2026-09-08, Version 24.21.0 'Krypton' (LTS) - #65873
Open
github-actions[bot] wants to merge 238 commits into
Open
2026-09-08, Version 24.21.0 'Krypton' (LTS)#65873github-actions[bot] wants to merge 238 commits into
github-actions[bot] wants to merge 238 commits into
Conversation
Accept WHATWG URL objects in private-key inputs and load referenced keys through OpenSSL STORE loaders. Pass optional property queries and passphrases while preserving provider-owned EVP_PKEY objects for ordinary KeyObject and CryptoKey operations. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #63949 Backport-PR-URL: #65426 Reviewed-By: Antoine du Hamel <[email protected]>
Signed-off-by: hanityx <[email protected]> PR-URL: #64865 Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Chemi Atlow <[email protected]>
Treat detached ArrayBuffers and Buffer or TypedArray views backed by them as zero-length inputs in buffer.isUtf8() and buffer.isAscii(). Both functions now return true for these inputs, consistent with other empty inputs. Signed-off-by: Archkon <[email protected]> PR-URL: #64504 Fixes: #64503 Reviewed-By: James M Snell <[email protected]>
Synchronize mk-ca-bundle.pl with curl 1.33. This brings in curl's corrected handling of NSS distrust-after metadata. Refs: https://github.com/curl/curl/blob/0ada20387c31c638cfd7f6b4ae7e5cab5b318caf/scripts/mk-ca-bundle.pl Signed-off-by: Archkon <[email protected]> PR-URL: #64753 Fixes: #64752 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: René <[email protected]>
File write streams inherit the default byte-stream highWaterMark. The fixed 16 KiB value became stale when that default changed. Also document the Windows-specific byte-stream default. Signed-off-by: umuoy1 <[email protected]> PR-URL: #64617 Reviewed-By: Chengzhong Wu <[email protected]>
Signed-off-by: James M Snell <[email protected]> PR-URL: #64760 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Filip Skokan <[email protected]>
Signed-off-by: Matteo Collina <[email protected]> PR-URL: #64651 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Filip Skokan <[email protected]>
Signed-off-by: kyungrae <[email protected]> PR-URL: #64976 Refs: #35093 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Tierney Cyren <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>
Similar to `URL.parse(...)`, the `MIMEType.parse(...)` API will return `null` if the input cannot be parsed as opposed to throwing the way the constructor does. Signed-off-by: James M Snell <[email protected]> PR-URL: #64965 Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: René <[email protected]>
PR-URL: #64977 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>
The startup failure always appended the OpenSSL error queue, so when Node.js itself detected the missing fips provider it printed an error header followed by nothing. Report the reason instead. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #64979 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>
PR-URL: #58909 Reviewed-By: Jake Yuesong Li <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>
OpenSSL reports FIPS mode as disabled after a successful EVP_default_properties_enable_fips(..., 0) call. Do not treat that disabled state as a failure. Add OpenSSL 3 regression coverage that verifies the state is enabled before disabling it again. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #64982 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Aviv Keller <[email protected]>
A missing OPENSSL_VERSION_NUMBER macro raises TypeError while the configure logic attempts to slice None. Treat that like the other version detection failures so configure warns and records version 0. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #64982 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Aviv Keller <[email protected]>
openssl_is_fips is always the string "true" or "false", so testing whether it is non-empty always adds OPENSSL_FIPS to mkssldef. Add the define only when FIPS was requested. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #64982 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Aviv Keller <[email protected]>
Distinguish OpenSSL 3 provider setup from FIPS/property-query state, document configuration precedence and provider limitations, and retain the OpenSSL 1.1 and runtime control guidance. Regenerate the CLI manpage. Signed-off-by: Filip Skokan <[email protected]> PR-URL: #64982 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Aviv Keller <[email protected]>
Report the rejected import name instead of the import module when throwing for reserved Wasm import names. Signed-off-by: hyemimi <[email protected]> PR-URL: #64950 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Guy Bedford <[email protected]>
PR-URL: #62061 Fixes: #61396 Reviewed-By: René <[email protected]> Reviewed-By: Edy Silva <[email protected]>
Signed-off-by: Renegade334 <[email protected]> PR-URL: #64985 Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
If `nChangeset == 0`, the pointer `pChangeset` may be nullptr. Passing a nullptr to `memcpy()` is undefined behaviour. This can be triggered by running the test suite under UBSAN. Signed-off-by: ndossche <[email protected]> PR-URL: #63637 Reviewed-By: René <[email protected]>
PR-URL: #62001 Fixes: #57862 Reviewed-By: Zeyu "Alex" Yang <[email protected]>
Signed-off-by: Lazizbek Ergashev <[email protected]> PR-URL: #65009 Fixes: #65006 Reviewed-By: René <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Tim Perry <[email protected]>
* fix duplicate address insertion in SocketAddressBlockList * fix BlockList rule listing order to match apply * add minor bound check in BlockList * improve performance of BlockList apply * eliminating shared_ptr * check fast api path * add clear method to BlockList * general storage improvements to BlockList * use shared locks for BlockList reads * add bulk address adding to BlockList * add BlockList benchmark * add remove range/subnet to BlockList * add cidr notation parsing to BlockList * add additional apis to BlockList * add private subnet presets to BlockList Signed-off-by: James M Snell <[email protected]> Assisted-by: OpenCode/Opus PR-URL: #64974 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]>
Fixes: #57288 Signed-off-by: PickBas <[email protected]> PR-URL: #63851 Reviewed-By: Stefan Stojanovic <[email protected]>
On slower CI machines, the probed process may take longer time to bootstrap and establish connection to. Increase the timeout so it's more likely to finish testing before timing out. Signed-off-by: Joyee Cheung <[email protected]> PR-URL: #64719 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-07-24.md Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]>
Recheck the stream state after signaling abort, as required by steps 3 and 4 of the WritableStreamAbort algorithm. Only reject pending close promise caches, as a cache materialized after the stream becomes errored may already contain a rejected promise. This makes the recursive abort WPT pass and removes its expected-failure entry. Refs: https://streams.spec.whatwg.org/#writable-stream-abort Signed-off-by: Jeong SeokChan <[email protected]> PR-URL: #64825 Reviewed-By: Daeyeon Jeong <[email protected]> Reviewed-By: Mattias Buelens <[email protected]>
Signed-off-by: hyemimi <[email protected]> PR-URL: #64913 Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>
Signed-off-by: Kirill Saied <[email protected]> PR-URL: #64775 Reviewed-By: Aviv Keller <[email protected]>
Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: #65004 Refs: #64972 Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Filip Skokan <[email protected]>
SQLTagStore reused cached statements without clearing values bound by a previous execution. Clear bindings before binding new values and reject parameters that do not correspond to template substitutions. Signed-off-by: Matteo Collina <[email protected]> PR-URL: #65041 Reviewed-By: René <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]>
Add an --analyze flag that performs statistical analysis directly
after benchmarks complete, eliminating the need for R and compare.R.
When --analyze is specified, compare.js collects the rate data during
the run and prints a statistical summary table instead of CSV output.
The table matches the format of compare.R: improvement percentage,
significance stars (* p<0.05, ** p<0.01, *** p<0.001), and confidence
intervals at three risk levels.
Also adds a --max-regression N option that causes the compare.js to
exit with 1 (error) when the `--new` is N% slower. Useful for CI
use to detect regressions.
Uses the histogram API's welchTest() and cohensD() methods introduced
in the previous commit. Benchmark rates are scaled to integers for
HdrHistogram recording; the --scale option (default 1000) controls
the multiplier for precision.
Usage:
node benchmark/compare.js --old ./node-old --new ./node-new \
--analyze url
Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus
PR-URL: #65416
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Signed-off-by: ishabi <[email protected]> PR-URL: #64801 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]>
Wait for buffer space after drop-newest discards an upstream result. This keeps one consumer pull from draining the source or looping indefinitely while a slower consumer keeps the buffer full. Signed-off-by: Kamat, Trivikram <[email protected]> Assisted-by: codex:gpt-5.6-sol PR-URL: #65338 Fixes: #65337 Reviewed-By: James M Snell <[email protected]>
The bundled ansi-regex OSC pattern used a restrictive URI character class that failed when URIs contained RFC 3986-valid characters such as parentheses. Match OSC sequences generically as ESC ] ... ST, aligned with ansi-regex v6.2.0. Co-authored-by: Cursor <[email protected]> Signed-off-by: dushyant <[email protected]> PR-URL: #64319 Fixes: #64313 Reviewed-By: Aviv Keller <[email protected]>
The JavaScript realpath implementation probes a namespaced drive root through the fs binding. Windows path resolution drops the trailing separator from that probe, so lstat receives C: and reports EISDIR. Use the regular drive-root spelling only for the probe. Preserve the namespaced spelling for traversal and returned paths. Signed-off-by: Jason Zhang <[email protected]> PR-URL: #65378 Fixes: #62446 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stefan Stojanovic <[email protected]>
fs.readFileSync(path, 'utf8') read the whole file in 8 KiB read() calls appended to a std::string, i.e. one syscall and a potential reallocation per 8 KiB (an 8 MiB file took ~1400 read() calls). Keep the exact old sequence for small files (one read into the 8 KiB stack buffer, one read reporting EOF). Once a read fills the stack buffer, read the rest directly into one heap buffer sized from fstat() (plus one byte so that the EOF read does not force growth), growing geometrically only when the size is unavailable or wrong. The size is only an allocation hint: reading continues until read() reports EOF, so procfs/sysfs files, FIFOs, files that change while being read and file descriptors positioned mid-file behave as before, and the bytes handed to StringBytes::Encode() are exactly the ones read. Signed-off-by: Shelley Vohr <[email protected]> PR-URL: #65328 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]>
This boosts RPS performance for the common API case where you call `res.end(data)` with the entire response by up to 9%. Signed-off-by: Tim Perry <[email protected]> PR-URL: #65466 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Signed-off-by: RafaelGSS <[email protected]> PR-URL: #65432 Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Beth Griggs <[email protected]> Reviewed-By: James M Snell <[email protected]>
tls.connect() with malformed ALPNProtocols hit CHECK_EQ(0, SSL_set_alpn_protos(...)) in the C++ layer and aborted the process with SIGABRT. Validate in JS instead, in convertALPNProtocols, so both client and server fail early with a recoverable ERR_INVALID_ARG_VALUE: - zero-length string protocols now throw from convertProtocols - wire-format buffers are checked for zero-length and truncated entries - an empty buffer or array is still accepted and means skip ALPN, matching the historical behavior for [] The C++ CHECK_EQ is left unchanged: once JS has validated the input, a non-zero SSL_set_alpn_protos return is an internal invariant failure rather than user-facing input. Fixes: #65069 Signed-off-by: Sankalp Thakur <[email protected]> PR-URL: #65076 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]>
Signed-off-by: Hamid Reza Ghavami <[email protected]> PR-URL: #64238 Reviewed-By: Jordan Harband <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>
Signed-off-by: Taeuk Ha <[email protected]> PR-URL: #65481 Reviewed-By: Daeyeon Jeong <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Beth Griggs <[email protected]>
The encode-and-enqueue transform walked the chunk code unit by code
unit, materializing a single-character string per index and building
the output with string concatenation. The only state that crosses
chunks is a trailing high (leading) surrogate, and TextEncoder.encode's
USVString conversion already replaces every interior lone surrogate
with U+FFFD, which is exactly what the spec loop produces. Join a
pending high surrogate with the incoming chunk, hold back a new
trailing high surrogate, and encode the rest in a single native call.
The streaming decode path also reuses a single options object instead
of allocating { stream: true } per chunk.
An encoding-streams benchmark is added since the suite had no
TextEncoderStream/TextDecoderStream row. Encoding improves by ~546%
with 1KB string chunks and ~20% with 16-character chunks; decode is
unchanged.
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #65414
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>
This is the certdata.txt[0] from NSS 3.126. This is the version of NSS that shipped in Firefox 154.0 on 2026-08-18. Certificates added: - SECOM TLS RSA Root CA 2024 - SECOM TLS ECC Root CA 2024 - Telia EC TLS Root CA v3 - Telia RSA TLS Root CA v3 Certificates removed: - ePKI Root Certification Authority - Atos TrustedRoot 2011 [0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_126_RTM/lib/ckfw/builtins/certdata.txt PR-URL: #65495 Reviewed-By: René <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
Normalize each stateless transform result before passing it to the next transform in a fused run. This ensures that subsequent transforms always receive Uint8Array[] batches in both synchronous and asynchronous pipelines. Signed-off-by: Kamat, Trivikram <[email protected]> Assisted-by: codex:gpt-5.6-sol PR-URL: #65367 Fixes: #65366 Reviewed-By: James M Snell <[email protected]>
Originally added in 16b11cd, it first had three callers. Now there's only one branch requireing it. Signed-off-by: Szymon Łągiewka <[email protected]> PR-URL: #64473 Reviewed-By: Chemi Atlow <[email protected]>
While more readable, the removed closure overhead unlocks 10-20% in eventtarget.js benchmark. Signed-off-by: Szymon Łągiewka <[email protected]> PR-URL: #64473 Reviewed-By: Chemi Atlow <[email protected]>
PR-URL: #65542 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>
PR-URL: #65542 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>
Signed-off-by: Filip Skokan <[email protected]> PR-URL: #65542 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>
AIX can report lo0 as the scope ID for a datagram sent to a local interface. Validate that the received address includes a non-empty scope ID and verify that the address can be used to reply, instead of requiring the scope ID to match the destination interface. Refs: #46792 Assisted-by: Codex Signed-off-by: Filip Skokan <[email protected]> PR-URL: #65629 Refs: #46792 Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
PR-URL: #65789 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]>
PR-URL: #65653 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Mike McCready <[email protected]>
Signed-off-by: Filip Skokan <[email protected]> PR-URL: #65622 Fixes: #65620 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: René <[email protected]> Reviewed-By: James M Snell <[email protected]>
Node.js 24 does not include the later stream lifecycle changes that the original fix relies on. Preserve its reset ordering, avoid JavaScript callbacks after a deferred session close, and let destroyed streams finish without requesting trailers. Signed-off-by: Matteo Collina <[email protected]> Refs: #64166 PR-URL: #65093 Reviewed-By: Antoine du Hamel <[email protected]>
Notable changes: crypto: * update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495 * (SEMVER-MINOR) support loading private keys through STORE loaders (Filip Skokan) #63949 deps: * update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542 * update Undici to 7.29.1 (Node.js GitHub Bot) #65789 lib,src: * (SEMVER-MINOR) improve histogram implementation (James M Snell) #65024 net: * (SEMVER-MINOR) improve performance of `net.BlockList` (James M Snell) #64974 perf_hooks: * (SEMVER-MINOR) add statistical hypothesis testing to histogram (James M Snell) #65416 util: * (SEMVER-MINOR) add non-throwing `MIMEType.parse` (James M Snell) #64965 PR-URL: #65873
aduh95
force-pushed
the
v24.21.0-proposal
branch
from
September 7, 2026 09:58
a76b285 to
955266b
Compare
aduh95
marked this pull request as ready for review
September 7, 2026 10:00
aduh95
approved these changes
Sep 7, 2026
Collaborator
|
CI: https://ci.nodejs.org/job/node-test-pull-request/77131/ |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## v24.x #65873 +/- ##
==========================================
+ Coverage 90.25% 90.33% +0.07%
==========================================
Files 712 714 +2
Lines 228693 231862 +3169
Branches 43213 43952 +739
==========================================
+ Hits 206405 209446 +3041
- Misses 14146 14150 +4
- Partials 8142 8266 +124 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
895f095e2d] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #639497744477388] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #655426917d076dc] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #657890529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #6502441c7062b81] - (SEMVER-MINOR) net: improve performance ofnet.BlockList(James M Snell) #64974b9d7a501ca] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #6541635c635b032] - (SEMVER-MINOR) util: add non-throwingMIMEType.parse(James M Snell) #64965Commits
84d706cb9b] - assert: improve documentation wording (Kamal Rawal) #64953d47f1b0e80] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416e609cde06e] - benchmark: add test-only and mock timers cases (Luan Muniz) #640971d8f045914] - benchmark: applyhighWaterMarkin webstreamspipe-to(Matteo Collina) #65138ed7ba3c993] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218c8837e1aa3] - benchmark: add test runner hooks and options (Luan Muniz) #637547e7e7c131b] - buffer: prevent string write offset overflow (Matteo Collina) #65043cc9ee6c2ae] - buffer: treat detached ArrayBuffers as empty (Archkon) #645045a5d73e4c5] - build: pass target architecture to small-icu genccode (ulofiai) #65095273e72d1a5] - build: deprecate always enabled--enable-static(Chengzhong Wu) #6510389a67246e3] - build: check FIPS option value in node.gyp (Filip Skokan) #649822d21f41cd5] - build: handle malformed OpenSSL macros (Filip Skokan) #649822b11b95a07] - build,win: add PGO workload scripts (Stefan Stojanovic) #6369631b5f6c39b] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #64510895f095e2d] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495a42aafb004] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #652008029383f3f] - crypto: use available BoringSSL APIs (Filip Skokan) #65423a9bd780e19] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #654237defefad3f] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #651156ed1e38627] - crypto: fix disabling FIPS mode (Filip Skokan) #64982afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #639499b9dd6e9cf] - debugger: wait for target startup (Filip Skokan) #651948d9a0a0fcb] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #656536917d076dc] - deps: update undici to 7.29.1 (Node.js GitHub Bot) #6578904f02d1980] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #655427744477388] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542ee8d54e08b] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #653165e610e6ec9] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #653183e58e48ea8] - deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) #65317670b3665c0] - deps: cherry-pick libuv/libuv@e640dc9 (ulofiai) #65118ca1c67b021] - deps: float ICU-23262 patch for icu78 (René) #646784ad043b0aa] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #6513696b4af109b] - deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) #6515304dfefe77f] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #62602755c2cf18e] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #6531302560d4afc] - dns: validate address type in lookupService (Lazizbek Ergashev) #6487815f95fc0e2] - dns: validate port range insetServers()(René) #6502137b9e9a154] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #6500993f99d11cf] - doc: update AHAFS reference link (Taeuk Ha) #65481d35d1a38b3] - doc: fix property names in os.networkInterfaces() example (Jihwan) #65469c51b60282f] - doc: fix broken links in cli.md (Donghoon Kang) #65412603ec1271b] - doc: remove outdated WASI version fallback (이혜미) #653035de6694fee] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #654136c3b6b98bd] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) #64949c8a54130ee] - doc: fix broken TLS security level example (soreavis) #653911f790cb00e] - doc: clarify socket destroyed behavior (Dayun) #6539514b4a167ef] - doc: update outdated nodejs.org guide links (Donghoon Kang) #65394bebd809323] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) #6211764cd3a6e95] - doc: clarify how fs.Dirent file types are determined (soreavis) #645329b92fdce14] - doc: update security release prepare command (Rafael Gonzaga) #646996f9b9df3c1] - doc: clarify copyFile symlink behavior (T) #629412480acb550] - doc: document setRawMode write access on Windows (Erik Demaine) #63856a1e9c3a5db] - doc: add missing return types in fs.md (Chaseton Collins) #653074533572040] - doc: add missing return types in buffer.md (Yuya Inoue) #6530839ecedbbd2] - doc: fix lint clean command (greenhead) #652740b1fb8fcd8] - doc: fix typo in onboarding.md (서울민트초코) #652953165b5d38a] - doc: add missingadded:tags tofs.lchmod(Lazizbek Ergashev) #65283113b808e59] - doc: fix SQLite changeset constant descriptions (greenhead) #65265c3eb51d5a1] - doc: document open pull request limit (Matteo Collina) #65250d7accdcd52] - doc: document http2 header constants (Harjoth Khara) #64548f47111416f] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) #62105c3b120e737] - doc: update synopsis (Augustin Mauroy) #6517139f4c831fd] - doc: fix broken internal links (greenhead) #64901be25cdd69e] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) #648311bf7737810] - doc: fix permission documentation examples (greenhead) #64897b7932e68a1] - doc: document sqlite parameter binding (Guilherme Araújo) #650895234a5169c] - doc: finalize statements in sqlite examples (Guilherme Araújo) #6508839ea929da7] - doc: document quic stopSending() and resetStream() (Issac) #648882ba198db73] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) #62009314f9b200f] - doc: remove usage ofutil.inherits(Augustin Mauroy) #60817d82a61662c] - doc: fix grammar in worker_threads.md (이혜미) #6491344c0c8ff5b] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) #649829b2ca70e0d] - doc: remove--expose-gcflag from CLI documentation (Dario Piotrowicz) #58909a0a12397b9] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) #64976b48699e077] - doc: correct default highWaterMark values (Yilong Li) #6461733b7c75ab4] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) #61951cd84d55c81] - esm: only register text format when enabled (Efe Karasakal) #64992c0a8ef611e] - esm: fix wasm import name in error message (이혜미) #649505d373adc52] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) #644733a7a7663cc] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) #64473e374abd382] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) #65328f45e19925c] - fs: fix realpath of namespaced drive paths (Jason Zhang) #6537813b725ca1f] - fs: fix glob early return skipping sibling entries (Srinu desetti) #64895e5ed96a260] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) #62654e722b7eb94] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) #638869acf1ec173] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) #64770d63087dcb7] - fs: treatstd::errc::permission_deniedasEPERMerror (Kirill Saied) #64698212fe77e76] - fs: add windowsHandle option to file streams (Kirill Saied) #63851fa4600848a] - http: improve performance with known-length calls to end() (Tim Perry) #65466141649f6bd] - http: cache maxHeaderPairs per header section (GetThatCookie) #6498804785c8f43] - http: fix keylog listener setup on existing agent sockets (Shani Singh) #650664b90031534] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) #64991b508a2031e] - http2: adapt receive deferral for Node.js 24 (Matteo Collina) #65093f43bed0ecc] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166b42d664321] - inspector: avoid calling into JS from V8 interrupts (Joyee Cheung) #65028bbd0dc410f] - lib: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) #61500151ca7e104] - lib: harden webidl dictionary member reads (Filip Skokan) #651157e8c2c9f44] - lib: use validateArray for array arguments (greenhead) #64959424fe2bc5a] - lib: add and test [EnforceRange] in webcrypto dictionaries (Filip Skokan) #650910529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024996ecbd5d1] - meta: move targos to emeritus (Michaël Zasso) #65393b41b07c72a] - meta: add unified http api initiative (James M Snell) #65139f85b6ecd67] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #651828f3d01bdce] - meta: add Aviv Keller to.mailmap(Aviv Keller) #65048cfad1d5b28] - meta: update sccache to 0.17.0 (René) #64985ba80f7b35b] - module: report unreadable package.json (Paul Bouchon) #652233157302095] - module: cache nearest parent package.json per directory (Shelley Vohr) #65326961bd04370] - module: fix --check on ambiguous ESM files (Paul Bouchon) #6520305cc430398] - net: handle undefined parent in _unrefTimer and _destroy (Shivay-98) #6464441c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974b9d7a501ca] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #654162cfc441402] - permission: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) #65432dff2b675db] - process: validate resource stats array offsets (Archkon) #650980c4b817c01] - quic: changes for nghttp3_conn_close_stream2 (Marten Richter) #64574eade9c7f1e] - quic: mark drain promise handled (James M Snell) #653193e89a5e9f7] - quic: reset rejected HTTP/3 request streams with H3_REQUEST_REJECTED (trivenay) #654425187ea33aa] - quic: write desired size needs update on maxstream (Marten Richter) #6476808168b7ffe] - quic: do not destroy incoming streams that have a consumer (trivenay) #65335ddc41c1ef4] - quic: fix wake up blob (Marten Richter) #6404488bee43d7c] - quic: convert incoming :status header to number (Hallison Pereira Melo) #63589cd776fe97c] - quic: fix infinite loop if STOP_SENDING received on a buffering stream (Tim Perry) #647156d195560f0] - repl: keep entries added while history file is loading (Mhayk Whandson) #64513cd1e6ce29b] - repl: add benchmarks (Aviv Keller) #645902ba740669d] - sea: avoid dangling CLI option pointers (Archkon) #64755ec5e2d6856] - sea: handle NUL bytes in asset keys (Archkon) #64773703b854293] - sea: reject trailing content in config JSON (Archkon) #647740a6f2eeade] - sqlite: prevent reentrant session.close() (Trivikram Kamat) #653496ae81be0a3] - sqlite: reject statement-less SQL in prepare() (Trevor Burnham) #65157043dfe4996] - sqlite: reject statement-less SQL in SQLTagStore (Trevor Burnham) #65157b8faee02e1] - sqlite: check null returns from sqlite value functions (Nora Dossche) #63288d6d2a71bee] - sqlite: validate maxSize argument in createTagStore() (Anshika Jain) #6379261a046309f] - sqlite: reject non-positive backup rates (Trivikram Kamat) #64893514e3f30fb] - sqlite: clear SQLTagStore bindings (Matteo Collina) #65041c1542255b8] - sqlite: bind Boolean (mike-git374) #62001cdb732beb5] - sqlite: fix undefined behaviour inSession::Changeset()(Nora Dossche) #63637fbe8861111] - sqlite: bind ArrayBuffer (mike-git374) #62061e000e4cf07] - src: add missing vector include (Filip Skokan) #656221377b3d77f] - src: fix heap value deduplication in embedder graph (Ilyas Shabi) #648016cfc169940] - src: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) #6451222e5023f4d] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217a0f3c62bd9] - src: simplify c++ diagnostics channel API (James M Snell) #651588e831a3d2e] - src: make minor cleanup to permission checks (James M Snell) #65158968b2ca3a3] - src: use DictionaryTemplate for permission diag channel message (James M Snell) #6515818e16e7f8d] - src: cache permission strings (James M Snell) #65158c8625a4b6f] - src: add SetAbortHandler (Max H Fisher) #64684c990140d60] - src: match cmd.exe case-insensitively in task runner (Archkon) #64907d7463b9dbc] - src: reuse cached env strings in remaining files (Seongeun Lee) #65039b055a43b93] - src: expose Windows-only fs open flags (Kirill Saied) #647757f21e37496] - src: report why --enable-fips failed (Filip Skokan) #649798c11beae27] - src: update repeated use strings to env (James M Snell) #64760113019d870] - stream: normalize fused stateless transform results (Trivikram Kamat) #6536790f41b5cf7] - stream: encode whole chunks in TextEncoderStream (Matteo Collina) #65414efdf0c215e] - stream: prevent share from eagerly draining source (Trivikram Kamat) #65338feb0d5773b] - stream: drain pending writes before broadcast end (Trivikram Kamat) #65334e2b522bd75] - stream: reuse unexposed managed read buffers (GetThatCookie) #64990e3a06df06a] - stream: avoid duplicated endReadableNT scheduling (Matteo Collina) #653106a3ec8d0ae] - stream: decouple transform backpressure changes (Matteo Collina) #651436dc4207804] - stream: reject pull on signal abort during flush (Trivikram Kamat) #65346386ed6a06d] - stream: avoid leaking consumers on signal failure (Trivikram Kamat) #6529974d53bd73b] - stream: use validateObject for zlib/iter params (greenhead) #650153a174ce16b] - stream: use validateNumber for BYOB reader options.min (greenhead) #65014859ea01cb2] - stream: consolidate non-op algorithm callbacks (Matteo Collina) #65138c577669825] - stream: cut promise churn in webstreams hot paths (Matteo Collina) #65138d631e910db] - stream: preserve falsy cancellation reasons (Trivikram Kamat) #64705f9c21eabbd] - stream: use validateBuffer for BYOB reader view (greenhead) #65046b89c8f5d1e] - stream: fix recursive WritableStream abort (Jeong SeokChan) #648250b02b1da1a] - string_decoder: decode UTF-8 via StringBytes::Encode (Shelley Vohr) #653246da9337da5] - test: fix link-local dgram scope assertion (Filip Skokan) #656290563f93c57] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542515b5c5621] - test: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) #65279b3b1a9dfd9] - test: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) #65351416051791c] - test: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) #6542401c126316e] - test: simplify test-timers-interval-promisified.js (Donghoon Kang) #653224494922d24] - test: add Headers coverage and benchmark (Yagiz Nizipli) #653657935ae01ea] - test: deflake test-net-listen-ipv6only (sangwook) #641736f279fb2c6] - test: use common/child_process spawnSync helpers (Junsoo Ha) #653773eea70d1f2] - test: fix Linux debug skip in SEA test guard (구현우) #63751fe0e4f1b65] - test: avoid timer race in event loop delay test (Trivikram Kamat) #647286ff69baea8] - test: enforce exit code intest-http-server-stale-close(Antoine du Hamel) #65198ba87603016] - test: convert test-async-local-storage-bind to async loop (freida-code) #652708d6b89f454] - test: replaceforEach()withfor...ofin parallel tests (Phillip Markert) #65272a60572a7bb] - test: convert forEach to for in test-constant.js file (NIxxy25) #65271f82060c6ce] - test: use for-of instead of forEach (Felix P.) #652685ded71f9cc] - test: coverrealpathSyncresolving symlinks after a FIFO stat (Hendrik Liebau) #65113ac9835225e] - test: account for [EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) #65173550d24277e] - test: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) #651502aa26559f0] - test: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) #65151d45c010108] - test: fix hidden error in test-http-server-stale-close.js (Meghan Denny) #59357881f8d092d] - test: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) #65079e4b1e3ee75] - test: allow half-open CONNECT tunnel sockets (Trivikram Kamat) #6497300f4240d48] - test: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) #65077cf7680efb7] - test: use libuv clock for immediate queue test (Trivikram Kamat) #64889b0c12772ff] - test: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) #647197e279104b4] - test: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) #64977ac11f88d16] - test,doc: cover and document multi-byte offset/size in randomFill (kyungrae2002) #6483454c9f0c353] - test_runner: match dotfiles in default coverage exclude (semimikoh) #634012df16811e2] - test_runner: print coverage and diagnostic info with dot reporter (mag123c) #61423be3c8fdb97] - test_runner: use run options with isolation="none" (Sylvester Keil) #622696f91d0916e] - test_runner: mock dual-package with conditional exports (Maruthan G) #6294303ae9ef6bb] - test_runner: add classname hierarchy for JUnit reporter (mag123c) #6022002d44f2ede] - test_runner: fix junit report on empty diagnostic (Lazizbek Ergashev) #65357d01dda79b6] - test_runner: do not tag-filter test file wrappers (Chemi Atlow) #6517032ead10ddd] - test_runner: fix env option validation (Jihwan) #64865cd136aaff9] - tls: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) #65076dcf65c50ce] - tls: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) #6467712fda8f6b8] - tools: improve commit queue failure comment (Filip Skokan) #654333c192c3407] - tools: fix max body length handler increate-release-proposal.sh(Antoine du Hamel) #65455450e4a943d] - tools: bump brace-expansion in/tools/clang-format(dependabot[bot]) #64984bfc0593cc0] - tools: make env variables consistent in cron jobs (Antoine du Hamel) #65168ac8a68ec92] - tools: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) #651976d9999fa2e] - tools: remove skip logic incommit-queue.sh(Antoine du Hamel) #6516260bfa1694e] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot[bot]) #65129782748527e] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot[bot]) #65130dac257340f] - tools: fix GITHUB_TOKEN permissions for CQ workflow (Antoine du Hamel) #65192e624785846] - tools: use the read-only token when filtering PRs in CQ (Antoine du Hamel) #651697d9dcfaaa7] - tools: delay removal ofcommit-queuelabel (Antoine du Hamel) #651010d7c7936e7] - tools: move ncu config to global for commit queue (Filip Skokan) #651325e1db5a38a] - tools: prefilter commit queue metadata (Filip Skokan) #64343f41509b91d] - tools: lazy-abort failed PR merges in CQ (Antoine du Hamel) #65004ceb0e99acd] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753079afe8ee8] - tty: add raw-vt and io raw modes (Samuel Williams) #64140a40bfc742e] - typings: add signal_wrap internal binding types (Seongeun Lee) #65229b103a4a3b9] - typings: add diagnostics_channel typings (Seongeun Lee) #65227e64de34b89] - typings: add watchdog internal binding types (Seongeun Lee) #65228c57c83b4d1] - typings: add internal_only_v8 binding typeis (Donghoon Kang) #65071f15e8c9dcd] - typings: add credentials internal binding types (Donghoon Kang) #650363f7d916f77] - url: skip unused href reuse comparison (Yagiz Nizipli) #65361c99a2a9a35] - url: speed up WHATWG URL parsing (Yagiz Nizipli) #65361afe2b71831] - url: speed up URLSearchParams (Yagiz Nizipli) #653638e2461d819] - url: bounds-check short Windows file URL paths (Archkon) #647889ffc0da90c] - url: handle unparsable serialized URLs in setters (Matteo Collina) #646518077540ba0] - util: allow single-line format when break length is infinite (Hamid Reza Ghavami) #64238f3db8db7c6] - util: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) #6431910e2603927] - util: fix formatting of functions returned from getters (Richard Gibson) #6483964c20b449e] - util: use more primordials incomparisons.js(Ayoub Mabrouk) #61198cea9786de8] - util: preserve function names without source map names (Hiroki Osame) #6510835c635b032] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #649655858c2ba9a] - zlib: validate pledgedSrcSize for sync zstd (Archkon) #64601