c] - quic: convert incoming :status header to number (Hallison Pereira Melo) #63589cd776fe97c] - quic: fix infinite loop if STOP_SENDING received on a buffering stream (Tim Perry) #647154f6eda3c23] - repl: keep entries added while history file is loading (Mhayk Whandson) #64513cd1e6ce29b] - repl: add benchmarks (Aviv Keller) #645902ba740669d] - sea: avoid dangling CLI option pointers (Archkon) #64755ec5e2d6856] - sea: handle NUL bytes in asset keys (Archkon) #64773703b854293] - sea: reject trailing content in config JSON (Archkon) #64774a61a5fdd1c] - sqlite: prevent reentrant session.close() (Trivikram Kamat) #653496ae81be0a3] - sqlite: reject statement-less SQL in prepare() (Trevor Burnham) #65157043dfe4996] - sqlite: reject statement-less SQL in SQLTagStore (Trevor Burnham) #65157b8faee02e1] - sqlite: check null returns from sqlite value functions (Nora Dossche) #63288d6d2a71bee] - sqlite: validate maxSize argument in createTagStore() (Anshika Jain) #6379261a046309f] - sqlite: reject non-positive backup rates (Trivikram Kamat) #64893514e3f30fb] - sqlite: clear SQLTagStore bindings (Matteo Collina) #65041c1542255b8] - sqlite: bind Boolean (mike-git374) #62001cdb732beb5] - sqlite: fix undefined behaviour inSession::Changeset()(Nora Dossche) #63637fbe8861111] - sqlite: bind ArrayBuffer (mike-git374) #62061e3c6bd6bc8] - src: add missing vector include (Filip Skokan) #65622793cf69df8] - src: fix heap value deduplication in embedder graph (Ilyas Shabi) #64801ea5935b04c] - src: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) #6451222e5023f4d] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217a0f3c62bd9] - src: simplify c++ diagnostics channel API (James M Snell) #651588e831a3d2e] - src: make minor cleanup to permission checks (James M Snell) #65158968b2ca3a3] - src: use DictionaryTemplate for permission diag channel message (James M Snell) #6515818e16e7f8d] - src: cache permission strings (James M Snell) #65158c8625a4b6f] - src: add SetAbortHandler (Max H Fisher) #64684c990140d60] - src: match cmd.exe case-insensitively in task runner (Archkon) #64907d7463b9dbc] - src: reuse cached env strings in remaining files (Seongeun Lee) #65039b055a43b93] - src: expose Windows-only fs open flags (Kirill Saied) #647757f21e37496] - src: report why --enable-fips failed (Filip Skokan) #649798c11beae27] - src: update repeated use strings to env (James M Snell) #647609e2c477e26] - stream: normalize fused stateless transform results (Trivikram Kamat) #65367107e96dd41] - stream: encode whole chunks in TextEncoderStream (Matteo Collina) #65414164068279b] - stream: prevent share from eagerly draining source (Trivikram Kamat) #6533893d822bdc1] - stream: drain pending writes before broadcast end (Trivikram Kamat) #653346b8b9c362f] - stream: reuse unexposed managed read buffers (GetThatCookie) #649904ec4fab367] - stream: avoid duplicated endReadableNT scheduling (Matteo Collina) #6531086d1196ebf] - stream: decouple transform backpressure changes (Matteo Collina) #65143b8a7a75b19] - stream: reject pull on signal abort during flush (Trivikram Kamat) #65346386ed6a06d] - stream: avoid leaking consumers on signal failure (Trivikram Kamat) #6529974d53bd73b] - stream: use validateObject for zlib/iter params (greenhead) #650153a174ce16b] - stream: use validateNumber for BYOB reader options.min (greenhead) #65014859ea01cb2] - stream: consolidate non-op algorithm callbacks (Matteo Collina) #65138c577669825] - stream: cut promise churn in webstreams hot paths (Matteo Collina) #65138d631e910db] - stream: preserve falsy cancellation reasons (Trivikram Kamat) #64705f9c21eabbd] - stream: use validateBuffer for BYOB reader view (greenhead) #65046b89c8f5d1e] - stream: fix recursive WritableStream abort (Jeong SeokChan) #6482539e0457e86] - test: fix link-local dgram scope assertion (Filip Skokan) #656291433cf9d5b] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #655427d135d24b7] - test: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) #65279421ee11715] - test: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) #65351929d5705bc] - test: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) #65424f38f154c14] - test: simplify test-timers-interval-promisified.js (Donghoon Kang) #65322a98e27f2a9] - test: add Headers coverage and benchmark (Yagiz Nizipli) #6536538fdbb62aa] - test: deflake test-net-listen-ipv6only (sangwook) #6417306c7684b01] - test: use common/child_process spawnSync helpers (Junsoo Ha) #653776438c70004] - test: fix Linux debug skip in SEA test guard (구현우) #63751fe0e4f1b65] - test: avoid timer race in event loop delay test (Trivikram Kamat) #647286ff69baea8] - test: enforce exit code intest-http-server-stale-close(Antoine du Hamel) #65198ba87603016] - test: convert test-async-local-storage-bind to async loop (freida-code) #652708d6b89f454] - test: replaceforEach()withfor...ofin parallel tests (Phillip Markert) #65272a60572a7bb] - test: convert forEach to for in test-constant.js file (NIxxy25) #65271f82060c6ce] - test: use for-of instead of forEach (Felix P.) #652685ded71f9cc] - test: coverrealpathSyncresolving symlinks after a FIFO stat (Hendrik Liebau) #65113ac9835225e] - test: account for [EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) #65173550d24277e] - test: update WPT for WebCryptoAPI to4c2fd05(Node.js GitHub Bot) #651502aa26559f0] - test: update WPT for urlpattern to4832db4(Node.js GitHub Bot) #65151d45c010108] - test: fix hidden error in test-http-server-stale-close.js (Meghan Denny) #59357881f8d092d] - test: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) #65079e4b1e3ee75] - test: allow half-open CONNECT tunnel sockets (Trivikram Kamat) #6497300f4240d48] - test: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) #65077cf7680efb7] - test: use libuv clock for immediate queue test (Trivikram Kamat) #64889b0c12772ff] - test: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) #647197e279104b4] - test: update WPT for WebCryptoAPI to82c3d90(Node.js GitHub Bot) #64977ac11f88d16] - test,doc: cover and document multi-byte offset/size in randomFill (kyungrae2002) #6483467da38cada] - test_runner: match dotfiles in default coverage exclude (semimikoh) #63401b06c61a08f] - test_runner: print coverage and diagnostic info with dot reporter (mag123c) #614237cb9c9c126] - test_runner: use run options with isolation="none" (Sylvester Keil) #62269339acf4201] - test_runner: mock dual-package with conditional exports (Maruthan G) #62943e7a68bca08] - test_runner: add classname hierarchy for JUnit reporter (mag123c) #602206a248acefe] - test_runner: fix junit report on empty diagnostic (Lazizbek Ergashev) #65357d01dda79b6] - test_runner: do not tag-filter test file wrappers (Chemi Atlow) #6517032ead10ddd] - test_runner: fix env option validation (Jihwan) #64865b0ef155440] - tls: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) #65076dcf65c50ce] - tls: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) #64677b0f54bda78] - tools: improve commit queue failure comment (Filip Skokan) #65433bc1f2718d5] - tools: fix max body length handler increate-release-proposal.sh(Antoine du Hamel) #65455bbe76516a9] - tools: bump brace-expansion in/tools/clang-format(dependabot[bot]) #6498467697debdf] - tools: make env variables consistent in cron jobs (Antoine du Hamel) #65168ac8a68ec92] - tools: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) #651976d9999fa2e] - tools: remove skip logic incommit-queue.sh(Antoine du Hamel) #6516260bfa1694e] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot[bot]) #65129782748527e] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot[bot]) #65130dac257340f] - tools: fix GITHUB_TOKEN permissions for CQ workflow (Antoine du Hamel) #65192e624785846] - tools: use the read-only token when filtering PRs in CQ (Antoine du Hamel) #651697d9dcfaaa7] - tools: delay removal ofcommit-queuelabel (Antoine du Hamel) #651010d7c7936e7] - tools: move ncu config to global for commit queue (Filip Skokan) #651325e1db5a38a] - tools: prefilter commit queue metadata (Filip Skokan) #64343f41509b91d] - tools: lazy-abort failed PR merges in CQ (Antoine du Hamel) #65004ceb0e99acd] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753600663b23f] - tty: add raw-vt and io raw modes (Samuel Williams) #64140a40bfc742e] - typings: add signal_wrap internal binding types (Seongeun Lee) #65229b103a4a3b9] - typings: add diagnostics_channel typings (Seongeun Lee) #65227e64de34b89] - typings: add watchdog internal binding types (Seongeun Lee) #65228c57c83b4d1] - typings: add internal_only_v8 binding typeis (Donghoon Kang) #65071f15e8c9dcd] - typings: add credentials internal binding types (Donghoon Kang) #65036a500256b0b] - url: skip unused href reuse comparison (Yagiz Nizipli) #6536158390f8bec] - url: speed up WHATWG URL parsing (Yagiz Nizipli) #653617d5428c812] - url: speed up URLSearchParams (Yagiz Nizipli) #653638e2461d819] - url: bounds-check short Windows file URL paths (Archkon) #647889ffc0da90c] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651fa9d4e075d] - util: allow single-line format when break length is infinite (Hamid Reza Ghavami) #64238b68a7c3862] - util: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) #6431910cbb6dc00] - util: fix formatting of functions returned from getters (Richard Gibson) #6483964c20b449e] - util: use more primordials incomparisons.js(Ayoub Mabrouk) #61198cea9786de8] - util: preserve function names without source map names (Hiroki Osame) #6510835c635b032] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #649655858c2ba9a] - zlib: validate pledgedSrcSize for sync zstd (Archkon) #64601v24.20.0: 2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b12bcc9ae1] - (SEMVER-MINOR) async_hooks: addusingscopes toAsyncLocalStorage(Stephen Belanger) #61674e2eb88b36b] - (SEMVER-MINOR) buffer: addendparameter (Robert Nagy) #623901fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #647464a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656d4cafce076] - (SEMVER-MINOR) lib,permission: addpermission.drop(Rafael Gonzaga) #62672b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239cd1eb3e60b] - (SEMVER-MINOR) src,permission: add--permission-audit(RafaelGSS) #6186928dc85d8d2] - (SEMVER-MINOR) stream: addnode:stream/iterimplementation (James M Snell) #62066d31c168740] - (SEMVER-MINOR) test_runner: addcontext.log()and test:log event (Moshe Atlow) #64389add1edbc42] - (SEMVER-MINOR) test_runner: reportentryFileinTestStreamevents (Moshe Atlow) #64309d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #59941Commits
1822c0f335] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674984260bf44] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731ba2612cca2] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146236dc4d2d7] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291b022a1419c] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314a290f51f15] - (SEMVER-MINOR) benchmark: add benchmarks for experimental stream/iter (James M Snell) #62066465f2bfb74] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #6473974a22cd0c5] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #6390421e24208dc] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115ddacb3ff10] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #6357749198d2313] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390e2e5c4fe88] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282b78a212553] - build: pin envinfo versions in github actions (Joyee Cheung) #64117094fb840aa] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #6387591f5003cad] - build: fix flags for ngtcp2 on IBM i (SRAVANI GUNDEPALLI) #60073e83648effd] - build,test: add tests for binary linked with shared libnode (Joyee Cheung) #614634a425b41d9] - build,tools: fix shared library cross-compile (Kirill Saied) #63963fe8fa45ff2] - cli: style node --help output with util.styleText (Adrián Estrada) #644843cd1576cb2] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #6477674b3023565] - crypto: handle XOF output allocation failure (Filip Skokan) #64851fea0666a1b] - crypto: clarify missing cipher error (Filip Skokan) #6485233fec91b54] - crypto: reuse X509 issuer result (Filip Skokan) #6485244c1473348] - crypto: validate key generation options (Filip Skokan) #64852c2c53a18e5] - crypto: fix Argon2 validation errors (Filip Skokan) #64852edc1f2126d] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851be8237240c] - crypto: handle DH operation failures (Filip Skokan) #64851b65a8f3875] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #6454749f2ae204b] - crypto: cleanse provider private key copies (Filip Skokan) #64547a5d4ac8208] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547b72c0b9616] - crypto: retain legacy DH validation (Filip Skokan) #6454724a1be5886] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #645570290e0a61e] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211ba27e72ff8] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #647761fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746c0dd022081] - crypto: use user-facing error for output encoding changes (Archkon) #64692ff485a9410] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #606781329d9b9f1] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #6446782a02336aa] - deps: V8: backportd259a9e(Leszek Swirski) #63865f0fc82d404] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944c4e02f0fbc] - deps: upgrade npm to 11.19.0 (npm team) #64883d5a57ed4dd] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #6494351d413150a] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #6494521f79ce140] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #649427a4960d6a9] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #649415c423aa113] - deps: update googletest to1b6f64d(Node.js GitHub Bot) #6494040561e61b0] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #6493951090925b0] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #647447c534bf8e5] - deps: V8: backport5177b10(avivkeller) #646317b1898a341] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #647909209cc4095] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #647453833fceff6] - deps: update googletest tofa005b2(Node.js GitHub Bot) #64587bc7ce488d1] - deps: histogram: cherry-pick62ea52b(StefanStojanovic) #64296e3fa05841d] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296e75bdb9bbe] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #645861e034e6e40] - deps: update timezone to 2026c (Node.js GitHub Bot) #645882b8f1f27bd] - deps: update googletest to8240fa7(Node.js GitHub Bot) #64439241ece0417] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606215105eb90] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #643307ac97fc84e] - deps: upgrade npm to 11.18.0 (npm team) #641998d4cb9ae46] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295564c0f4592] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297e3304cd31a] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182345d6ad4eb] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777a53db015e6] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #637761f4a5c1c76] - deps: update ngtcp2 to 1.22.1 (Node.js GitHub Bot) #62812080c4d7cda] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #625954309e7c82f] - deps: update ngtcp2 to 1.21.0 (Node.js GitHub Bot) #6205190cf11cfb5] - deps: update nghttp3 to 1.15.0 (Node.js GitHub Bot) #61512e1f315a554] - deps: update ngtcp2 to 1.20.0 (Node.js GitHub Bot) #615119a3f690c9d] - deps: update ngtcp2 to 1.19.0 (Node.js GitHub Bot) #61156fe88f31764] - deps: add ngtcp2 test binaries (James M Snell) #599466d60fce138] - diagnostics_channel: grow native channel storage (Stephen Belanger) #6449730ae8ab091] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #647918cefc6efa8] - doc: fix guaranteed typo (lilianakatrina684-a11y) #623742e78e4b120] - doc: add throwIfNoEntry version history to fs.stat (kovan) #62204c7a04401cb] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957331e5e8f62] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952232287fcc6] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #649467f9efeb445] - doc: remove references toca/crlas per-context QuicSession options (René) #64769b54aa83cc6] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896f4e427803c] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843f2cd6df3f3] - doc: fix typos in documentation (greenhead) #64900d5627162bd] - doc: improve TestContext hook descriptions (Kamal Rawal) #6489972ee03bd2e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789995141eb81] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862dc30379310] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837205d4d0472] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814108b883d0b] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806b03bd3a8ed] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584093098ad7f] - doc: stabilize --disable-warning (Jean Michelet) #647422de1d76d80] - doc: add MDN links for explicit resource management in fs (lluisemper) #595572e0f36a891] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #620101c9d354d09] - doc: update technical priorities (Jacob Smith) #6450530c99bf08f] - doc: deprecation add more codemod (Augustin Mauroy) #631758a971a09eb] - doc: run license-builder (Node.js GitHub Bot) #63918707f6eacfc] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648928208cffc] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634ee593cadf5] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #646589c228b32d1] - doc: fix typo in releases guide (Jihwan) #646214a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #646568125809853] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #643712a2effadf6] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112c879f912bf] - doc: mention crypto.hash() for better perf (Steven) #63420634afda904] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025bced1433a3] - doc: fix socket.readyState state descriptions (YuSheng Chen) #644684b2c18938f] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #645825207231996] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442329a2884fd] - doc: fix typo in embedding.md (greenhead) #64425fab3f56aa1] - doc: fix typos in contributing docs (Donghoon Kang) #64520cbc2bed4e8] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362dada3ae60e] - doc: fix spelling in devcontainer guide (한만욱) #6445971343b28aa] - doc: clarify PEM format for signing keys (Harjoth Khara) #644040544ec1c78] - doc: fix typo in tls.md (Daijiro Wachi) #644588fe58078e7] - doc: document net Socket server property (Efe Karasakal) #64364d54fd03fa4] - doc: update a Dispatcher undici doc link (Filip Skokan) #643581bdebecd41] - doc: fix typos in documentation (Jungwon Sohn) #6446686bca58641] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421b5b84c9394] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386004238d77c] - doc: clarify proxy threat model (Matteo Collina) #643666851b8d55f] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321662e33714a] - doc: various updates to releases.md (Stewart X Addison) #64198949bc3cfd3] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220830d16067f] - doc: clarify QUIC stream state wording (EduardF1) #6366079b6704630] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #641889f5bf554db] - doc: fix broken link (Antoine du Hamel) #6507842b27ed428] - doc: remove unsupported syntax fromstream_iter.md(Antoine du Hamel) #64649f1a9df7f22] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682c7a3d450ac] - doc: improve quic documentation (James M Snell) #63157cc425bc659] - doc: fix promise nomenclature instream_iter.md(Antoine du Hamel) #63406859a02da96] - doc: minor structural stream/iter edits (René) #63089630b15eb20] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #6291650791fa8fa] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #642799e39360a09] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260d2b02e443a] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154e8c153f3f4] - events: avoid retaining removed event names (Matteo Collina) #6447573e1701bad] - events: optimize once() and removeListener() (Matteo Collina) #6437312f7fc0558] - fs: key glob matcher cache by platform (Archkon) #64571e5af022302] - fs: add pattern cache for matchGlobPattern() (bq) #6391563321eeb11] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #643530ad55e5618] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847ee54d9d4d2] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #6439214cb8b0a06] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506f24177ccc6] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #6465355e2c2da8c] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #64311b57350fe27] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #64370af3a17e0b3] - http2: avoid copying the options in respond() (Matteo Collina) #64265f11ac0da37] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265157bd07b6e] - http2: reduce per-request allocations (Matteo Collina) #64265b075b33429] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427445bcce079] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #6432806b54fe7d3] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481d8fac094d1] - lib: fix typo in comment in _http_client.js (agape1225) #647299ce72fd6fb] - lib: useassignFunctionNameutil where it makes sense (Antoine du Hamel) #64515c40d1473e6] - lib,permission: fix addon permission drop (Martin Wagner) #64007d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #626726b09d30a76] - lib,tools: addnode-core/func-name-matchinglint rule (Livia Medeiros) #57901d7d4f0e2ac] - loader: enforce path normalization before lookup (Maël Nison) #63917b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239cf425ad935] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #6493526fa9cc32b] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934c90fa82cd7] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933314893253a] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #649326ab711278f] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #649319138f5892a] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #649303ef3f934d4] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927a0a33127ae] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #649264ad2afbf33] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925d9b2ee4083] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #647372b43b78e82] - meta: lower stale to 3 months (Aviv Keller) #645690ffe8352ae] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315afd922cd8a] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245b6149a2976] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #642418f4a5c622f] - meta: update sccache version in test-linux-quic (René) #640439040b08696] - net: support TCP handle transfer on Windows (Matteo Collina) #644601216481a09] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399f6bf3f8a5d] - net: support sync connect for BoundSocket (Guy Bedford) #64375fb8a7e15ca] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225224d2c7886] - path: add benchmarks for path.matchesGlob() (bq) #63915980c651de5] - permission: add unique warning codes (David Evans) #644149f9a96030d] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #648088a00872183] - quic: fix stop sending behaviour & callback (Tim Perry) #647107aab0c3183] - quic: fix coverage comment typo (Jungwon Sohn) #64486b4ecb3040b] - quic: fix segfault after fragmented client hello (Tim Perry) #647206386540dad] - quic: serialize stream reset code as string (한만욱) #6457782717741c9] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #641327cb3099907] - quic: preserve session stats after close (한만욱) #6448950e639b578] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434e2e28292cc] - quic: extract transport logic from Application to Session (Tim Perry) #641272ef4b7ebf2] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289a682b53456] - quic: fix no onstream handler crash quic (Efe) #641589445e2719a] - quic: fix stall datagrams, if no pending streams (Marten Richter) #643032ea9d193bd] - quic: fix potential crash from unobserved closed (Tim Perry) #641343b7f4fc1fb] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228bd477a3202] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #641703dd04b3ec6] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #639464be8abe8f9] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191e264c5c0cb] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #639502f749dde18] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #635585ca7ef3202] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874147150cfdd] - quic: add listEndpoints API (James M Snell) #635363b59d12f5d] - quic: add proper error codes & messages for QUIC failures (Tim Perry) #63198b68f8eadb9] - quic: support hostname verification (James M Snell) #634837652bd9c6d] - quic: add stream idle timeout (James M Snell) #63483e493f04214] - quic: add block list support for endpoints (James M Snell) #634836d6cd45f8b] - quic: improve peer cert verification (James M Snell) #63483dbe0b371ee] - quic: handle h3 max header size option (James M Snell) #6348339dca4150c] - quic: add rate limiting docs (James M Snell) #63483c726a893d6] - quic: cache timestamp for address lru cache (James M Snell) #6348311778a7925] - quic: add session creation rate limiting (James M Snell) #634838107f1b3ed] - quic: refine rate limiting (James M Snell) #634833f0d7371e0] - quic: flip preferred address policy default to 'ignore' (James M Snell) #6348397c8a96774] - quic: add doc note about certificate size limitations (James M Snell) #6348342aa3f6612] - quic: add applicationOptions to session (James M Snell) #632674c00ab9d29] - quic: add getters for local and remote transport parameters (James M Snell) #63267858b636576] - quic: improve recv coalescing test sizes (James M Snell) #6326784d3100256] - quic: add initial RTT option to session options (James M Snell) #63267a2b6a81c66] - quic: enable recvmmsg batching in Endpoint (James M Snell) #6326746a0868994] - quic: improve stream header collection performance (James M Snell) #63267bc7f4efdb7] - quic: coalesce received data into fewer buffers (James M Snell) #63267f727efb8b2] - quic: apply multiple additional minor improvements (James M Snell) #63267ee0a0f1540] - quic: fix tests that are missing serverEndpoint close (James M Snell) #63267f8a1fdad07] - quic: fixup some v8:: qualifiers (James M Snell) #63267c66605609c] - quic: fix premature unref of endpoint when listening (James M Snell) #632679a72949b0b] - quic: fixup UAFs in bindingdata, streams, and app (James M Snell) #63267a4db12198e] - quic: fix UAF in Application::OnTimeout() (James M Snell) #632670a11b2ccde] - quic: improve the quic js structure (James M Snell) #632671bc25d2a03] - quic: improve internal structure of QuicStream (James M Snell) #6326769e48aed02] - quic: add aliased struct arenas (James M Snell) #632676b7185351b] - quic: add handshake timeout and default connection limits (James M Snell) #6326791e3c39097] - quic: fix crash in early handshake failure (James M Snell) #63267098e3d715d] - quic: eliminate per-received datagram allocation (James M Snell) #6326753b05e2ab2] - quic: cache the timestamp on send and receive (James M Snell) #632671592a11219] - quic: add support for future ECN marking (James M Snell) #6326780e6bf9539] - quic: improve batching of packet sending (James M Snell) #63267ff0cd5b95f] - quic: improve backend quic packet processing (James M Snell) #63267c4eb6a95da] - quic: send correct OpenSSL alert for ALPN mismatches (Tim Perry) #63193575dc7d100] - quic: fixup quic stream variable chunk len (James M Snell) #632302551f9e6dd] - quic: remove unused env_ variable in session_manager.h/cc (James M Snell) #63177bea62a14b3] - quic: ignore coverage for quic files (James M Snell) #631499788bbff97] - quic: complete the internal implementation of QUIC (James M Snell) #6287654c094d245] - quic: continue working on quic api bits (James M Snell) #60123ea82bc418d] - readline: reduce createInterface overhead (Matteo Collina) #6458590a8b23db0] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #647836abd00ed65] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812c2a52514d6] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797f9126923ef] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535c010131bc3] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #64219782ad5d5b0] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #646604afc15bf1d] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #6455337085f850d] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658f58ac8224c] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #6466805ec9c4771] - src: fix libuv assertion on windows (liuxingbaoyu) #61999308a589ee9] - src: avoid redundant DataPointer reallocations (Filip Skokan) #645523650fabcb4] - src: fix comment typos (Jungwon Sohn) #6450906b3441ea2] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) #64347bb24a88b99] - src: fix some typo errors and rename some variables (Archkon) #64301ba36ab71fd] - src: make node.config.json throw at unknown fields (Marco Ippolito) #62992fbb3960189] - src: show original file name in FileHandle GC close errors (Anna Henningsen) #60593d53d582be7] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #64426cd1eb3e60b] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869b1596c2b65] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #648902cfa96f5cb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798fc80ff5f7a] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772486cff4c08] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #6472759ef1789f7] - stream: use validateString for consumer encoding (Jungwon Sohn) #647548aba47536a] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818b20217cb56] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #641618accb0c4c0] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445ed5b04027c] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #64420136d4e7628] - stream: skip null output from stateful transforms (Trivikram Kamat) #64462193091f1ba] - stream: update iterable streams to use budget backpressure (James M Snell) #64464e2b32fce77] - stream: remove customCloneableDOMExceptionimplementation (Antoine du Hamel) #64469d77788eafe] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #64417de4ca2c962] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) #644512a3babb8d7] - stream: validate writer options signal (Trivikram Kamat) #643850ab8f269b0] - stream: reject push iterator.throw() with error (Trivikram Kamat) #64380262e6545d1] - stream: simplify nestedPromisePrototypeThens (Antoine du Hamel) #644700ddfc6af91] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) #64431a5e7d89f9e] - stream: validate writevSync chunks before queuing (Trivikram Kamat) #643008044f895bf] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) #64320d4dfb66bdf] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) #643829c9ade337f] - stream: reject nested async streamables in from() (Trivikram Kamat) #64352271c7454f4] - stream: avoid draining merged iter sources (Trivikram Kamat) #64293cbb2568a04] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) #6431267688cc651] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) #643123f8b446a67] - stream: prefer sync iterator in fromSync (Trivikram Kamat) #642943043b2a68a] - stream: speed up async iteration over WHATWG byte streams (Antoine du Hamel) #64291870273ccde] - stream: reject iter consumers on abort (Trivikram Kamat) #640668a4a997f3e] - stream: fix merge abort for pending sources (Trivikram Kamat) #64013ac5e5d5dec] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253cb298cfb15] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #64082bbbb4aadef] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #640154387ad412f] - stream: respect iter consumer abort signals (Trivikram Kamat) #639974ba1fa0062] - stream: handle falsy push writer fail reasons (Trivikram Kamat) #635693b8c30c096] - stream: handle setEncoding after buffered data (Matteo Collina) #6397397ef13c84e] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) #63500a46ddad9fa] - stream: refine the stream/iter backpressure (James M Snell) #63697557bf99245] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) #6368424b7831a1a] - stream: fix pipeToSync byte accounting (Trivikram Kamat) #635643b5f1b56bc] - stream: reject pull() reads on abort (Trivikram Kamat) #63498e48e287633] - stream: fast-path stateless transform flush results (Trivikram Kamat) #63605f0ee316f45] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) #63561fbed90b2fb] - stream: settle pending broadcast reads on return (Trivikram Kamat) #63603568dcc250f] - stream: serialize concurrent share consumer reads (Trivikram Kamat) #634785e2b4c4ade] - stream: fix lint error (Antoine du Hamel) #6359874bd0cd35a] - stream: reject pending reads on iterator throw (Trivikram Kamat) #6355545780df841] - stream: wait for push writer end fallback to drain (Trivikram Kamat) #63503217b495e0a] - stream: flush each fused stateless transform (Trivikram Kamat) #634682e8685592e] - stream: avoid duplicate writes in toWritable (Trivikram Kamat) #6336088a3392a78] - stream: propagate abort reason in share and broadcast (Trivikram Kamat) #63358fce3df74e9] - stream: disallow writing string chunk with 'buffer' encoding (René) #630625658c631fa] - stream: alignReadable.toWebtermination with eos (ikeyan) #6239402a51a746b] - stream: add sync iterable fast path to pipeTo (Trivikram Kamat) #633184c9f3edb64] - stream: fix merge handling for object-like sources (Trivikram Kamat) #63356c50d8e49cc] - stream: limit iter from sync iterable batches (Trivikram Kamat) #633241d7c86d577] - stream: cache minimum cursor count in broadcast (Trivikram Kamat) #63322ec2666edbe] - stream: avoid retrying accepted pipeTo writes (Trivikram Kamat) #63297f63143fd83] - stream: validate broadcast writer writev chunks (Trivikram Kamat) #63300944470b08a] - stream: uncork fromWritable writev on chunk error (Trivikram Kamat) #63295ae79f2b67a] - stream: validate fromWritable() options before cache (Trivikram Kamat) #63278c98cc67f33] - stream: optimize single-slot push queue drain (Trivikram Kamat) #632749a45ff5d8f] - stream: preserve toReadableSync batch after backpressure (Trivikram Kamat) #63276eb72fe94fc] - stream: cache minimum cursor count in share (Trivikram Kamat) #63262b57b51eeed] - stream: minor stream/iter implementation edits (René) #63132274b3a2ea1] - stream: remove redundant method check from iter.pipeToSync (René) #63099baf98faa06] - stream: add stream/iter to classic stream adapters (James M Snell) #6246928dc85d8d2] - (SEMVER-MINOR) stream: add stream/iter Implementation (James M Snell) #62066125c19da43] - stream, quic: update iterable streams backpressure (James M Snell) #6446411d1bd3ba7] - test: split test-embedding.js and run tests in parallel (Joyee Cheung) #61571e59346b704] - test: ensure assertions are reached on all tests (Antoine du Hamel) #6471642a967d7ed] - test: unflake debugger and REPL tests (Matteo Collina) #64718d80a45fdc4] - test: update WPT for url to4832db4(Node.js GitHub Bot) #648297264efb21b] - test: update WPT for url tob63305b(Node.js GitHub Bot) #64790539f5dc8f9] - test: cover worker throwing primitive values (varshitha) #64365087d9e8dd0] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612dd1e7139a5] - test: update quic tests for stream/iter update (James M Snell) #64464eee0e84537] - test: fix flaky http2 socket proxy test (Tim Perry) #64673a5ce44dd75] - test: apply correction to comment (Rich Trott) #64524da8508c5a0] - test: keep finalization before-exit ref alive (Tim Perry) #6452114b710c415] - test: copyedittest-tls-psk-alpn-callback-exception-handling(Antoine du Hamel) #6348599b7382c6a] - test: fix stale async-context-frame status entries (Kirill Saied) #641416da6ca730d] - test: update WPT for urlpattern to5847ee5(Node.js GitHub Bot) #6443673bf0f07f1] - test: update WPT for WebCryptoAPI toec2fee3(Node.js GitHub Bot) #644359a7ec52e6f] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) #6440759af7e0ed9] - test: fix 2nd flaky blob test case (Tim Perry) #643917fd5f66376] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) #64372d5b47d2fae] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) #64332a8ae44096d] - test: unmark flaky http2-large-file for Win (Kirill Saied) #642558461d18597] - test: increase timeout in consumed-timeout test (Trivikram Kamat) #64204af52410d70] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) #642730ea079be7b] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) #642711bde0ef053] - test: update WPT for WebCryptoAPI to0c413fb(Node.js GitHub Bot) #63647f32b412867] - test: get rid of unnecessaryAbortControllerinstanciations (Antoine du Hamel) #634898cbd90161b] - test: update WPT for wasm/jsapi to288c467(Node.js GitHub Bot) #63136f200aaccf0] - test: fixup quic tests (James M Snell) #6326714c547351b] - (SEMVER-MINOR) test: add tests for experimental stream/iter implementation (James M Snell) #620662cc54e1793] - test: skip quic tests that IBM i does not support (SRAVANI GUNDEPALLI) #601608ec80b311b] - test_runner: wait for filtered suite build (semimikoh) #642089ed7146851] - test_runner: convert to uint during deserialization (Aviv Keller) #64706d31c168740] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389add1edbc42] - (SEMVER-MINOR) test_runner: reportentryFileinTestStreamevents (Moshe Atlow) #643098d97dee696] - tests: start adding quic test server utilities (James M Snell) #59946e5278b7f7d] - timers: do not retain a reference to the async store after firing (Matteo Collina) #53443e277bc4608] - tls: fix SNICallback certificate selection (Matteo Collina) #64700b9104decc3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145b50139e89f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #649285460c464a0] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904f8a13811cd] - tools: use 'readonly' for EventSource global (Honey Tyagi) #647876e10012c0d] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) #64636d66b7588ac] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) #644955d90e48175] - tools: disable zipping tarballs on GHA (Antoine du Hamel) #644238a909f4540] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) #626089e171710fa] - tools: removeenvinfofrom our workflows (Antoine du Hamel) #642593fb722054f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #639385755712920] - tools: add lint rule for aborted AbortController (Trivikram Kamat) #63541e88d5b78bc] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816ae93bc8ad1] - typings: remove isDataView from types binding (Archkon) #64738c00bd1427d] - url: create URLPattern result properties in WebIDL order (Archkon) #647338a07969e28] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) #64123bf86741167] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #599419016ddabb9] - wasm: register missing SetURL function (Archkon) #64679e599b9428b] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #646041f1adc89da] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #645990ee91ead8b] - zlib: reject truncated zstd input (Archkon) #64593v24.19.0: 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
d08872b530] - (SEMVER-MINOR) buffer: implementblob.textStream()(Matthew Aitken) #6403635222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217d6ab039f24] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #630501da05fb79d] - doc: markstream.composestable (Matteo Collina) #625623c1636dabf] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300e323e877be] - (SEMVER-MINOR) fs: support caller-suppliedreadFile()buffers (Matteo Collina) #63634c1248c9544] - (SEMVER-MINOR) http: addhttpValidationoption to configure header value validation (RajeshKumar11) #61597a534b65815] - (SEMVER-MINOR) net: supportTCP_KEEPINTVLandTCP_KEEPCNTinsetKeepAlive(Guy Bedford) #63825a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #629357428b57a37] - (SEMVER-MINOR) src: allow empty--experimental-config-file(Marco Ippolito) #61610e57597173c] - (SEMVER-MINOR) stream: exposeReadableStreamTee(Matteo Collina) #641955396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641195e901b5cd9] - (SEMVER-MINOR) tls: addcertificateCompressionoption (Tim Perry) #62217Commits
676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #640366e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #6374787e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #6362632174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #5389969cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #6362937ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #641182424207191] - build: suppress compiler warnings for histogram (Richard Lau) #6398063502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #639337907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #639880f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #6362273aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #6326112c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #636449a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #634908bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #6389597b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #637049098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #6366359cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #634372922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #632866fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #636081ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #6360792a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #635248b37af8b11] - deps: V8: backportbef0d9c(Joyee Cheung) #621328832126422] - deps: V8: cherry-pick64b36b4(Dan Carney) #6171275990c2cd6] - deps: update googletest to8b53336(Node.js GitHub Bot) #641818500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180dc78091b45] - deps: c-ares: cherry-pick8ba37af(René) #64110873cc72125] - deps: update googletest to0b1e895(Node.js GitHub Bot) #640391d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #6390135222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #6385785c6d46606] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821d2ea8b7a8c] - deps: update googletest to7140cd4(Node.js GitHub Bot) #6377525b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #636700b3b56ee95] - deps: update googletest to8736d2c(Node.js GitHub Bot) #63669aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #638386edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #6355691c9ce5a45] - doc: improvefs.StatFsproperties descriptions (aymanxdev) #6257854e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #6319964c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #63080bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #64184fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #64215faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #6368579d685adf3] - doc: updateHttp2Server.close&Http2SecureServer.close(YuSheng Chen) #63298744e40e05e] - doc: update list of people inSECURITY.md(Richard Lau) #64152185f57c4a4] - doc: add missing option to man page (Richard Lau) #641568933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #639123a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #639745a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #6419366e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #63961d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #63939b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #63883df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #63881a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #63882206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #63672e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #637170b3fbc82d7] - doc: add webstreams to args forpipelinefromstream/promises(David Sanders) #6362862078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #6343842cd7e47de] - doc: add worker_threads history entries (Bob Put) #63545d6ab039f24] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #6305056bdd87378] - doc: move hyperlinks outside of text blocks (Aviv Keller) #634931da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #625627bb6dab70c] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #639241a4edb3c22] - doc,lib: align WebCrypto names with spec (Filip Skokan) #635183c1636dabf] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300e0f211ca79] - events: improveaddAbortListenerperf by caching options object (Raz Luvaton) #52367a124429b36] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634a41b4824d7] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095c63e00e3a5] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686d3d7cd05e3] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #635566f6387ecb3] - gyp: update deps gypfiles (Nad Alaba) #63117592544af44] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #6159785a223bf15] - http: fix drain event with cork/uncork (David Evans) #640388b060a9628] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209e68a3d33ac] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837d3682930b7] - lib: fix missing lazyDOMException import (Filip Skokan) #64033af9ea9cfcf] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174cd1ea26110] - lib: use__proto__: nullwhen callingObjectDefineProperty(Antoine du Hamel) #642395b264398ce] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702823efe8c71] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #636987f4af5568f] - lib: add Iterator global to primordials (Renegade334) #63698c8f3f5e5a5] - lib: makeNavigator#languagegetter throw on invalidthis(Mohamed Sayed) #636011ebbbd59cf] - lib: optimize webidl conversion options (Filip Skokan) #6275688590d1bb7] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #637260ea9cb9630] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850f7275a0864] - meta: fix linter warning instale.yml(Antoine du Hamel) #642813a77d21d8c] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #6424884e2836c95] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #6424709f800eec6] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #642466df1f97e64] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244737eb89651] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243dac3cd8b8f] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242108a6bc481] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #6424034d09a725d] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224944d9bc25f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057cc22555402] - meta: update status of past strategic initiatives (Joyee Cheung) #63480da7a21931e] - meta: speed up stale bot (Aviv Keller) #640757bfcf7ca56] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724db6c983cdd] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #628479e4f1339d1] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #6372592c98d3ade] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728bbd3ffde89] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727a6dd675c82] - module: enable import support for addons by default (Chengzhong Wu) #64221fb2ccb15a1] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705b9e17dc424] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825c55dd030e6] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935f08b83bc1d] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #638778d58e1b415] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087c757e3ef59] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #6385487064a096b] - sqlite: fix stack-use-after-scope with function callback (ndossche) #636407428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610d7946c9c07] - src: add test flag to config file (Marco Ippolito) #60798a642657d71] - src: rename config file testRunner to test (Marco Ippolito) #60798818b43d09e] - src: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) #62132af5e1a9729] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #640898a5d3bc168] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053ce6f29e45b] - src: avoid redundant call tostd::get_if<>()(Tobias Nießen) #6409496478050f2] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #639430147ed746e] - src: guard OpenSSL compression header include (Filip Skokan) #640098d2858a9c4] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885e5289d180f] - src: do not track weakBaseObjects as childrens ofRealms (Anna Henningsen) #63842e8352ff754] - src: allow tracking children inMemoryTrackerwith weak edges (Anna Henningsen) #63842a408f279c5] - src: use C++14 deprecated attribute forNODE_DEPRECATED(Anna Henningsen) #637554b5eb7b72d] - src: add cleanup hooks tonode::ObjectWrap(Anna Henningsen) #6364244976c6071] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #634765b3bb284f3] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #633857cdad636c4] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #63529c438250c68] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252291c127947] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #638763d91aeb434] - stream: optimize pipeTo promise handling (Matteo Collina) #63572fcbff00a44] - stream: preserve half-open duplexes in async iteration (Efe) #64275e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195a48edf40e8] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048f58c5bafcf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #629867261276f45] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #639641558986b78] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909edef89ba6a] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833915e3e2f42] - stream: check done before backpressure in stream reader (Daijiro Wachi) #636992d29628b5b] - test: update WPT for WebCryptoAPI to03a1476(Node.js GitHub Bot) #6390089e23b70c4] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #6354754ca514414] - test: make blob desiredSize assertion robust (Trivikram Kamat) #6410601cbe530eb] - test: update WPT for urlpattern to11a459a(Node.js GitHub Bot) #640376fcd3cf516] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049f50a55d7e5] - test: keep finalization close fixture ref alive (Trivikram Kamat) #640853085714530] - test: fix typo from overriden to overridden (parkhojeong) #634039f5347e8df] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #6405444b4fe4246] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #640522f567edaca] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #64051a56fbb2d36] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937b636f4769c] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006ba23eb9717] - test: update WPT for url tod4598eb(Node.js GitHub Bot) #63899bc420f20d8] - test: update WPT for urlpattern to23aac92(Node.js GitHub Bot) #63898d2c9c07af8] - test: add tests for 3 methods in utils (Daijiro Wachi) #637654e00c8ec2e] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743a17cf06d12] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764d59d7fdd16] - test: add coverage outside SEA (Daijiro Wachi) #6374471a32d31bf] - test: update WPT for urlpattern to2f28df5(Node.js GitHub Bot) #6377128c77ab174] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #633899a81921d4a] - test: add regression test for usingObjectWrapin worker (Mohamed Akram) #6364288ab61f2f8] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687b4f5c86463] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293812a66f0ac] - test: update test426-fixtures to2965987(Node.js GitHub Bot) #636682bf0de838d] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #63520bec6856ae8] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748a2b9095e03] - test_runner: avoid recompiling coverage globs for every file (sangwook) #6367502fbff446f] - test_runner: cacheshouldSkipFileCoverageresult per URL (sangwook) #63675094869354a] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #6351068edc2b009] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #63533659d5bf068] - test_runner: add parentId to test events with testId (Moshe Atlow) #63435eaebeb8b88] - test_runner: fix hooks test context (Moshe Atlow) #63285d03d96889b] - test_runner: add tags option and tag-name filter (Chemi Atlow) #63221e8c3db1364] - test_runner: addgetTestContext()(Moshe Atlow) #62501345c591d10] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #640562f47fb23bf] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #64050260cf1ac89] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #6402924140eafdf] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847b7fdb4891a] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690e48b307e09] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #642545396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119a653e9bb57] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #640935e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #622173abcfa723c] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822eaba4cd59d] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #642497d7ea1dbca] - tools: update c-ares updater script (Antoine du Hamel) #64194976827cd71] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070cc0c586b52] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078f0a35fa56a] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948dafbd23240] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #639470ae1552650] - tools: update the llhttp updater script (Antoine du Hamel) #638193623586d1f] - tools: align Bash snippets in GHA withlint-shconventions (Antoine du Hamel) #6382964b130ce1d] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #637304900cac251] - tools: fix zlib updater script (Antoine du Hamel) #637078edf3abafc] - typings: add typing for crypto (Filip Skokan) #64122d5be94e820] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782ee66a3851c] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022e26f183699] - util: fix scientific notation formatting (Daijiro Wachi) #638237993e3e476] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #6381538758a7789] - util: remove style caches from styleText slow path (Guilherme Araújo) #6370646a0ca256a] - watch: print name of changed file that triggers restart (Marco) #63781e1582818ad] - watch: cancel pending restart on shutdown (Trivikram Kamat) #633839a208668b0] - zlib: validate flush king for all streams (Ic3b3rg) #63746928981d803] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746fd0fb00164] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023e334d30b4c] - zlib: reject trailing gzip members in web streams (Filip Skokan) #640237433c3df2e] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbolCompare Source
This is a security release.
Notable Changes
Commits
6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #647139d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#9298a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#92134ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375295ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#9119a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9266c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#89605f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931v24.18.0: 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxaCompare Source
Notable Changes
e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352744c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #621834c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #631558c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #630793f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834Commits
d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #635979ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #627557c22ee23aa] - build: defNODE_USE_NODE_CODE_CACHEonly used in node_mksnapshot (Chengzhong Wu) #635882551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #633633d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #6336356e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #632553bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #632551bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #632554433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #6288326781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352761826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #6353116d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #632803b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576141de35399] - debugger: add --help tonode inspectand improve docs (Joyee Cheung) #63201b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #636024ec142314c] - deps: SQLite: cherry-pickb869ed6(Junsu Han) #6352519e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #634638a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #6321750c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #628116e56f01c4b] - deps: V8: cherry-pick435a2cd(Matthias Liedtke) #631363ba813b242] - deps: cherry-pick libuv/libuv@a43e543(Ali Hassan) #632222390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #6365052a1c18374] - doc: updategit node landinstructions for security releases (Antoine du Hamel) #635863e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #6358384d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #634797da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #622033d79bd8b29] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #635154f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #635125258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #6345343e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734fd9e14c405] - doc: update http2'spushandtrailersevents withrawHeadersparam (YuSheng Chen) #63259b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #633294b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #6321132ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #631874627bcfd82] - doc: run license-builder (github-actions[bot]) #6323228eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #628292648efd438] - doc: remove unnecessary<!-- eslint-magic comments (Antoine du Hamel) #63200a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #631317d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #6303327c1c1d842] - doc: remove list of versions inBUILDING.md(Antoine du Hamel) #63113e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #634916d1f6048d2] - fs: makeDateproperties onStatsenumerable (LiviaMedeiros) #6332844c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #640044c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #6315539f61fb06c] - http2: emit session close before stream close (Matteo Collina) #634148a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #620178c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #626451c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #6297902f35d6dce] - lib: definekEnumerablePropertyatomically (Antoine du Hamel) #6360912c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #634659b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #6282311734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #630177cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591d56e8d2512] - meta: addvfssubsystem label (René) #623316201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565f095e2bd31] - meta: add additional gitignore entries (James M Snell) #632671ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #632357d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #6355069df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #6292075d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #6326726a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #632670b534b5770] - quic: fixup linting issue after other changes (James M Snell) #632674b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #631772574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #6288630e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673677ca7e76c] - src: simplify OpenSSL feature gates (Filip Skokan) #63255c863c75c39] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206f6b2466921] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #6292492d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #630668ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #6300885d1639495] - src: remove TOCTOU race condition when encoding SAB-backedBuffers (Antoine du Hamel) #635179473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231f35c91ee68] - src: improve token return value check (James M Snell) #6348326f677c1c5] - src: exposenode::RegisterContextto make a node managed context (Chengzhong Wu) #62322275cf909b6] - src,sqlite: only passxFilterwhen user provided a callback (Antoine du Hamel) #63516287e02303f] - src,sqlite: remove dead code (Edy Silva) #6320458fa2ee189] - stream: switch to internalsleepbinding (Antoine du Hamel) #63611f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #611973f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #6303061b20f60a3] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161a835363808] - test: update WPT for WebCryptoAPI to97bbc72(Node.js GitHub Bot) #63417a00297480b] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #623895a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #634055e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469ee15380950] - test: update test426-fixtures to9b9e225(Node.js GitHub Bot) #633739e063d9bea] - test: update WPT for url toe4a4672(Node.js GitHub Bot) #63372503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #633951d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #633862004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #632440ff6bf853c] - test: reduce flakiness ofdifferent-registry-per-thread(Antoine du Hamel) #63244d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #633616d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #631009dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060a072a25ee7] - test: move FFI tests toNATIVE_SUITES(Antoine du Hamel) #6316564efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #630767dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #6328394e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #6316106d308fb61] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #631112e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #634154c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #6337867d0c490a8] - tools: fix skip oftest-interneton forks (Antoine du Hamel) #6349202f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #630755d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #6337455af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999v24.17.0: 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #6289166e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #638203a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8559224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85431beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8578e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
chore(deps): update node.js to v24.18.1to Update Node.js to v24.18.19b8b0e601dto1306f9b3c0Update Node.js to v24.18.1to Update Node.js to v24.19.01306f9b3c0to748b8404bfUpdate Node.js to v24.19.0to Update Node.js to v24.20.0Update Node.js to v24.20.0to chore(deps): update node.js to v24.20.0chore(deps): update node.js to v24.20.0to Update Node.js to v24.20.0748b8404bftof6fc957c03Update Node.js to v24.20.0to Update Node.js to v24.21.0Update Node.js to v24.21.0to chore(deps): update node.js to v24.21.0View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.