Skip to content

quic: copy options buffer instead of detaching - #61403

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
legendecas:quic-certs
Jan 22, 2026
Merged

quic: copy options buffer instead of detaching#61403
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
legendecas:quic-certs

Conversation

@legendecas

@legendecas legendecas commented Jan 16, 2026

Copy link
Copy Markdown
Member

The certs could be allocated in a pooled buffer, like Buffer.from, and
Buffer.allocUnsafe (used by fs.readFileSync, etc).

Refs: #61372

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jan 16, 2026
@legendecas legendecas mentioned this pull request Jan 16, 2026
Closed
@legendecas legendecas added the quic Issues and PRs related to the QUIC implementation / HTTP/3. label Jan 16, 2026
Renegade334
Renegade334 reviewed Jan 16, 2026
View reviewed changes

@Renegade334 Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was going to suggest a similar approach.

The commit message should probably reflect that this applies to all buffer-based quic options, not just SessionOptions#certs.

Comment thread src/quic/data.cc Outdated
Comment thread test/parallel/test-quic-internal-endpoint-listen-defaults.mjs Outdated
@legendecas
legendecas force-pushed the quic-certs branch 2 times, most recently from da77e1e to b8f90b8 Compare January 16, 2026 21:27
@legendecas legendecas changed the title quic: copy options.certs buffer instead of detaching quic: copy optionsbuffer instead of detaching Jan 16, 2026
@legendecas legendecas changed the title quic: copy optionsbuffer instead of detaching quic: copy options buffer instead of detaching Jan 16, 2026
@legendecas
quic: copy options.certs buffer instead of detaching
7a9130c 
The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).
@codecov

codecov Bot commented Jan 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 50.00000% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.51%. Comparing base (e3071d5) to head (7a9130c).
⚠️ Report is 54 commits behind head on main.

Files with missing lines Patch % Lines
src/quic/data.cc 52.63% 9 Missing ⚠️
src/quic/tlscontext.cc 25.00% 3 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #61403      +/-   ##
==========================================
- Coverage   88.53%   88.51%   -0.02%     
==========================================
  Files         704      704              
  Lines      208797   208806       +9     
  Branches    40316    40308       -8     
==========================================
- Hits       184857   184834      -23     
- Misses      15923    15971      +48     
+ Partials     8017     8001      -16
Files with missing lines Coverage Δ
src/quic/data.h 36.36% <ø> (-27.28%) ⬇️
src/quic/endpoint.cc 56.64% <100.00%> (+0.12%) ⬆️
src/quic/tlscontext.cc 37.47% <25.00%> (+0.62%) ⬆️
src/quic/data.cc 52.08% <52.63%> (-2.67%) ⬇️

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@legendecas legendecas added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 18, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 18, 2026
@nodejs-github-bot

nodejs-github-bot commented Jan 18, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/70871/

@nodejs-github-bot

nodejs-github-bot commented Jan 18, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/70877/

@nodejs-github-bot

nodejs-github-bot commented Jan 19, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/70898/

@avivkeller avivkeller added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jan 19, 2026
addaleax
addaleax approved these changes Jan 21, 2026
View reviewed changes
Comment thread src/quic/data.cc
auto length = view->ByteLength();
auto offset = view->ByteOffset();
auto dest = ArrayBuffer::NewBackingStore(
isolate, length, v8::BackingStoreInitializationMode::kUninitialized);

@addaleax addaleax Jan 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice if we could handle allocation failures in these calls too

@legendecas legendecas Jan 22, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right. I think we can use BackingStoreOnFailureMode to gracefully handle the failure. Given that there are many ArrayBuffer::NewBackingStore call sites in the codebase, I could file a follow-up to bulk update.

@legendecas legendecas added the commit-queue Add this label to land a pull request using GitHub Actions. label Jan 22, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Jan 22, 2026
@nodejs-github-bot

nodejs-github-bot commented Jan 22, 2026

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/61403
✔  Done loading data for nodejs/node/pull/61403
----------------------------------- PR info ------------------------------------
Title      quic: copy options buffer instead of detaching (#61403)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     legendecas:quic-certs -> nodejs:main
Labels     c++, lib / src, author ready, needs-ci, quic
Commits    1
 - quic: copy options.certs buffer instead of detaching
Committers 1
 - Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/61403
Refs: https://github.com/nodejs/node/pull/61372
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/61403
Refs: https://github.com/nodejs/node/pull/61372
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 16 Jan 2026 20:26:08 GMT
   ✔  Approvals: 2
   ✔  - Colin Ihrig (@cjihrig): https://github.com/nodejs/node/pull/61403#pullrequestreview-3674325947
   ✔  - Anna Henningsen (@addaleax): https://github.com/nodejs/node/pull/61403#pullrequestreview-3687646808
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-01-19T23:08:55Z: https://ci.nodejs.org/job/node-test-pull-request/70898/
- Querying data for job/node-test-pull-request/70898/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
remote: Internal Server Error
fatal: unable to access 'https://github.com/nodejs/node/': The requested URL returned error: 500
https://github.com/nodejs/node/actions/runs/21252560285

@legendecas legendecas added commit-queue Add this label to land a pull request using GitHub Actions. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels Jan 22, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jan 22, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 41c6256 into nodejs:main Jan 22, 2026
78 of 79 checks passed
@nodejs-github-bot

nodejs-github-bot commented Jan 22, 2026

Copy link
Copy Markdown
Collaborator

Landed in 41c6256

@legendecas
legendecas deleted the quic-certs branch January 22, 2026 14:56
@legendecas legendecas mentioned this pull request Jan 22, 2026
Merged
aduh95 pushed a commit that referenced this pull request Jan 24, 2026
@legendecas @aduh95
quic: copy options.certs buffer instead of detaching
62d71eb 
The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: #61403
Refs: #61372
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@github-actions github-actions Bot mentioned this pull request Jan 25, 2026
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jan 27, 2026
ECG Bot @tmeijn
build(deps): update node to v25.5.0
fff2390 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `25.4.0` → `25.5.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v25.5.0`](https://github.com/nodejs/node/releases/tag/v25.5.0): 2026-01-26, Version 25.5.0 (Current), @&#8203;aduh95

[Compare Source](nodejs/node@v25.4.0...v25.5.0)

##### Notable Changes

- \[[`99a4e51f93`](nodejs/node@99a4e51f93)] - **crypto**: update root certificates to NSS 3.119 (Node.js GitHub Bot) [#&#8203;61419](nodejs/node#61419)
- \[[`fbe4da5725`](nodejs/node@fbe4da5725)] - **(SEMVER-MINOR)** **deps**: add LIEF as a dependency (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`0feab0f083`](nodejs/node@0feab0f083)] - **(SEMVER-MINOR)** **deps**: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`e91b296001`](nodejs/node@e91b296001)] - **(SEMVER-MINOR)** **fs**: add ignore option to fs.watch (Matteo Collina) [#&#8203;61433](nodejs/node#61433)
- \[[`b351910af1`](nodejs/node@b351910af1)] - **(SEMVER-MINOR)** **sea**: add `--build-sea` to generate SEA directly with Node.js binary (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`957292e233`](nodejs/node@957292e233)] - **(SEMVER-MINOR)** **sea**: split sea binary manipulation code (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`f289817ff8`](nodejs/node@f289817ff8)] - **(SEMVER-MINOR)** **sqlite**: enable defensive mode by default (Bart Louwers) [#&#8203;61266](nodejs/node#61266)
- \[[`069f3603e2`](nodejs/node@069f3603e2)] - **(SEMVER-MINOR)** **sqlite**: add sqlite prepare options args (Guilherme Araújo) [#&#8203;61311](nodejs/node#61311)
- \[[`5a984b9a09`](nodejs/node@5a984b9a09)] - **src**: use node- prefix on thread names (Stewart X Addison) [#&#8203;61307](nodejs/node#61307)
- \[[`75c06bc2a8`](nodejs/node@75c06bc2a8)] - **(SEMVER-MINOR)** **test**: migrate to `--build-sea` in existing SEA tests (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`cabd58f1cb`](nodejs/node@cabd58f1cb)] - **(SEMVER-MINOR)** **test**: use fixture directories for sea tests (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`ff1fcabfc9`](nodejs/node@ff1fcabfc9)] - **(SEMVER-MINOR)** **test\_runner**: support expecting a test-case to fail (Jacob Smith) [#&#8203;60669](nodejs/node#60669)

##### Commits

- \[[`778a56f3c9`](nodejs/node@778a56f3c9)] - **assert,util**: fix deep comparison for sets and maps with mixed types (Ruben Bridgewater) [#&#8203;61388](nodejs/node#61388)
- \[[`32cd18e37f`](nodejs/node@32cd18e37f)] - **async\_hooks**: enabledHooksExist shall return if hooks are enabled (Gerhard Stöbich) [#&#8203;61054](nodejs/node#61054)
- \[[`482b2568bc`](nodejs/node@482b2568bc)] - **benchmark**: add SQLite benchmarks (Guilherme Araújo) [#&#8203;61401](nodejs/node#61401)
- \[[`e9a34263bb`](nodejs/node@e9a34263bb)] - **buffer**: make methods work on Uint8Array instances (Neal Beeken) [#&#8203;56578](nodejs/node#56578)
- \[[`8255cdefcf`](nodejs/node@8255cdefcf)] - **build**: add `--shared-nbytes` configure flag (Antoine du Hamel) [#&#8203;61341](nodejs/node#61341)
- \[[`8dd379d110`](nodejs/node@8dd379d110)] - **build**: update android-patches/trap-handler.h.patch (Mo Luo) [#&#8203;60369](nodejs/node#60369)
- \[[`1b4b5eb0e4`](nodejs/node@1b4b5eb0e4)] - **build**: update devcontainer.json to use paired nix env (Joyee Cheung) [#&#8203;61414](nodejs/node#61414)
- \[[`86e2a763ad`](nodejs/node@86e2a763ad)] - **build**: infer cargo mode with gyp var build\_type directly (Chengzhong Wu) [#&#8203;61354](nodejs/node#61354)
- \[[`7e211e6942`](nodejs/node@7e211e6942)] - **build**: add embedtest into native suite (Joyee Cheung) [#&#8203;61357](nodejs/node#61357)
- \[[`637470e79f`](nodejs/node@637470e79f)] - **build**: fix misplaced comma in ldflags (hqzing) [#&#8203;61294](nodejs/node#61294)
- \[[`a1a0f77a45`](nodejs/node@a1a0f77a45)] - **build**: fix crate vendor file checksums on windows (Chengzhong Wu) [#&#8203;61329](nodejs/node#61329)
- \[[`d597b8e342`](nodejs/node@d597b8e342)] - **build,tools**: fix addon build deadlock on errors (Vladimir Morozov) [#&#8203;61321](nodejs/node#61321)
- \[[`b5cdc27ba4`](nodejs/node@b5cdc27ba4)] - **build,win**: improve logs when ClangCL is missing (Mike McCready) [#&#8203;61438](nodejs/node#61438)
- \[[`ef01f0c033`](nodejs/node@ef01f0c033)] - **build,win**: update WinGet configurations to Python 3.14 (Mike McCready) [#&#8203;61431](nodejs/node#61431)
- \[[`d8a1cdeefe`](nodejs/node@d8a1cdeefe)] - **child\_process**: treat ipc length header as unsigned uint32 (Ryuhei Shima) [#&#8203;61344](nodejs/node#61344)
- \[[`588b00fafa`](nodejs/node@588b00fafa)] - **cluster**: fix port reuse between cluster (Ryuhei Shima) [#&#8203;60141](nodejs/node#60141)
- \[[`99a4e51f93`](nodejs/node@99a4e51f93)] - **crypto**: update root certificates to NSS 3.119 (Node.js GitHub Bot) [#&#8203;61419](nodejs/node#61419)
- \[[`048f7a5c9c`](nodejs/node@048f7a5c9c)] - **deps**: upgrade npm to 11.8.0 (npm team) [#&#8203;61466](nodejs/node#61466)
- \[[`fbe4da5725`](nodejs/node@fbe4da5725)] - **(SEMVER-MINOR)** **deps**: add LIEF as a dependency (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`0feab0f083`](nodejs/node@0feab0f083)] - **(SEMVER-MINOR)** **deps**: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`4bb00d7e3c`](nodejs/node@4bb00d7e3c)] - **deps**: update googletest to [`8508785`](nodejs/node@8508785) (Node.js GitHub Bot) [#&#8203;61417](nodejs/node#61417)
- \[[`6a3c614f27`](nodejs/node@6a3c614f27)] - **deps**: update sqlite to 3.51.2 (Node.js GitHub Bot) [#&#8203;61339](nodejs/node#61339)
- \[[`13c0397d6d`](nodejs/node@13c0397d6d)] - **deps**: update icu to 78.2 (Node.js GitHub Bot) [#&#8203;60523](nodejs/node#60523)
- \[[`098ec6f196`](nodejs/node@098ec6f196)] - **deps**: update ada to v3.4.0 (Yagiz Nizipli) [#&#8203;61315](nodejs/node#61315)
- \[[`320b576125`](nodejs/node@320b576125)] - **deps**: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) [#&#8203;61135](nodejs/node#61135)
- \[[`98f5e7cf51`](nodejs/node@98f5e7cf51)] - **deps**: V8: cherry-pick [highway@`dcc0ca1`](https://github.com/highway/node/commit/dcc0ca1cd42) (Richard Lau) [#&#8203;61008](nodejs/node#61008)
- \[[`e326df79c9`](nodejs/node@e326df79c9)] - **deps**: V8: backport [`209d2db`](nodejs/node@209d2db9e24a) (Zhijin Zeng) [#&#8203;61322](nodejs/node#61322)
- \[[`ccfd9d9b30`](nodejs/node@ccfd9d9b30)] - **doc**: remove `v` prefix for version references (Mike McCready) [#&#8203;61488](nodejs/node#61488)
- \[[`b6cc5d77a1`](nodejs/node@b6cc5d77a1)] - **doc**: mention constructor comparison in assert.deepStrictEqual (Hamza Kargin) [#&#8203;60253](nodejs/node#60253)
- \[[`236d7ee635`](nodejs/node@236d7ee635)] - **doc**: add CVE delay mention (Rafael Gonzaga) [#&#8203;61465](nodejs/node#61465)
- \[[`0729fb6ee7`](nodejs/node@0729fb6ee7)] - **doc**: update previous version links in BUILDING (Mike McCready) [#&#8203;61457](nodejs/node#61457)
- \[[`0fb464252f`](nodejs/node@0fb464252f)] - **doc**: include OpenJSF handle for security stewards (Rafael Gonzaga) [#&#8203;61454](nodejs/node#61454)
- \[[`3331bdca7c`](nodejs/node@3331bdca7c)] - **doc**: clarify process.argv\[1] behavior for -e/--eval (Jeevankumar S) [#&#8203;61366](nodejs/node#61366)
- \[[`94b34c38e2`](nodejs/node@94b34c38e2)] - **doc**: remove Windows Dev Home instructions from BUILDING (Mike McCready) [#&#8203;61434](nodejs/node#61434)
- \[[`a17016ee81`](nodejs/node@a17016ee81)] - **doc**: clarify TypedArray properties on Buffer (Roman Reiss) [#&#8203;61355](nodejs/node#61355)
- \[[`214fac9d7e`](nodejs/node@214fac9d7e)] - **doc**: update Python 3.14 manual install instructions (Windows) (Mike McCready) [#&#8203;61428](nodejs/node#61428)
- \[[`6a32a685a6`](nodejs/node@6a32a685a6)] - **doc**: note resume build should not be done on node-test-commit (Stewart X Addison) [#&#8203;61373](nodejs/node#61373)
- \[[`2a8e8dfaf3`](nodejs/node@2a8e8dfaf3)] - **doc**: refine WebAssembly error documentation (sangwook) [#&#8203;61382](nodejs/node#61382)
- \[[`f3caf27f8b`](nodejs/node@f3caf27f8b)] - **doc**: add deprecation history for url.parse (Eng Zer Jun) [#&#8203;61389](nodejs/node#61389)
- \[[`5ab8057856`](nodejs/node@5ab8057856)] - **doc**: add marco and rafael in last sec release (Marco Ippolito) [#&#8203;61383](nodejs/node#61383)
- \[[`f83cb1e785`](nodejs/node@f83cb1e785)] - **doc**: packages: example of private import switch to internal (coderaiser) [#&#8203;61343](nodejs/node#61343)
- \[[`3d23bcd0e2`](nodejs/node@3d23bcd0e2)] - **doc**: add esm and cjs examples to node:v8 (Alfredo González) [#&#8203;61328](nodejs/node#61328)
- \[[`1d159550e0`](nodejs/node@1d159550e0)] - **doc**: added 'secure' event to tls.TLSSocket (ikeyan) [#&#8203;61066](nodejs/node#61066)
- \[[`90080d2892`](nodejs/node@90080d2892)] - **doc**: restore [@&#8203;watilde](https://github.com/watilde) to collaborators (Daijiro Wachi) [#&#8203;61350](nodejs/node#61350)
- \[[`a87f7a50f8`](nodejs/node@a87f7a50f8)] - **doc**: run license-builder (github-actions\[bot]) [#&#8203;61348](nodejs/node#61348)
- \[[`adf5c84701`](nodejs/node@adf5c84701)] - **doc**: clean up writing-and-running-benchmarks.md (Hardanish Singh) [#&#8203;61345](nodejs/node#61345)
- \[[`2be98add0c`](nodejs/node@2be98add0c)] - **doc**: document ALPNCallback option for TLSSocket constructor (ikeyan) [#&#8203;61331](nodejs/node#61331)
- \[[`2db4893c8d`](nodejs/node@2db4893c8d)] - **esm**: ensure watch mode restarts after syntax errors (Xavier Stouder) [#&#8203;61232](nodejs/node#61232)
- \[[`828feb2e6b`](nodejs/node@828feb2e6b)] - **events**: remove redundant todo (Gürgün Dayıoğlu) [#&#8203;60595](nodejs/node#60595)
- \[[`e91b296001`](nodejs/node@e91b296001)] - **(SEMVER-MINOR)** **fs**: add ignore option to fs.watch (Matteo Collina) [#&#8203;61433](nodejs/node#61433)
- \[[`606184fae5`](nodejs/node@606184fae5)] - **fs**: remove duplicate getValidatedPath calls (Mert Can Altin) [#&#8203;61359](nodejs/node#61359)
- \[[`434fcd7f8f`](nodejs/node@434fcd7f8f)] - **fs**: fix errorOnExist behavior for directory copy in fs.cp (Nicholas Paun) [#&#8203;60946](nodejs/node#60946)
- \[[`bacba16f5e`](nodejs/node@bacba16f5e)] - **fs**: fix ENOTDIR in globSync when file is treated as dir (sangwook) [#&#8203;61259](nodejs/node#61259)
- \[[`7697ce0310`](nodejs/node@7697ce0310)] - **fs**: remove duplicate fd validation in sync functions (Mert Can Altin) [#&#8203;61361](nodejs/node#61361)
- \[[`8abd54f597`](nodejs/node@8abd54f597)] - **gyp**: aix: change gcc version detection so CXX="ccache g++" works (Stewart X Addison) [#&#8203;61464](nodejs/node#61464)
- \[[`24033ee7ea`](nodejs/node@24033ee7ea)] - **http**: fix rawHeaders exceeding maxHeadersCount limit (Max Harari) [#&#8203;61285](nodejs/node#61285)
- \[[`cf56327939`](nodejs/node@cf56327939)] - **http2**: validate initialWindowSize per HTTP/2 spec (Matteo Collina) [#&#8203;61402](nodejs/node#61402)
- \[[`696935eeeb`](nodejs/node@696935eeeb)] - **inspector**: initial support storage inspection (Ryuhei Shima) [#&#8203;61139](nodejs/node#61139)
- \[[`3d5e718e38`](nodejs/node@3d5e718e38)] - **lib**: fix typo in `util.js` comment (Taejin Kim) [#&#8203;61365](nodejs/node#61365)
- \[[`f55a5fea00`](nodejs/node@f55a5fea00)] - **lib**: fix TypeScript support check in jitless mode (sangwook) [#&#8203;61382](nodejs/node#61382)
- \[[`b3fbc3c375`](nodejs/node@b3fbc3c375)] - **meta**: do not fast-track npm updates (Antoine du Hamel) [#&#8203;61475](nodejs/node#61475)
- \[[`2423ecdaef`](nodejs/node@2423ecdaef)] - **meta**: fix typos in issue template config (Daijiro Wachi) [#&#8203;61399](nodejs/node#61399)
- \[[`e2df85a33a`](nodejs/node@e2df85a33a)] - **meta**: label v8 module MRs (René) [#&#8203;61325](nodejs/node#61325)
- \[[`bc9e5f7d4d`](nodejs/node@bc9e5f7d4d)] - **node-api**: fix node\_api\_create\_object\_with\_properties name (Vladimir Morozov) [#&#8203;61319](nodejs/node#61319)
- \[[`4f30c21c59`](nodejs/node@4f30c21c59)] - **node-api**: use Node-API in comments (Vladimir Morozov) [#&#8203;61320](nodejs/node#61320)
- \[[`62d71eb28d`](nodejs/node@62d71eb28d)] - **quic**: copy options.certs buffer instead of detaching (Chengzhong Wu) [#&#8203;61403](nodejs/node#61403)
- \[[`4bbbe75ba1`](nodejs/node@4bbbe75ba1)] - **quic**: move quic behind compile time flag (Matteo Collina) [#&#8203;61444](nodejs/node#61444)
- \[[`b351910af1`](nodejs/node@b351910af1)] - **(SEMVER-MINOR)** **sea**: add --build-sea to generate SEA directly with Node.js binary (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`957292e233`](nodejs/node@957292e233)] - **(SEMVER-MINOR)** **sea**: split sea binary manipulation code (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`f289817ff8`](nodejs/node@f289817ff8)] - **(SEMVER-MINOR)** **sqlite**: enable defensive mode by default (Bart Louwers) [#&#8203;61266](nodejs/node#61266)
- \[[`6442229880`](nodejs/node@6442229880)] - **sqlite**: add some tests (Guilherme Araújo) [#&#8203;61410](nodejs/node#61410)
- \[[`069f3603e2`](nodejs/node@069f3603e2)] - **(SEMVER-MINOR)** **sqlite**: add sqlite prepare options args (Guilherme Araújo) [#&#8203;61311](nodejs/node#61311)
- \[[`df02d00d61`](nodejs/node@df02d00d61)] - **src**: improve StringBytes::Encode perf on UTF8 (Сковорода Никита Андреевич) [#&#8203;61131](nodejs/node#61131)
- \[[`e35814ba80`](nodejs/node@e35814ba80)] - **src**: add missing override specifier to Clean() (Tobias Nießen) [#&#8203;61429](nodejs/node#61429)
- \[[`803ff7d3de`](nodejs/node@803ff7d3de)] - **src**: cache context lookup in vectored io loops (Mert Can Altin) [#&#8203;61387](nodejs/node#61387)
- \[[`58abe99cbf`](nodejs/node@58abe99cbf)] - **src**: cache missing package.json files in the C++ package config cache (Michael Smith) [#&#8203;60425](nodejs/node#60425)
- \[[`2a542094e4`](nodejs/node@2a542094e4)] - **src**: use starts\_with instead of rfind/find (Tobias Nießen) [#&#8203;61426](nodejs/node#61426)
- \[[`77cacf6d9d`](nodejs/node@77cacf6d9d)] - **src**: use C++ nullptr in sqlite (Tobias Nießen) [#&#8203;61416](nodejs/node#61416)
- \[[`344cc629d4`](nodejs/node@344cc629d4)] - **src**: use C++ nullptr in webstorage (Tobias Nießen) [#&#8203;61407](nodejs/node#61407)
- \[[`9f25cad26c`](nodejs/node@9f25cad26c)] - **src**: fix pointer alignment (jhofstee) [#&#8203;61336](nodejs/node#61336)
- \[[`5a984b9a09`](nodejs/node@5a984b9a09)] - **src**: use node- prefix on thread names (Stewart X Addison) [#&#8203;61307](nodejs/node#61307)
- \[[`d4cf423a65`](nodejs/node@d4cf423a65)] - **stream**: export namespace object from internal end-of-stream module (René) [#&#8203;61455](nodejs/node#61455)
- \[[`7d8232e34c`](nodejs/node@7d8232e34c)] - **test**: add some validation for JSON doc output (Antoine du Hamel) [#&#8203;61413](nodejs/node#61413)
- \[[`75c06bc2a8`](nodejs/node@75c06bc2a8)] - **(SEMVER-MINOR)** **test**: migrate to --build-sea in existing SEA tests (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`cabd58f1cb`](nodejs/node@cabd58f1cb)] - **(SEMVER-MINOR)** **test**: use fixture directories for sea tests (Joyee Cheung) [#&#8203;61167](nodejs/node#61167)
- \[[`bcffca8911`](nodejs/node@bcffca8911)] - **test**: aix: mark test\_threadsafe\_function/test flaky on AIX (Stewart X Addison) [#&#8203;61452](nodejs/node#61452)
- \[[`29399501c1`](nodejs/node@29399501c1)] - **test**: add implicit test for fs dispose handling with using (Ilyas Shabi) [#&#8203;61140](nodejs/node#61140)
- \[[`3bb481571a`](nodejs/node@3bb481571a)] - **test**: reveal wpt evaluation errors in status files (Chengzhong Wu) [#&#8203;61358](nodejs/node#61358)
- \[[`a132be7f71`](nodejs/node@a132be7f71)] - **test**: check new WebCryptoAPI enum values (Filip Skokan) [#&#8203;61406](nodejs/node#61406)
- \[[`72f1463735`](nodejs/node@72f1463735)] - **test**: split test-esm-loader-hooks (Joyee Cheung) [#&#8203;61374](nodejs/node#61374)
- \[[`39105e4c5f`](nodejs/node@39105e4c5f)] - **test**: aix: mark test-emit-on-destroyed as flaky (Stewart X Addison) [#&#8203;61381](nodejs/node#61381)
- \[[`3f17acfb1c`](nodejs/node@3f17acfb1c)] - **test**: add webidl web-platform tests (Yagiz Nizipli) [#&#8203;61316](nodejs/node#61316)
- \[[`89983cf747`](nodejs/node@89983cf747)] - **test**: update url web-platform tests (Yagiz Nizipli) [#&#8203;61315](nodejs/node#61315)
- \[[`73c0a242d7`](nodejs/node@73c0a242d7)] - **test**: forbid use of named imports for fixtures (Antoine du Hamel) [#&#8203;61228](nodejs/node#61228)
- \[[`a49d54308e`](nodejs/node@a49d54308e)] - **test**: enforce better never-settling-promise detection (Antoine du Hamel) [#&#8203;60976](nodejs/node#60976)
- \[[`335cb0b5cc`](nodejs/node@335cb0b5cc)] - **test**: ensure assertions are reached on all tests (Antoine du Hamel) [#&#8203;60845](nodejs/node#60845)
- \[[`5ee02c789a`](nodejs/node@5ee02c789a)] - **test**: ensure assertions are reached on more tests (Antoine du Hamel) [#&#8203;60763](nodejs/node#60763)
- \[[`141fb82ffb`](nodejs/node@141fb82ffb)] - **test**: ensure assertions are reached on more tests (Antoine du Hamel) [#&#8203;60760](nodejs/node#60760)
- \[[`edf90ce457`](nodejs/node@edf90ce457)] - **test**: use `RegExp.escape` to improve test reliability (Antoine du Hamel) [#&#8203;60803](nodejs/node#60803)
- \[[`f5f9b2dcf6`](nodejs/node@f5f9b2dcf6)] - **test**: ensure assertions are reached on more tests (Antoine du Hamel) [#&#8203;60728](nodejs/node#60728)
- \[[`ec1cbbe0b6`](nodejs/node@ec1cbbe0b6)] - **test\_runner**: fix memory leaks in runner (Abhishek Kv. Savani) [#&#8203;60860](nodejs/node#60860)
- \[[`399ac68427`](nodejs/node@399ac68427)] - **test\_runner**: fix coverage report when a directory is named file (Heath Dutton🕴️) [#&#8203;61169](nodejs/node#61169)
- \[[`6e1beda333`](nodejs/node@6e1beda333)] - **test\_runner**: print info when test restarts (Xavier Stouder) [#&#8203;61160](nodejs/node#61160)
- \[[`f5803ccb86`](nodejs/node@f5803ccb86)] - **test\_runner**: fix rerun ambiguous test failures (Moshe Atlow) [#&#8203;61392](nodejs/node#61392)
- \[[`a5a4c3eb44`](nodejs/node@a5a4c3eb44)] - **test\_runner**: nix dead reporter code (Vas Sudanagunta) [#&#8203;59700](nodejs/node#59700)
- \[[`ff1fcabfc9`](nodejs/node@ff1fcabfc9)] - **(SEMVER-MINOR)** **test\_runner**: support expecting a test-case to fail (Jacob Smith) [#&#8203;60669](nodejs/node#60669)
- \[[`ade4fc2338`](nodejs/node@ade4fc2338)] - **tools**: copyedit Nix files (Antoine du Hamel) [#&#8203;61447](nodejs/node#61447)
- \[[`7c2242beb9`](nodejs/node@7c2242beb9)] - **tools**: validate release commit diff as part of `lint-release-proposal` (Antoine du Hamel) [#&#8203;61440](nodejs/node#61440)
- \[[`ca4ebed258`](nodejs/node@ca4ebed258)] - **tools**: use ad-hoc flag to lint Nix files (Antoine du Hamel) [#&#8203;61405](nodejs/node#61405)
- \[[`05ce2c87f3`](nodejs/node@05ce2c87f3)] - **tools**: fix vcbuild lint-js-build (Vladimir Morozov) [#&#8203;61318](nodejs/node#61318)
- \[[`41adb54a37`](nodejs/node@41adb54a37)] - **tools**: enforce trailing commas in `test/es-module` (Antoine du Hamel) [#&#8203;60891](nodejs/node#60891)
- \[[`eebd732a52`](nodejs/node@eebd732a52)] - **tools**: enforce trailing commas in `test/sequential` (Antoine du Hamel) [#&#8203;60892](nodejs/node#60892)
- \[[`8b73739e03`](nodejs/node@8b73739e03)] - **typings**: add typing for string\_decoder (Taejin Kim) [#&#8203;61368](nodejs/node#61368)
- \[[`e88dd012ad`](nodejs/node@e88dd012ad)] - **v8**: changing total\_allocated\_bytes to avoid ABI changes (Caio Lima) [#&#8203;60800](nodejs/node#60800)
- \[[`c75ad3d87d`](nodejs/node@c75ad3d87d)] - **v8**: add GCProfiler support for erm (Ilyas Shabi) [#&#8203;61191](nodejs/node#61191)
- \[[`611c179663`](nodejs/node@611c179663)] - **zlib**: validate write\_result array length (Ryuhei Shima) [#&#8203;61342](nodejs/node#61342)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xMSIsInVwZGF0ZWRJblZlciI6IjQyLjkyLjExIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
aduh95 pushed a commit that referenced this pull request May 7, 2026
@legendecas @aduh95
quic: copy options.certs buffer instead of detaching
45c1ebd 
The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: #61403
Refs: #61372
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@github-actions github-actions Bot mentioned this pull request May 12, 2026
Merged
mwalbeck pushed a commit to mwalbeck/docker-cyberchef that referenced this pull request Jun 20, 2026
renovate-bot @mwalbeck
Update Node.js to v24.16.0 (#480)
7e2490d 
This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [node](https://github.com/nodejs/node) | stage | minor | `24.15.0-trixie` → `24.16.0-trixie` | `24.17.0-trixie` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.16.0`](https://github.com/nodejs/node/releases/tag/v24.16.0): 2026-05-21, Version 24.16.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.15.0...v24.16.0)

##### Notable Changes

- \[[`b267f6bca3`](nodejs/node@b267f6bca3)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#&#8203;62553](nodejs/node#62553)
- \[[`ec2451b9cd`](nodejs/node@ec2451b9cd)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#&#8203;62713](nodejs/node#62713)
- \[[`9705f628d9`](nodejs/node@9705f628d9)] - **(SEMVER-MINOR)** **fs**: add signal option to `fs.stat()` (Mert Can Altin) [#&#8203;57775](nodejs/node#57775)
- \[[`40ccfdecf9`](nodejs/node@40ccfdecf9)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#&#8203;62277](nodejs/node#62277)
- \[[`d7188af5c9`](nodejs/node@d7188af5c9)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#&#8203;63082](nodejs/node#63082)
- \[[`aa1d8a9afc`](nodejs/node@aa1d8a9afc)] - **(SEMVER-MINOR)** **http**: add `req.signal` to `IncomingMessage` (Akshat) [#&#8203;62541](nodejs/node#62541)
- \[[`6f37f7e240`](nodejs/node@6f37f7e240)] - **(SEMVER-MINOR)** **stream**: propagate destruction in `duplexPair` (Ahmed Elhor) [#&#8203;61098](nodejs/node#61098)
- \[[`d14029be7f`](nodejs/node@d14029be7f)] - **(SEMVER-MINOR)** **test\_runner**: support test order randomization (Pietro Marchini) [#&#8203;61747](nodejs/node#61747)
- \[[`d142c584cd`](nodejs/node@d142c584cd)] - **(SEMVER-MINOR)** **test\_runner**: align mock timeout api (sangwook) [#&#8203;62820](nodejs/node#62820)
- \[[`01a9552585`](nodejs/node@01a9552585)] - **(SEMVER-MINOR)** **test\_runner**: add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) [#&#8203;60751](nodejs/node#60751)
- \[[`00705a459a`](nodejs/node@00705a459a)] - **(SEMVER-MINOR)** **util**: colorize text with hex colors (Guilherme Araújo) [#&#8203;61556](nodejs/node#61556)

##### Commits

- \[[`dd72df060d`](nodejs/node@dd72df060d)] - **assert,util**: fix stale nested cycle memo entries (Ruben Bridgewater) [#&#8203;62509](nodejs/node#62509)
- \[[`add94f4bc3`](nodejs/node@add94f4bc3)] - **build**: track PDL files as inputs in inspector GN build (Robo) [#&#8203;62888](nodejs/node#62888)
- \[[`1b1eb9e334`](nodejs/node@1b1eb9e334)] - **build**: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) [#&#8203;62667](nodejs/node#62667)
- \[[`8752b604ec`](nodejs/node@8752b604ec)] - **crypto**: deduplicate and canonicalize CryptoKey usages (Filip Skokan) [#&#8203;62902](nodejs/node#62902)
- \[[`341947e7fd`](nodejs/node@341947e7fd)] - **crypto**: reject unintended raw key format string input (Filip Skokan) [#&#8203;62974](nodejs/node#62974)
- \[[`28a78747fc`](nodejs/node@28a78747fc)] - **crypto**: remove Argon2 KDF derivation from its job setup (Filip Skokan) [#&#8203;62863](nodejs/node#62863)
- \[[`16e8c2b54d`](nodejs/node@16e8c2b54d)] - **crypto**: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) [#&#8203;62839](nodejs/node#62839)
- \[[`eeae754a87`](nodejs/node@eeae754a87)] - **crypto**: reject inherited key type names (Jonathan Lopes) [#&#8203;62875](nodejs/node#62875)
- \[[`9dd5540325`](nodejs/node@9dd5540325)] - **crypto**: add memory tracking for secureContext openssl objects (Mert Can Altin) [#&#8203;59051](nodejs/node#59051)
- \[[`b267f6bca3`](nodejs/node@b267f6bca3)] - **(SEMVER-MINOR)** **crypto**: implement randomUUIDv7() (nabeel378) [#&#8203;62553](nodejs/node#62553)
- \[[`7597d204c1`](nodejs/node@7597d204c1)] - **crypto**: add support for [`Ed25519`](nodejs/node@Ed25519) context parameter (Filip Skokan) [#&#8203;62474](nodejs/node#62474)
- \[[`4bf85845da`](nodejs/node@4bf85845da)] - **debugger**: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) [#&#8203;63013](nodejs/node#63013)
- \[[`ec2451b9cd`](nodejs/node@ec2451b9cd)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#&#8203;62713](nodejs/node#62713)
- \[[`83e98f77b7`](nodejs/node@83e98f77b7)] - **deps**: update corepack to 0.35.0 (Node.js GitHub Bot) [#&#8203;63375](nodejs/node#63375)
- \[[`ec8c6b939a`](nodejs/node@ec8c6b939a)] - **deps**: V8: cherry-pick [`657d8de`](nodejs/node@657d8de27427) (Guy Bedford) [#&#8203;62784](nodejs/node#62784)
- \[[`722c0c3274`](nodejs/node@722c0c3274)] - **deps**: update nghttp3 to 1.14.0 (Node.js GitHub Bot) [#&#8203;61187](nodejs/node#61187)
- \[[`5304db93d3`](nodejs/node@5304db93d3)] - **deps**: update nghttp3 to 1.13.1 (Node.js GitHub Bot) [#&#8203;60046](nodejs/node#60046)
- \[[`e073b3811d`](nodejs/node@e073b3811d)] - **deps**: update nghttp3 to 1.11.0 (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`1d00313fb2`](nodejs/node@1d00313fb2)] - **deps**: update ngtcp2 to 1.14.0 (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`8b3a4fc18f`](nodejs/node@8b3a4fc18f)] - **deps**: update amaro to 1.1.9 (Node.js GitHub Bot) [#&#8203;63090](nodejs/node#63090)
- \[[`62fe0cfcd1`](nodejs/node@62fe0cfcd1)] - **deps**: update llhttp to 9.4.1 (Node.js GitHub Bot) [#&#8203;63045](nodejs/node#63045)
- \[[`137e09c8e9`](nodejs/node@137e09c8e9)] - **deps**: update corepack to 0.34.7 (Node.js GitHub Bot) [#&#8203;62810](nodejs/node#62810)
- \[[`14a4cb8fbc`](nodejs/node@14a4cb8fbc)] - **deps**: update timezone to 2026b (Node.js GitHub Bot) [#&#8203;62962](nodejs/node#62962)
- \[[`3e1036583a`](nodejs/node@3e1036583a)] - **deps**: upgrade npm to 11.13.0 (npm team) [#&#8203;62898](nodejs/node#62898)
- \[[`01dfe5961c`](nodejs/node@01dfe5961c)] - **deps**: cherry-pick [libuv/libuv@`439a54b`](libuv/libuv@439a54b) (skooch) [#&#8203;62881](nodejs/node#62881)
- \[[`6cd368b10c`](nodejs/node@6cd368b10c)] - **deps**: update sqlite to 3.53.0 (Node.js GitHub Bot) [#&#8203;62699](nodejs/node#62699)
- \[[`f218a4f553`](nodejs/node@f218a4f553)] - **deps**: update nbytes to 0.1.4 (Node.js GitHub Bot) [#&#8203;62698](nodejs/node#62698)
- \[[`b47688524a`](nodejs/node@b47688524a)] - **deps**: update archs files for openssl-3.5.6 (Node.js GitHub Bot) [#&#8203;62629](nodejs/node#62629)
- \[[`d202e2d343`](nodejs/node@d202e2d343)] - **deps**: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) [#&#8203;62629](nodejs/node#62629)
- \[[`2faba66341`](nodejs/node@2faba66341)] - **deps**: update minimatch to 10.2.5 (Node.js GitHub Bot) [#&#8203;62594](nodejs/node#62594)
- \[[`fa46c90c5d`](nodejs/node@fa46c90c5d)] - **deps**: update googletest to [`d72f9c8`](nodejs/node@d72f9c8) (Node.js GitHub Bot) [#&#8203;62593](nodejs/node#62593)
- \[[`099ded5713`](nodejs/node@099ded5713)] - **deps**: update simdjson to 4.6.1 (Node.js GitHub Bot) [#&#8203;62592](nodejs/node#62592)
- \[[`7ce95afe96`](nodejs/node@7ce95afe96)] - **deps**: libuv: cherry-pick [`aabb765`](nodejs/node@aabb7651de) (Santiago Gimeno) [#&#8203;62561](nodejs/node#62561)
- \[[`57ef845623`](nodejs/node@57ef845623)] - **deps**: update icu to 78.3 (Node.js GitHub Bot) [#&#8203;62324](nodejs/node#62324)
- \[[`493ac40e12`](nodejs/node@493ac40e12)] - **deps**: update libuv to 1.52.1 (Node.js GitHub Bot) [#&#8203;61829](nodejs/node#61829)
- \[[`b39508b368`](nodejs/node@b39508b368)] - **deps**: update undici to 7.25.0 (Node.js GitHub Bot) [#&#8203;63011](nodejs/node#63011)
- \[[`cb67a925e9`](nodejs/node@cb67a925e9)] - **deps**: use npm undici\@&#8203;seven tag in `update-undici.sh` (Matteo Collina) [#&#8203;62739](nodejs/node#62739)
- \[[`aa1e0bc28b`](nodejs/node@aa1e0bc28b)] - **doc**: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) [#&#8203;62828](nodejs/node#62828)
- \[[`f2a1735ed9`](nodejs/node@f2a1735ed9)] - **doc**: fix duplicate word "to to" in util.styleText (Daijiro Wachi) [#&#8203;62917](nodejs/node#62917)
- \[[`b6378e215c`](nodejs/node@b6378e215c)] - **doc**: fix node-config-schema (Сковорода Никита Андреевич) [#&#8203;61596](nodejs/node#61596)
- \[[`233894a9ce`](nodejs/node@233894a9ce)] - **doc**: fix the TypeScript Execute (tsx) project link (David Thornton) [#&#8203;63093](nodejs/node#63093)
- \[[`5d97919f8f`](nodejs/node@5d97919f8f)] - **doc**: correct diagnostics\_channel built-in channel names (Bryan English) [#&#8203;62995](nodejs/node#62995)
- \[[`2a9ccc927e`](nodejs/node@2a9ccc927e)] - **doc**: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) [#&#8203;62884](nodejs/node#62884)
- \[[`ef413b5358`](nodejs/node@ef413b5358)] - **doc**: fix typo in test.md (Rich Trott) [#&#8203;62960](nodejs/node#62960)
- \[[`76f21c5070`](nodejs/node@76f21c5070)] - **doc**: correct typo in PR contribution instructions (Mike McCready) [#&#8203;62738](nodejs/node#62738)
- \[[`ca02af1f7d`](nodejs/node@ca02af1f7d)] - **doc**: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) [#&#8203;62917](nodejs/node#62917)
- \[[`46c99ed526`](nodejs/node@46c99ed526)] - **doc**: fix duplicate word "for for" in compile cache (Daijiro Wachi) [#&#8203;62917](nodejs/node#62917)
- \[[`1a60851734`](nodejs/node@1a60851734)] - **doc**: fix typo in dns.lookup options description (Daijiro Wachi) [#&#8203;62882](nodejs/node#62882)
- \[[`169b5ea2ed`](nodejs/node@169b5ea2ed)] - **doc**: fix Argon2 parameter bounds (Tobias Nießen) [#&#8203;62868](nodejs/node#62868)
- \[[`9a3a190f4e`](nodejs/node@9a3a190f4e)] - **doc**: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) [#&#8203;62205](nodejs/node#62205)
- \[[`0fba9e87d6`](nodejs/node@0fba9e87d6)] - **doc**: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) [#&#8203;62841](nodejs/node#62841)
- \[[`9c700f3446`](nodejs/node@9c700f3446)] - **doc**: clarify dns.lookup() callback signature when all is true (eungi) [#&#8203;62800](nodejs/node#62800)
- \[[`6b7280bc17`](nodejs/node@6b7280bc17)] - **doc**: add experimental modules lifetime policy (Paolo Insogna) [#&#8203;62753](nodejs/node#62753)
- \[[`ce47ea31c9`](nodejs/node@ce47ea31c9)] - **doc**: clarify process.\_debugProcess() in Permission Model (Fahad Khan) [#&#8203;62537](nodejs/node#62537)
- \[[`ba01633757`](nodejs/node@ba01633757)] - **doc**: fix typo in devcontainer guide (Rohan Santhosh Kumar) [#&#8203;62687](nodejs/node#62687)
- \[[`70b4d5839b`](nodejs/node@70b4d5839b)] - **doc**: clarify Backport-PR-URL metadata added automatically (Mike McCready) [#&#8203;62668](nodejs/node#62668)
- \[[`8126d1c3eb`](nodejs/node@8126d1c3eb)] - **doc**: update WPT test runner README.md (Filip Skokan) [#&#8203;62680](nodejs/node#62680)
- \[[`978afea4b5`](nodejs/node@978afea4b5)] - **doc**: fix spelling in release announcement guidance (Rohan Santhosh Kumar) [#&#8203;62663](nodejs/node#62663)
- \[[`1684ab8ff8`](nodejs/node@1684ab8ff8)] - **doc**: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) [#&#8203;62600](nodejs/node#62600)
- \[[`86d4f07930`](nodejs/node@86d4f07930)] - **doc**: update bug bounty program (Rafael Gonzaga) [#&#8203;62590](nodejs/node#62590)
- \[[`736ed8a08f`](nodejs/node@736ed8a08f)] - **doc**: document TransformStream transformer.cancel option (Tom Pereira) [#&#8203;62566](nodejs/node#62566)
- \[[`938af9be01`](nodejs/node@938af9be01)] - **doc**: mention test runner retry attemp is zero based (Moshe Atlow) [#&#8203;62504](nodejs/node#62504)
- \[[`94433e450f`](nodejs/node@94433e450f)] - **doc,src,test**: fix dead inspector help URL (semimikoh) [#&#8203;62745](nodejs/node#62745)
- \[[`ddf1f01659`](nodejs/node@ddf1f01659)] - **esm**: add `ERR_REQUIRE_ESM_RACE_CONDITION` (Antoine du Hamel) [#&#8203;62462](nodejs/node#62462)
- \[[`4a506acd16`](nodejs/node@4a506acd16)] - **fs**: add followSymlinks option to glob (Matteo Collina) [#&#8203;62695](nodejs/node#62695)
- \[[`f4ea495f9b`](nodejs/node@f4ea495f9b)] - **fs**: restore fs patchability in ESM loader (Joyee Cheung) [#&#8203;62835](nodejs/node#62835)
- \[[`63c111cd60`](nodejs/node@63c111cd60)] - **fs**: validate position argument before length === 0 early return (Edy Silva) [#&#8203;62674](nodejs/node#62674)
- \[[`9705f628d9`](nodejs/node@9705f628d9)] - **(SEMVER-MINOR)** **fs**: add signal option to fs.stat() (Mert Can Altin) [#&#8203;57775](nodejs/node#57775)
- \[[`40ccfdecf9`](nodejs/node@40ccfdecf9)] - **(SEMVER-MINOR)** **fs**: expose frsize field in statfs (Jinho Jang) [#&#8203;62277](nodejs/node#62277)
- \[[`717476a24e`](nodejs/node@717476a24e)] - **http**: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) [#&#8203;62936](nodejs/node#62936)
- \[[`d7188af5c9`](nodejs/node@d7188af5c9)] - **(SEMVER-MINOR)** **http**: harden ClientRequest options merge (Matteo Collina) [#&#8203;63082](nodejs/node#63082)
- \[[`64f15c274a`](nodejs/node@64f15c274a)] - **http**: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) [#&#8203;62872](nodejs/node#62872)
- \[[`5c4798d799`](nodejs/node@5c4798d799)] - **http**: fix no\_proxy leading-dot suffix matching (Daijiro Wachi) [#&#8203;62333](nodejs/node#62333)
- \[[`9f3bc70ae5`](nodejs/node@9f3bc70ae5)] - **http**: cleanup pipeline queue (Robert Nagy) [#&#8203;62534](nodejs/node#62534)
- \[[`aa1d8a9afc`](nodejs/node@aa1d8a9afc)] - **(SEMVER-MINOR)** **http**: add req.signal to IncomingMessage (Akshat) [#&#8203;62541](nodejs/node#62541)
- \[[`900dc758ff`](nodejs/node@900dc758ff)] - **http2**: expose writable stream state on compat response (T) [#&#8203;63003](nodejs/node#63003)
- \[[`b3bfe35912`](nodejs/node@b3bfe35912)] - **inspector**: coerce key and value to string in webstorage events (Ali Hassan) [#&#8203;62616](nodejs/node#62616)
- \[[`3dc3fb6ad8`](nodejs/node@3dc3fb6ad8)] - **inspector**: return errors when CDP protocol event emission fails (Ryuhei Shima) [#&#8203;62162](nodejs/node#62162)
- \[[`4f3f21bd7c`](nodejs/node@4f3f21bd7c)] - **inspector**: auto collect webstorage data (Ryuhei Shima) [#&#8203;62145](nodejs/node#62145)
- \[[`36cc04189d`](nodejs/node@36cc04189d)] - **inspector**: initial support storage inspection (Ryuhei Shima) [#&#8203;61139](nodejs/node#61139)
- \[[`1718bc3b9b`](nodejs/node@1718bc3b9b)] - **inspector**: fix absolute URLs in network http (bugyaluwang) [#&#8203;62955](nodejs/node#62955)
- \[[`97e32c7a74`](nodejs/node@97e32c7a74)] - **lib**: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) [#&#8203;62914](nodejs/node#62914)
- \[[`25d2e999de`](nodejs/node@25d2e999de)] - **lib**: harden kKeyOps lookup with null prototype (Filip Skokan) [#&#8203;62877](nodejs/node#62877)
- \[[`37d3913c8f`](nodejs/node@37d3913c8f)] - **lib**: short-circuit WebIDL BufferSource SAB check (Filip Skokan) [#&#8203;62833](nodejs/node#62833)
- \[[`430c69d25f`](nodejs/node@430c69d25f)] - **lib**: use js-only implementation of `isDataView()` (René) [#&#8203;62780](nodejs/node#62780)
- \[[`3ba0add6a0`](nodejs/node@3ba0add6a0)] - **lib**: fix lint in internal/webstreams/util.js (Filip Skokan) [#&#8203;62806](nodejs/node#62806)
- \[[`9b95c41398`](nodejs/node@9b95c41398)] - **lib**: fix sequence argument handling in Blob constructor (Ms2ger) [#&#8203;62179](nodejs/node#62179)
- \[[`314dacdbee`](nodejs/node@314dacdbee)] - **lib**: improve Web Cryptography key validation ordering (Filip Skokan) [#&#8203;62749](nodejs/node#62749)
- \[[`3d18162430`](nodejs/node@3d18162430)] - **lib**: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) [#&#8203;62632](nodejs/node#62632)
- \[[`ada3ce879d`](nodejs/node@ada3ce879d)] - **lib**: defer AbortSignal.any() following (sangwook) [#&#8203;62367](nodejs/node#62367)
- \[[`b2981ec7eb`](nodejs/node@b2981ec7eb)] - **meta**: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot\[bot]) [#&#8203;62549](nodejs/node#62549)
- \[[`7cd20667b5`](nodejs/node@7cd20667b5)] - **meta**: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot\[bot]) [#&#8203;63074](nodejs/node#63074)
- \[[`91a07cfe9f`](nodejs/node@91a07cfe9f)] - **meta**: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot\[bot]) [#&#8203;63073](nodejs/node#63073)
- \[[`09e17fe47c`](nodejs/node@09e17fe47c)] - **meta**: add automation policy (Chengzhong Wu) [#&#8203;62871](nodejs/node#62871)
- \[[`59e7fb7986`](nodejs/node@59e7fb7986)] - **meta**: move VoltrexKeyva to emeritus (Matteo Collina) [#&#8203;62895](nodejs/node#62895)
- \[[`1e2915cfa6`](nodejs/node@1e2915cfa6)] - **meta**: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot\[bot]) [#&#8203;62845](nodejs/node#62845)
- \[[`0253c6e2be`](nodejs/node@0253c6e2be)] - **meta**: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot\[bot]) [#&#8203;62844](nodejs/node#62844)
- \[[`f503675b86`](nodejs/node@f503675b86)] - **meta**: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot\[bot]) [#&#8203;62842](nodejs/node#62842)
- \[[`5e14e4d26e`](nodejs/node@5e14e4d26e)] - **meta**: broaden stale bot (Aviv Keller) [#&#8203;62658](nodejs/node#62658)
- \[[`795db76f87`](nodejs/node@795db76f87)] - **meta**: pass release version to release worker (flakey5) [#&#8203;62777](nodejs/node#62777)
- \[[`ef384fe39f`](nodejs/node@ef384fe39f)] - **meta**: add QUIC to CODEOWNERS (Tim Perry) [#&#8203;62652](nodejs/node#62652)
- \[[`67e0ac568d`](nodejs/node@67e0ac568d)] - **meta**: move Michael to emeritus (Michael Dawson) [#&#8203;62536](nodejs/node#62536)
- \[[`5dad616393`](nodejs/node@5dad616393)] - **meta**: populate apt list for slim runner in update-openssl workflow (René) [#&#8203;62628](nodejs/node#62628)
- \[[`a869d25d8a`](nodejs/node@a869d25d8a)] - **meta**: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot\[bot]) [#&#8203;62550](nodejs/node#62550)
- \[[`769efc0403`](nodejs/node@769efc0403)] - **meta**: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot\[bot]) [#&#8203;62548](nodejs/node#62548)
- \[[`73fcc2b055`](nodejs/node@73fcc2b055)] - **meta**: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot\[bot]) [#&#8203;62547](nodejs/node#62547)
- \[[`6c001246fe`](nodejs/node@6c001246fe)] - **meta**: bump codecov/codecov-action from 5.5.2 to 6.0.0 (dependabot\[bot]) [#&#8203;62545](nodejs/node#62545)
- \[[`5ee40d6a03`](nodejs/node@5ee40d6a03)] - **meta**: bump actions/cache from 5.0.3 to 5.0.4 (dependabot\[bot]) [#&#8203;62543](nodejs/node#62543)
- \[[`ca16ad8a05`](nodejs/node@ca16ad8a05)] - **meta**: require DCO signoff in commit message guidelines (James M Snell) [#&#8203;62510](nodejs/node#62510)
- \[[`db9497fc41`](nodejs/node@db9497fc41)] - **meta**: expand memory leak DoS criteria to all DoS (Joyee Cheung) [#&#8203;62505](nodejs/node#62505)
- \[[`13b7d08b8d`](nodejs/node@13b7d08b8d)] - **module**: remove duplicated checks from `_resolveFilename` (Antoine du Hamel) [#&#8203;62729](nodejs/node#62729)
- \[[`6b53efb53a`](nodejs/node@6b53efb53a)] - **module,win**: fix long subpath import (Stefan Stojanovic) [#&#8203;62101](nodejs/node#62101)
- \[[`841dfbf6fc`](nodejs/node@841dfbf6fc)] - **node-api**: update libuv ABI stability note (Chengzhong Wu) [#&#8203;62789](nodejs/node#62789)
- \[[`01090f2aa1`](nodejs/node@01090f2aa1)] - **node-api**: add napi\_create\_external\_sharedarraybuffer (Ben Noordhuis) [#&#8203;62623](nodejs/node#62623)
- \[[`87443b4355`](nodejs/node@87443b4355)] - **node-api**: execute tsfn finalizer after queue drains when aborted (Kevin Eady) [#&#8203;61956](nodejs/node#61956)
- \[[`e95570c054`](nodejs/node@e95570c054)] - **process**: handle rejections only when needed (Gürgün Dayıoğlu) [#&#8203;62919](nodejs/node#62919)
- \[[`37d49f3219`](nodejs/node@37d49f3219)] - **process**: optimize asyncHandledRejections by using FixedQueue (Gürgün Dayıoğlu) [#&#8203;60854](nodejs/node#60854)
- \[[`f697c55e38`](nodejs/node@f697c55e38)] - **quic**: add QuicEndpoint.listening & QuicStream.destroy() and tests (Tim Perry) [#&#8203;62648](nodejs/node#62648)
- \[[`c128942b69`](nodejs/node@c128942b69)] - **quic**: fixup token verification to handle zero expiration (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`abb881ec92`](nodejs/node@abb881ec92)] - **quic**: support multiple ALPN negotiation (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`476926c2ad`](nodejs/node@476926c2ad)] - **quic**: apply multiple TLS context improvements and SNI support (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`76d9c24b95`](nodejs/node@76d9c24b95)] - **quic**: implement rapidhash for hashing improvements (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`08726cd43d`](nodejs/node@08726cd43d)] - **quic**: move quic behind compile time flag (Matteo Collina) [#&#8203;61444](nodejs/node#61444)
- \[[`ea4f19aaa7`](nodejs/node@ea4f19aaa7)] - **quic**: use arena allocation for packets (James M Snell) [#&#8203;62589](nodejs/node#62589)
- \[[`21e9239e2a`](nodejs/node@21e9239e2a)] - **quic**: fixup linting/formatting issues (James M Snell) [#&#8203;62387](nodejs/node#62387)
- \[[`edeed4303b`](nodejs/node@edeed4303b)] - **quic**: update http3 impl details (James M Snell) [#&#8203;62387](nodejs/node#62387)
- \[[`7f3a85e6aa`](nodejs/node@7f3a85e6aa)] - **quic**: fix a handful of bugs and missing functionality (James M Snell) [#&#8203;62387](nodejs/node#62387)
- \[[`45c1ebddf8`](nodejs/node@45c1ebddf8)] - **quic**: copy options.certs buffer instead of detaching (Chengzhong Wu) [#&#8203;61403](nodejs/node#61403)
- \[[`a31a8ee680`](nodejs/node@a31a8ee680)] - **quic**: reduce boilerplate and other minor cleanups (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`3be70ff43a`](nodejs/node@3be70ff43a)] - **quic**: multiple fixups and updates (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`b91a93444c`](nodejs/node@b91a93444c)] - **quic**: update more of the quic to the new compile guard (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`ca0080c164`](nodejs/node@ca0080c164)] - **quic**: few additional small comment edits in cid.h (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`6553202d83`](nodejs/node@6553202d83)] - **quic**: fixup NO\_ERROR macro conflict on windows (James M Snell) [#&#8203;59381](nodejs/node#59381)
- \[[`6df1508ac2`](nodejs/node@6df1508ac2)] - **quic**: fixup windows coverage compile error (James M Snell) [#&#8203;59381](nodejs/node#59381)
- \[[`b2b0bf8b04`](nodejs/node@b2b0bf8b04)] - **quic**: update the guard to check openssl version (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`5556b154bd`](nodejs/node@5556b154bd)] - **quic**: start re-enabling quic with openssl 3.5 (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`2ca42c8263`](nodejs/node@2ca42c8263)] - **repl**: keep reference count for `process.on('newListener')` (Anna Henningsen) [#&#8203;61895](nodejs/node#61895)
- \[[`2f37f9177f`](nodejs/node@2f37f9177f)] - **sqlite**: use OneByte for ASCII text and internalize col names (Ali Hassan) [#&#8203;61954](nodejs/node#61954)
- \[[`3c96ae1b2f`](nodejs/node@3c96ae1b2f)] - **sqlite**: add serialize() and deserialize() (Ali Hassan) [#&#8203;62579](nodejs/node#62579)
- \[[`be4d2f3a4c`](nodejs/node@be4d2f3a4c)] - **sqlite**: enable Percentile extension (Jurj Andrei George) [#&#8203;61295](nodejs/node#61295)
- \[[`dafed453b2`](nodejs/node@dafed453b2)] - **src**: clean up experimental flag variables (Antoine du Hamel) [#&#8203;62759](nodejs/node#62759)
- \[[`dca1e6aeea`](nodejs/node@dca1e6aeea)] - **src**: expose help texts into node-config-schema.json (Pietro Marchini) [#&#8203;58680](nodejs/node#58680)
- \[[`28c4f44eb1`](nodejs/node@28c4f44eb1)] - **src**: add permission support to config file (Marco Ippolito) [#&#8203;60746](nodejs/node#60746)
- \[[`f49175b220`](nodejs/node@f49175b220)] - **src**: fix small compile warning in quic/streams.cc (James M Snell) [#&#8203;60118](nodejs/node#60118)
- \[[`c9d4a446d8`](nodejs/node@c9d4a446d8)] - **src**: cleanup quic TransportParams class (James M Snell) [#&#8203;59884](nodejs/node#59884)
- \[[`99bb02fd9e`](nodejs/node@99bb02fd9e)] - **src**: swap dotenv and config file parsing order (Marco Ippolito) [#&#8203;63035](nodejs/node#63035)
- \[[`ecb4d49b7b`](nodejs/node@ecb4d49b7b)] - **src**: add missing \<cstdlib> for abort() declaration (Charles Kerr) [#&#8203;63001](nodejs/node#63001)
- \[[`b6219b6362`](nodejs/node@b6219b6362)] - **src**: fix crash in GetErrorSource() for invalid using syntax (semimikoh) [#&#8203;62770](nodejs/node#62770)
- \[[`b5ca5ad4c5`](nodejs/node@b5ca5ad4c5)] - **src**: simplify `TCPWrap::Connect` signature (Anna Henningsen) [#&#8203;62929](nodejs/node#62929)
- \[[`ef7ffce7cf`](nodejs/node@ef7ffce7cf)] - **src**: use DCHECK in AsyncWrap::MakeCallback instead emiting a warning (Gerhard Stöbich) [#&#8203;62795](nodejs/node#62795)
- \[[`cd9890a5ab`](nodejs/node@cd9890a5ab)] - **src**: fix MaybeStackBuffer char\_traits deprecation warning (om-ghante) [#&#8203;62507](nodejs/node#62507)
- \[[`c70ff44aee`](nodejs/node@c70ff44aee)] - **src**: use context-free V8 message column getters (René) [#&#8203;62778](nodejs/node#62778)
- \[[`06c405f1d7`](nodejs/node@06c405f1d7)] - **src**: coerce `spawnSync` args to string once (Antoine du Hamel) [#&#8203;62633](nodejs/node#62633)
- \[[`6151999ad6`](nodejs/node@6151999ad6)] - **src**: use stack allocation for small string encoding (Ali Hassan) [#&#8203;62431](nodejs/node#62431)
- \[[`a71a4ac7a3`](nodejs/node@a71a4ac7a3)] - **src**: add contextify interceptor debug logs (Chengzhong Wu) [#&#8203;62460](nodejs/node#62460)
- \[[`ad9a2909c2`](nodejs/node@ad9a2909c2)] - **src**: workaround AIX libc++ std::filesystem bug (Richard Lau) [#&#8203;62788](nodejs/node#62788)
- \[[`7792f1ae47`](nodejs/node@7792f1ae47)] - **stream**: copyedit `webstreams/adapter.js` (Antoine du Hamel) [#&#8203;63034](nodejs/node#63034)
- \[[`1397d8ce5c`](nodejs/node@1397d8ce5c)] - **stream**: remove duplicated utility (Antoine du Hamel) [#&#8203;63031](nodejs/node#63031)
- \[[`ff86b1d64f`](nodejs/node@ff86b1d64f)] - **stream**: simplify `setPromiseHandled` utility (Antoine du Hamel) [#&#8203;63032](nodejs/node#63032)
- \[[`24a078149a`](nodejs/node@24a078149a)] - **stream**: validate ReadableStream.from iterator objects (Daeyeon Jeong) [#&#8203;62911](nodejs/node#62911)
- \[[`cfb1fa9680`](nodejs/node@cfb1fa9680)] - **stream**: reject duplicate nested transferables (Daeyeon Jeong) [#&#8203;62831](nodejs/node#62831)
- \[[`d0c913758a`](nodejs/node@d0c913758a)] - **stream**: ensuring cross-destruction in \_duplexify to prevent leaks (Daijiro Wachi) [#&#8203;62824](nodejs/node#62824)
- \[[`978f5c15d7`](nodejs/node@978f5c15d7)] - **stream**: simplify `readableStreamFromIterable` (Antoine du Hamel) [#&#8203;62651](nodejs/node#62651)
- \[[`3527646ba5`](nodejs/node@3527646ba5)] - **stream**: fix nested compose error propagation (Matteo Collina) [#&#8203;62556](nodejs/node#62556)
- \[[`dfb9edef4f`](nodejs/node@dfb9edef4f)] - **stream**: allow shared array buffer sources in writable webstream adapter (René) [#&#8203;62163](nodejs/node#62163)
- \[[`f00cdab627`](nodejs/node@f00cdab627)] - **stream**: simplify `createPromiseCallback` (Antoine du Hamel) [#&#8203;62650](nodejs/node#62650)
- \[[`3ed783535f`](nodejs/node@3ed783535f)] - **stream**: fix writev unhandled rejection in fromWeb (sangwook) [#&#8203;62297](nodejs/node#62297)
- \[[`29b196694c`](nodejs/node@29b196694c)] - **stream**: noop pause/resume on destroyed streams (Robert Nagy) [#&#8203;62557](nodejs/node#62557)
- \[[`d73dbb9fc8`](nodejs/node@d73dbb9fc8)] - **stream**: refactor duplexify to be less suceptible to prototype pollution (Antoine du Hamel) [#&#8203;62559](nodejs/node#62559)
- \[[`6f37f7e240`](nodejs/node@6f37f7e240)] - **(SEMVER-MINOR)** **stream**: propagate destruction in duplexPair (Ahmed Elhor) [#&#8203;61098](nodejs/node#61098)
- \[[`b8816580e9`](nodejs/node@b8816580e9)] - **test**: generate `localstorage.db` in a temp dir (Chengzhong Wu) [#&#8203;62660](nodejs/node#62660)
- \[[`31a863fd29`](nodejs/node@31a863fd29)] - **test**: update WPT for url to [`258f285`](nodejs/node@258f285de0) (Node.js GitHub Bot) [#&#8203;63087](nodejs/node#63087)
- \[[`d0d19bd8e3`](nodejs/node@d0d19bd8e3)] - **test**: update WPT for streams to [`f8f26a3`](nodejs/node@f8f26a372f) (Node.js GitHub Bot) [#&#8203;62864](nodejs/node#62864)
- \[[`f50ac5bc78`](nodejs/node@f50ac5bc78)] - **test**: improve config-file permission test coverage (Rafael Gonzaga) [#&#8203;60929](nodejs/node#60929)
- \[[`a0f90000f4`](nodejs/node@a0f90000f4)] - **test**: export isRiscv64 from common module (Jamie Magee) [#&#8203;62609](nodejs/node#62609)
- \[[`da4dd8646f`](nodejs/node@da4dd8646f)] - **test**: normalize known inspector crash as completion (Joyee Cheung) [#&#8203;62851](nodejs/node#62851)
- \[[`b7fdd94a4c`](nodejs/node@b7fdd94a4c)] - **test**: account for RFC 7919 FFDHE negotiation in OpenSSL 4.0 (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`375a993aaf`](nodejs/node@375a993aaf)] - **test**: skip tls-deprecated secp256k1 on OpenSSL 4.0 (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`698d8287d1`](nodejs/node@698d8287d1)] - **test**: use an always invalid cipher and cover OpenSSL 4.0 behaviours (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`036bc6f300`](nodejs/node@036bc6f300)] - **test**: use valid DER OCSP responses (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`3aa9938da8`](nodejs/node@3aa9938da8)] - **test**: skip test-tls-error-stack when engines are unsupported (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`947f1ae246`](nodejs/node@947f1ae246)] - **test**: accept renamed OpenSSL 4.0 error code and reason (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`afdd355622`](nodejs/node@afdd355622)] - **test**: update test/addons/openssl-binding for OpenSSL 4.0 (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`8637524a99`](nodejs/node@8637524a99)] - **test**: mark test-snapshot-reproducible flaky (Filip Skokan) [#&#8203;62808](nodejs/node#62808)
- \[[`c22d34134b`](nodejs/node@c22d34134b)] - **test**: check contextify contextual store behavior in strict mode (René) [#&#8203;62571](nodejs/node#62571)
- \[[`0b4e0d3c94`](nodejs/node@0b4e0d3c94)] - **test**: update tls junk data error expectations (Filip Skokan) [#&#8203;62629](nodejs/node#62629)
- \[[`85d83c2cdb`](nodejs/node@85d83c2cdb)] - **test**: ensure WPT report is in out/wpt (Filip Skokan) [#&#8203;62637](nodejs/node#62637)
- \[[`9e21711c60`](nodejs/node@9e21711c60)] - **test**: improve WPT runner summary (Filip Skokan) [#&#8203;62636](nodejs/node#62636)
- \[[`e04e2c9ac1`](nodejs/node@e04e2c9ac1)] - **test**: skip url WPT subtests instead of modifying test script (Filip Skokan) [#&#8203;62635](nodejs/node#62635)
- \[[`7b1211f88c`](nodejs/node@7b1211f88c)] - **test**: capture negative utimes mtime at call time (Yuya Inoue) [#&#8203;62490](nodejs/node#62490)
- \[[`f1a6e9fcc7`](nodejs/node@f1a6e9fcc7)] - **test**: allow skipping individual WPT subtests (Filip Skokan) [#&#8203;62517](nodejs/node#62517)
- \[[`23f927542e`](nodejs/node@23f927542e)] - **test**: use on-disk fixture for test-npm-install (Joyee Cheung) [#&#8203;62584](nodejs/node#62584)
- \[[`4739c45879`](nodejs/node@4739c45879)] - **test**: update WPT for url to [`7a3645b`](nodejs/node@7a3645b79a) (Node.js GitHub Bot) [#&#8203;62591](nodejs/node#62591)
- \[[`f68189b839`](nodejs/node@f68189b839)] - **test\_runner**: add `testId` to test events (Moshe Atlow) [#&#8203;62772](nodejs/node#62772)
- \[[`5c2770446e`](nodejs/node@5c2770446e)] - **test\_runner**: publish to TracingChannel for OTel instrumentation (Moshe Atlow) [#&#8203;62502](nodejs/node#62502)
- \[[`d14029be7f`](nodejs/node@d14029be7f)] - **(SEMVER-MINOR)** **test\_runner**: support test order randomization (Pietro Marchini) [#&#8203;61747](nodejs/node#61747)
- \[[`3f74a58979`](nodejs/node@3f74a58979)] - **test\_runner**: update node-config-schema (Pietro Marchini) [#&#8203;58680](nodejs/node#58680)
- \[[`60c83f6199`](nodejs/node@60c83f6199)] - **test\_runner**: fix failing suite hooks when marked with `todo` (Moshe Atlow) [#&#8203;63097](nodejs/node#63097)
- \[[`d142c584cd`](nodejs/node@d142c584cd)] - **(SEMVER-MINOR)** **test\_runner**: align mock timeout api (sangwook) [#&#8203;62820](nodejs/node#62820)
- \[[`3e72065ed6`](nodejs/node@3e72065ed6)] - **test\_runner**: fix suite rerun edge case (Moshe Atlow) [#&#8203;62860](nodejs/node#62860)
- \[[`01a9552585`](nodejs/node@01a9552585)] - **(SEMVER-MINOR)** **test\_runner**: add mock-timers support for AbortSignal.timeout (DeveloperViraj) [#&#8203;60751](nodejs/node#60751)
- \[[`dd43efffa6`](nodejs/node@dd43efffa6)] - **test\_runner**: add passed, attempt, and diagnostic to SuiteContext (Moshe Atlow) [#&#8203;62504](nodejs/node#62504)
- \[[`a12dc445cc`](nodejs/node@a12dc445cc)] - **tools**: add a check for clean git tree after tests (Antoine du Hamel) [#&#8203;62661](nodejs/node#62661)
- \[[`5b49178375`](nodejs/node@5b49178375)] - **tools**: use LTS Node.js in notify-on-push workflow (Nenad Spasenic) [#&#8203;63084](nodejs/node#63084)
- \[[`5a93bde5bb`](nodejs/node@5a93bde5bb)] - **tools**: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) [#&#8203;63065](nodejs/node#63065)
- \[[`b133019d19`](nodejs/node@b133019d19)] - **tools**: simplify `update-undici.sh` (Antoine du Hamel) [#&#8203;63044](nodejs/node#63044)
- \[[`04d3538074`](nodejs/node@04d3538074)] - **tools**: do not run `test-linux` on unrelated tools changes (Antoine du Hamel) [#&#8203;63037](nodejs/node#63037)
- \[[`4d396ac4a5`](nodejs/node@4d396ac4a5)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#&#8203;62848](nodejs/node#62848)
- \[[`9354bf40e7`](nodejs/node@9354bf40e7)] - **tools**: update gyp-next to 0.22.1 (Node.js GitHub Bot) [#&#8203;62961](nodejs/node#62961)
- \[[`c23db1ca85`](nodejs/node@c23db1ca85)] - **tools**: fix commit linter for semver-major release proposals (Antoine du Hamel) [#&#8203;62993](nodejs/node#62993)
- \[[`6e097ee3f1`](nodejs/node@6e097ee3f1)] - **tools**: consolidate and simplify .editorconfig deps section (Daijiro Wachi) [#&#8203;62887](nodejs/node#62887)
- \[[`a47ea6d6ea`](nodejs/node@a47ea6d6ea)] - **tools**: set bot as author of tools-deps-update PRs (Antoine du Hamel) [#&#8203;62856](nodejs/node#62856)
- \[[`00e86f0471`](nodejs/node@00e86f0471)] - **tools**: bump brace-expansion from 5.0.4 to 5.0.5 in /tools/eslint (dependabot\[bot]) [#&#8203;62458](nodejs/node#62458)
- \[[`cd7e262e75`](nodejs/node@cd7e262e75)] - **tools**: bump brace-expansion in /tools/clang-format (dependabot\[bot]) [#&#8203;62467](nodejs/node#62467)
- \[[`bfc1319bc8`](nodejs/node@bfc1319bc8)] - **tools**: exclude [@&#8203;node-core/doc-kit](https://github.com/node-core/doc-kit) from dependabot cooldown (Levi Zim) [#&#8203;62775](nodejs/node#62775)
- \[[`a932fbd10b`](nodejs/node@a932fbd10b)] - **tools**: re-enable undici WPTs in daily wpt.fyi job (Filip Skokan) [#&#8203;62677](nodejs/node#62677)
- \[[`f7bd9e3055`](nodejs/node@f7bd9e3055)] - **tools**: update gyp-next to 0.22.0 (Node.js GitHub Bot) [#&#8203;62697](nodejs/node#62697)
- \[[`c400d46d87`](nodejs/node@c400d46d87)] - **tools**: improve backport review script (Antoine du Hamel) [#&#8203;62573](nodejs/node#62573)
- \[[`be23b75814`](nodejs/node@be23b75814)] - **tools**: improve output for unexpected passes in WTP tests (Antoine du Hamel) [#&#8203;62587](nodejs/node#62587)
- \[[`609c013ece`](nodejs/node@609c013ece)] - **tools**: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) [#&#8203;62627](nodejs/node#62627)
- \[[`81bac1ebfd`](nodejs/node@81bac1ebfd)] - **tools**: bump the eslint group in /tools/eslint with 2 updates (dependabot\[bot]) [#&#8203;62552](nodejs/node#62552)
- \[[`1fee26522d`](nodejs/node@1fee26522d)] - **tools**: allow triagers to queue a PR for CI until it's reviewed (Antoine du Hamel) [#&#8203;62524](nodejs/node#62524)
- \[[`332088f929`](nodejs/node@332088f929)] - **tools**: do not run `commit-lint` on release proposals (Antoine du Hamel) [#&#8203;62523](nodejs/node#62523)
- \[[`9a25fc8a4d`](nodejs/node@9a25fc8a4d)] - **url**: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) [#&#8203;62574](nodejs/node#62574)
- \[[`7bd08ff60a`](nodejs/node@7bd08ff60a)] - **url**: optimize URLSearchParams set/delete duplicate handling (Gürgün Dayıoğlu) [#&#8203;62266](nodejs/node#62266)
- \[[`2d636388fa`](nodejs/node@2d636388fa)] - **url**: align default argument handling for URLPattern with webidl (Filip Skokan) [#&#8203;62719](nodejs/node#62719)
- \[[`00705a459a`](nodejs/node@00705a459a)] - **(SEMVER-MINOR)** **util**: colorize text with hex colors (Guilherme Araújo) [#&#8203;61556](nodejs/node#61556)
- \[[`0e2adb3e45`](nodejs/node@0e2adb3e45)] - **watch**: track worker entry files in watch mode (SudhansuBandha) [#&#8203;62368](nodejs/node#62368)
- \[[`c58fe38211`](nodejs/node@c58fe38211)] - **watch**: fix --env-file-if-exists crashing on linux if the file is missing (Efe) [#&#8203;61870](nodejs/node#61870)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/480
kotlarmilos added a commit to dotnet/node that referenced this pull request Aug 12, 2026
@kotlarmilos @aduh95
@deepak1556 @nsinfoPRO @nodejs-github-bot @MoLow @davidthornton @jasnell @legendecas @mcollina @marco-ippolito @RafaelGSS @pmarchini @ChALkeR @dependabot @araujogui @pimterry @watilde @addaleax @panva @islandryu @thisalihassan @guybedford @abmusse @Anshikakalpana @joyeecheung @Renegade334 @geeksilva97 @mokashang @Jah-yee @Liedtke @github-actions @umuoy1 @MikeMcC399 @RobinMalfait @inoway46 @LiviaMedeiros @marcopiraccini @trivikr @samuel871211 @ovflowd @joao-oliveira-softtor @sxa @Han5991 @atlowChemi @npm-cli-bot @ljharb @kovan @claude @RonGamzu @junius-sec @JamieMagee @mertcanaltin @DivyanshuX9 @ShogunPanda @StefanStojanovic @IlyasShabi @tniessen @richardlau
Merge upstream Node.js v24.18.1 into dotnet/main (#375)
4dc0c19 
* stream: copyedit `webstreams/adapter.js`

- Simplify `ZLIB_FAILURES` creation.
- Cache `cause.code` in `handleKnownInternalErrors` in case of a getter.
- Replace `SafePromiseAll` with `SafePromiseAllReturnVoid` to reduce the
  number of allocated promises.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63034
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* build: track PDL files as inputs in inspector GN build

The `node_protocol_generated_sources` action
was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja
to skip regeneration when PDL domain files changed.

PR-URL: https://github.com/nodejs/node/pull/62888
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>

* tools: use LTS Node.js in notify-on-push workflow

Without pinning Node.js, the runner defaults to Node 20 and npx falls
back to core-validate-commit@5.0.1 instead of 6.0.0 (requires
Node 22+). Version 5 does not recognise the ffi subsystem, causing
false invalid-commit alerts.

Signed-off-by: Nenad Spasenic <40522817+nsinfoPRO@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/63084
Fixes: https://github.com/nodejs/node/issues/63070
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

* deps: update amaro to 1.1.9

PR-URL: https://github.com/nodejs/node/pull/63090
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* test_runner: fix failing suite hooks when marked with `todo`

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/63097
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* doc: fix the TypeScript Execute (tsx) project link

Signed-off-by: David Thornton <david.m.thornton@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63093
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

* quic: start re-enabling quic with openssl 3.5

Start working on re-enabling QUIC support with the availability
of OpenSSL 3.5. This will be a multi-step process.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* deps: update ngtcp2 to 1.14.0

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* deps: update nghttp3 to 1.11.0

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* quic: update the guard to check openssl version

Since we need to be able to use the openssl adapter provided
by the ngtcp2 library, and because that adapter does not include
any compile guards to ensure that OpenSSL 3.5 is being used and
that the APIs are actually available, we need to add a compile
time check for the openssl version in order to conditionally
include the adapter to avoid build errors when using a shared
openssl library that is not OpenSSL 3.5.

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* quic: fixup windows coverage compile error

PR-URL: https://github.com/nodejs/node/pull/59381
Fixes: https://github.com/nodejs/node/issues/59369
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

* quic: fixup NO_ERROR macro conflict on windows

PR-URL: https://github.com/nodejs/node/pull/59381
Fixes: https://github.com/nodejs/node/issues/59369
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

* quic: few additional small comment edits in cid.h

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

* quic: update more of the quic to the new compile guard

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

* quic: multiple fixups and updates

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

* quic: reduce boilerplate and other minor cleanups

While I get that macros aren't the most loved thing in
the world, they do help reduce boilerplate, and there's
a lot of boilerplate in the QUIC code. This commit cleans
up some of that boilerplate, particularly around the
use of v8 APIs.

PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

* src: cleanup quic TransportParams class

PR-URL: https://github.com/nodejs/node/pull/59884
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

* src: fix small compile warning in quic/streams.cc

Fixes: https://github.com/nodejs/node/issues/60110
PR-URL: https://github.com/nodejs/node/pull/60118
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

* deps: update nghttp3 to 1.13.1

PR-URL: https://github.com/nodejs/node/pull/60046
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* deps: update nghttp3 to 1.14.0

PR-URL: https://github.com/nodejs/node/pull/61187
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* quic: copy options.certs buffer instead of detaching

The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: https://github.com/nodejs/node/pull/61403
Refs: https://github.com/nodejs/node/pull/61372
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

* quic: fix a handful of bugs and missing functionality

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

* quic: update http3 impl details

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

* quic: fixup linting/formatting issues

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

* quic: use arena allocation for packets

Previously Packets were ReqWrap objects with a shared
free-list. This commit changes to a per-Endpoint arena
with no v8 involvement. This is the design I originally
had in mind but I initially went with the simpler
freelist approach to get something working. There's
too much overhead in the reqrap/freelist approach and
individual packets do not really need to be observable
via async hooks.

This design should eliminate the risk of memory fragmentation
and eliminate a significant bottleneck in the hot path.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62589
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

* quic: move quic behind compile time flag

Move node:quic behind a compile-time flag, disabled by default.
Use --experimental-quic at configure time to enable.

- Add --experimental-quic flag to configure.py
- Add node_use_quic variable and HAVE_QUIC define
- Make QUIC sources conditional in node.gyp
- Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi
- Update C++ guards to check HAVE_QUIC
- Update process.features.quic to check node_use_quic

PR-URL: https://github.com/nodejs/node/pull/61444
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

* quic: implement rapidhash for hashing improvements

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

* src: add permission support to config file

PR-URL: https://github.com/nodejs/node/pull/60746
Backport-PR-URL: https://github.com/nodejs/node/pull/62760
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>

* test: improve config-file permission test coverage

Refs: https://github.com/nodejs/node/pull/60746#pullrequestreview-3470430664
PR-URL: https://github.com/nodejs/node/pull/60929
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* src: expose help texts into node-config-schema.json

PR-URL: https://github.com/nodejs/node/pull/58680
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

* test_runner: update node-config-schema

PR-URL: https://github.com/nodejs/node/pull/58680
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

* doc: fix node-config-schema

PR-URL: https://github.com/nodejs/node/pull/61596
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* meta: bump actions/download-artifact from 8.0.0 to 8.0.1

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: https://github.com/nodejs/node/pull/62549
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* quic: apply multiple TLS context improvements and SNI support

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

* quic: support multiple ALPN negotiation

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

* quic: fixup token verification to handle zero expiration

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

* util: colorize text with hex colors

PR-URL: https://github.com/nodejs/node/pull/61556
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* quic: add QuicEndpoint.listening & QuicStream.destroy() and tests

Starting to explore and cover the existing implementation, this covers
the basic endpoint & stream lifecycle and the exposed properties.
Added endpoint.listening to match net.Server and round out endpoint
properties, and stream.destroy() which is already called by
quicSession.destroy() and documented, but didn't actually exist.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62648
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>

* tools: add a check for clean git tree after tests

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62661
Refs: https://github.com/nodejs/node/issues/62646
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

* src: clean up experimental flag variables

- `fetch` is no longer disable by a CLI flag
- `node:sqlite` requires SQLite, obviously

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62759
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

* fs: add followSymlinks option to glob

PR-URL: https://github.com/nodejs/node/pull/62695
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>

* doc: fix duplicate word "to to" in util.styleText

PR-URL: https://github.com/nodejs/node/pull/62917
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>

* test: update WPT for streams to f8f26a372f

PR-URL: https://github.com/nodejs/node/pull/62864
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* test: update WPT for url to 258f285de0

PR-URL: https://github.com/nodejs/node/pull/63087
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* repl: keep reference count for `process.on('newListener')`

When investigating a memory leak in one of our applications,
we discovered that this listener holds on to a `REPLServer`
instance and all heap objects transitively kept alive by it
by capturing as part of its closure.

It's cleaner to declare the listener outside of the `REPLServer`
class and to actually clean it up properly when it is no longer
required or meaningful, which is easily achieved through
keeping a reference count.

PR-URL: https://github.com/nodejs/node/pull/61895
Backport-PR-URL: https://github.com/nodejs/node/pull/63194
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* crypto: remove Argon2 KDF derivation from its job setup

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62863
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Fixes: https://github.com/nodejs/node/issues/62861
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* crypto: reject unintended raw key format string input

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62974
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* doc: fix typos and inconsistencies in crypto.md and webcrypto.md

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62828
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* crypto: deduplicate and canonicalize CryptoKey usages

Fixes: https://github.com/nodejs/node/issues/62899

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62902
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Fixes: https://github.com/nodejs/node/issues/62899
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* inspector: initial support storage inspection

PR-URL: https://github.com/nodejs/node/pull/61139
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* inspector: auto collect webstorage data

PR-URL: https://github.com/nodejs/node/pull/62145
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* inspector: return errors when CDP protocol event emission fails

PR-URL: https://github.com/nodejs/node/pull/62162
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* inspector: coerce key and value to string in webstorage events

Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: https://github.com/nodejs/node/pull/62616
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Refs: https://github.com/nodejs/node/pull/62145
Refs: https://github.com/nodejs/node/pull/62162
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* test: generate `localstorage.db` in a temp dir

Co-Authored-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62660
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* deps: V8: cherry-pick 657d8de27427

Original commit message:

    [maglev] Fix throwing node inside eager inlining

    This commit refactors the exception handling logic to correctly identify
    and associate nodes with their respective `catch` blocks, even
    when multiple levels of inlining are involved.

    Previously, the check `!IsInsideTryBlock() && !is_eager_inline()` was
    insufficient to determine if catch block inside `CatchDetails` was
    already created.

    Specifically, consider the case where:
    1. Function `bar` is non-eagerly inlined into `foo`.
    2. `foo` contains a `catch` block.
    3. `bar` calls `in_bar`, which is eagerly inlined.
    4. A node within `in_bar` can `throw`.

    In this scenario, `is_eager_inline` would be true when compiling
    `in_bar`, leading to an incorrect assumption that the catch block didn't exist yet.

    This change addresses the issue by propagating a boolean value via
    `CatchDetails`. This boolean accurately indicates whether a `catch`
    block is present in the call chain, allowing for correct exception
    handling regardless of inlining depth or eagerness.

    Fixed: 417768368
    Change-Id: Ic52f72f302b4dc644bdcad939addf98111bc525b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6563500
    Commit-Queue: Victor Gomes <victorgomes@chromium.org>
    Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#100380}

Refs: https://github.com/v8/v8/commit/657d8de274276c940d07203ee43d3cf4c732cebd
PR-URL: https://github.com/nodejs/node/pull/62784
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>

* test_runner: support test order randomization

PR-URL: https://github.com/nodejs/node/pull/61747
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>

* test_runner: publish to TracingChannel for OTel instrumentation

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/62502
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* test_runner: add `testId` to test events

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/62772
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

* deps: update corepack to 0.35.0

PR-URL: https://github.com/nodejs/node/pull/63375
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

* 2026-05-21, Version 24.16.0 'Krypton' (LTS)

Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63263

* Working on v24.16.1

PR-URL: https://github.com/nodejs/node/pull/63263

* deps: update undici to 7.28.0

PR-URL: https://github.com/nodejs/node/pull/63703
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* deps: fix aix implicit declaration in OpenSSL

This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: https://github.com/nodejs/node/pull/62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

* deps: upgrade openssl sources to openssl-3.5.7

PR-URL: https://github.com/nodejs/node/pull/63820
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

* deps: update archs files for openssl-3.5.7

PR-URL: https://github.com/nodejs/node/pull/63820
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

* deps: update nghttp2 to 1.69.0

PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63164
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

* deps: fix integration issues with the latest nghttp2

This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63164
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Refs: https://hackerone.com/reports/3658225
CVE-ID: CVE-2026-48937

* deps: update llhttp to 9.4.2

PR-URL: https://github.com/nodejs-private/node-private/pull/890
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

* lib,test: redact proxy credentials in tunnel errors

Refs: https://hackerone.com/reports/3720313
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/867
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
CVE-ID: CVE-2026-48615

* permission: handle process.chdir on writereport

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/870
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987

* tls: normalize hostname for server identity checks

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/869
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48618
Refs: https://hackerone.com/reports/3688064

* http2: cap originSet size to prevent unbounded memory growth

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619

* tls: fix case-sensitive SNI context matching

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: https://github.com/nodejs-private/node-private/pull/857
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869

* dns,net: reject hostnames with embedded NUL bytes

Ref: https://hackerone.com/reports/3656716
PR-URL: https://github.com/nodejs-private/node-private/pull/868
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48930
Refs: https://hackerone.com/reports/3656716

* permission: disable FileHandle utimes with permission model

PR-URL: https://github.com/nodejs-private/node-private/pull/873
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48935
Refs: https://hackerone.com/reports/3625987

* http: fix response queue poisoning in http.Agent

Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.

Refs: https://hackerone.com/reports/3582376
PR-URL: https://github.com/nodejs-private/node-private/pull/846
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48931
Refs: https://hackerone.com/reports/3582376

* crypto: guard WebCrypto cipher output length

Reject WebCrypto cipher operations whose computed output length would
exceed INT_MAX before passing the length to OpenSSL.

This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot
cipher paths and turns oversized inputs into a clean operation failure.

Refs: https://hackerone.com/reports/3760016
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/878
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48933

* tls: bind reusable sessions to authenticated host

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48934
Refs: https://hackerone.com/reports/3649802

* test: add session reuse host verification regressions

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://hackerone.com/reports/3649802

* 2026-06-18, Version 24.17.0 'Krypton' (LTS)

This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

PR-URL: https://github.com/nodejs-private/node-private/pull/899

* Working on v24.17.1

PR-URL: https://github.com/nodejs-private/node-private/pull/899

* doc: remove list of versions in `BUILDING.md`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63113
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>

* doc: document the latest-vX.x schema

Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63033
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* doc: add Hmac.digest() documentation-only deprecation (DEP0206)

Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63121
Refs: https://github.com/nodejs/node/issues/62838
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* sqlite: keep source database alive during backup

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/62673
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* module: fix sync hook short-circuit in require() in imported CJS

- For imported CJS, if it's not customized by asynchronous hooks,
  make sure it won't use the quirky re-invented require in all
  cases.
- When the imported CJS module is customized by synchronous hooks,
  in the synthetic module evalutation step, avoid calling the
  respective default step again.
- Make the branching of loadCJSModuleWithModuleLoad() and
  loadCJSModuleWithSpecialRequire() more explicit, and fold
  the tentative fs read in the 'commonjs' translator into the
  share createCJSModuleWrap() helper instead of checking it
  twice in the same path.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62920
Fixes: https://github.com/nodejs/node/issues/63060
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

* test: use ERM to destroy sqlite database handles after tests

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/63076
Refs: https://github.com/nodejs/node/issues/63052
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>

* doc,sqlite: document entryPoint argument for loadExtension

Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63152
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

* doc: update release steps when post-release fails

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/63131
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* tls: add unsupported renegotiation error

Map BoringSSL's native renegotiation failure to
ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is
called. This avoids exposing an implementation-specific OpenSSL error
when the TLS backend does not support caller-initiated renegotiation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63161
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

* quic: remove unused binding variable in session.cc

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63177
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

* doc: clarify SEA platform support excludes darwin-x64

The Platform support section of the single-executable-applications doc
listed `macOS` without qualifying which architecture is supported.
SEA on x64 macOS is not supported and is skipped in CI; only arm64
macOS is exercised.

Refs: https://github.com/nodejs/node/issues/62893
Signed-off-by: mokashang <64570909+mokashang@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/63181
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* doc: remove unnecessary `<!-- eslint-` magic comments

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63200
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

* meta: ignore AI assistants files

Ignore CLAUDE.md and AGENTS.md in .gitignore, and exclude
them from markdown and ESLint linting.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/62612
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

* lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array

Follow WHATWG streams spec update: https://github.com/whatwg/streams/pull/1367

ReadableStreamBYOBRequest.view is always constructed as a Uint8Array.

This changes the documented return type from ArrayBufferView to
Uint8Array per the updated spec.

Fixes: https://github.com/nodejs/node/issues/62952

Signed-off-by: Jah-yee <166608075+Jah-yee@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/63017
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>

* doc: add large pull requests contributing guide

- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/62829
Fixes: https://github.com/nodejs/node/issues/62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>

* tools: use different branch for tool updates on staging branches

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63110
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

* debugger: add --help to `node inspect` and improve docs

- Add `--help` / `-h` to `node inspect` covering both interactive and
  non-interactive probe modes. The help text is printed when
  `--help`/`-h` appears before any positional argument to avoid
  hijacking `--help` passed to a child script.
- Improve the documentation of probe mode and add examples, explain
  same-location probe coalescing, TDZ caveat for let/const bindings,
  basename matching and exit code behavior. Also move it to a
  section parallel to interactive mode. Remove recommendation of
  evaluating structured expressions as that is prone to missing
  info in JSON mode.

Drive-by: When probe mode exits due to invalid arguments, exit with
`kInvalidCommandLineArgument` (9) instead of `kGenericUserError` (1).

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63201
Reviewed-By: Jan Martin <jan.krems@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>

* deps: cherry-pick libuv/libuv@a43e543

Original commit message:

    unix: fix pedantic compiler warnings (#5052)

    Fixes: https://github.com/libuv/libuv/issues/5051

Fixes: https://github.com/nodejs/node/issues/63196
Refs: https://github.com/libuv/libuv/pull/5052
Refs: https://github.com/libuv/libuv/commit/a43e543dbffba93f014fe8360a5edbe8d6ce8500
PR-URL: https://github.com/nodejs/node/pull/63222
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

* src,sqlite: remove dead code

Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63204
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>

* deps: V8: cherry-pick 435a2cdf664c

Original commit message:

    [wasm] Update WebAssembly.Exception JS API

    WebIDL specifies the existence of a
    `WebAssembly.Exception.prototype.stack` getter.
    WebIDL also expects the constructor to have 2 parameters (plus an
    optional one).

    https://webassembly.github.io/spec/js-api/#exceptions

    Bug: 336347912, 42204334
    Change-Id: I128e976a84f942dcf9b93a157534b15fad0f9215
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7697976
    Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
    Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106215}

Refs: https://github.com/v8/v8/commit/435a2cdf664ce02e0c6ea9401fbae600663e47cb
PR-URL: https://github.com/nodejs/node/pull/63136
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* crypto: improve system certificate enumeration logic on macOS

1) Fixed macOS default for missing kSecTrustSettingsResult

When kSecTrustSettingsResult is absent from a trust settings dictionary,
Apple specifies kSecTrustSettingsResultTrustRoot as the default value.

Previously, the trust result evaluation (deny check, self-issued check,
TrustAsRoot check) was inside the block that only executed when
kSecTrustSettingsResult was explicitly present. When the key was absent,
the function fell through to return UNSPECIFIED, incorrectly rejecting
self-signed certificates that should have been trusted via the default.

Move the trust result evaluation outside the conditional block so the
default value of kSecTrustSettingsResultTrustRoot flows through the
same code path as explicit values. This aligns with Chromium's
trust_store_mac.cc implementation.

2) Fix CFRelease leak in IsTrustDictionaryTrustedForPolicy: the
CFDictionaryRef returned by SecPolicyCopyProperties(policy_ref)
was not released when the policy OID matched kSecPolicyAppleSSL.

3) Deduplicate certificates: SecItemCopyMatching can return the same
certificate from multiple keychains.

4) Filter expired certificates.

Signed-off-by: deepak1556 <hop2deep@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62576
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

* doc: run license-builder

PR-URL: https://github.com/nodejs/node/pull/63232
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

* lib: fixes validator message

PR-URL: https://github.com/nodejs/node/pull/62823
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* lib: fix typo idenity => identity


PR-URL: https://github.com/nodejs/node/pull/63112
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>

* node-api: support SharedArrayBuffer in napi_create_typedarray

Signed-off-by: umuoy1 <burningdian@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62710
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com>

* meta: move one or more collaborators to emeritus

PR-URL: https://github.com/nodejs/node/pull/63235
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

* doc: recommend explicitly Tier 1 or 2 for production applications

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/63187
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* doc: replace Visual Studio 2022 Evergreen version reference with 17.14

Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/63211
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

* test: move FFI tests to `NATIVE_SUITES`

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63165
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* doc: reference correct function in Module docs

Signed-off-by: Robin Malfait <malfait.robin@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63247
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* tools: fix test426 updater

The previous version produces a commit that does pass the linter
because of a too-long commit title.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63271
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* repl: fix dedup comparing normalized line against raw history

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62886
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* test_runner: fix diagnostics channel context tracking

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/63283
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

* http2: validate non-link headers in writeEarlyHints

Validate header names and values for non-link hints passed to
writeEarlyHints() in the HTTP/2 compat layer using assertValidHeader()
and checkIsHttpToken(), consistent with the HTTP/1.1 validation added
in https://github.com/nodejs/node/pull/61897.

Previously, hints were forwarded into the headers object without any
validation, allowing invalid characters in header names/values to
surface as opaque errors deeper in the HTTP/2 stack.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/62017
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* deps: update simdjson to 4.6.4

PR-URL: https://github.com/nodejs/node/pull/62811
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* http: add writeInformation to send arbitrary 1xx status codes

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63155
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

* deps: update sqlite to 3.53.1

PR-URL: https://github.com/nodejs/node/pull/63217
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>

* test: avoid initial-break wait in restart-message

Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62060
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>

* test: avoid flaky restart sync in debugger exceptions test

Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62055
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

* stream: remove unnecessary check

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63030
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

* fs: make `Date` properties on `Stats` enumerable

Signed-off-by: LiviaMedeiros <livia@cirno.name>
PR-URL: https://github.com/nodejs/node/pull/63328
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* doc: remove inactive members from Triagers list

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63329
Fixes: https://github.com/nodejs/admin/issues/1058
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>

* test: relax min assertion in test-performance-eventloopdelay

Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63100
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

* test_runner: avoid hanging on incomplete v8 frames

Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: https://github.com/nodejs/node/pull/62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* test: fix flaky test-watch-mode-inspect timeout

This test randomly times out (~120s) on CI due to a race condition
between child-process restart (triggered by touching the watched file)
and the second inspector-session connection.

The old code used an interval-based restart (write every 500ms) and
a 'gettingDebuggedPid' flag to pause writes during a session. This
still left a race window where getDebuggedPid() would attempt to
connect the inspector via HTTP GET /json/list + WebSocket upgrade
either before the new child was ready (empty target list) or after
the old session was being destroyed, causing the promise to hang.

Fix: Replace the interval with a single write that triggers exactly
one restart, then wait for the restarted child's 'safe to debug now'
stdout line before connecting the second inspector session. This
eliminates the race by ensuring the new child process and its
inspector session are fully ready before any connection attempt.

Removes the now-unused gettingDebuggedPid flag and the pending
setTimeout delay that was needed as a backstop for the interval.

Fixes: https://github.com/nodejs/node/issues/44898
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/63361
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>

* test: reduce flakiness of `different-registry-per-thread`

There was an assumption that the `WeakRef` would be kept alive but
it seems to not always be true on Windows. This commit makes sure
it's kept alive.

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63244
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>

* test: relax test-memory-usage arrayBuffers check

Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63244
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>

* tools: update gyp-next to 0.22.2

PR-URL: https://github.com/nodejs/node/pull/63374
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

* tools: bump the eslint group in /tools/eslint with 4 updates

Bumps the eslint group in /tools/eslint with 4 updates:
[@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core),
[@babel/eslint-parser](https://github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser),
[@babel/plugin-syntax-import-source](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-syntax-import-source)
and [eslint](https://github.com/eslint/eslint).

Updates `@babel/core` from 8.0.0-rc.3 to 8.0.0-rc.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/packages/babel-core)

Updates `@babel/eslint-parser` from 8.0.0-rc.3 to 8.0.0-rc.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/eslint/babel-eslint-parser)

Updates `@babel/plugin-syntax-import-source` from 8.0.0-rc.3 to
8.0.0-rc.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/packages/babel-plugin-syntax-import-source)

Updates `eslint` from 10.2.0 to 10.2.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 8.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: "@babel/eslint-parser"
  dependency-version: 8.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: "@babel/plugin-syntax-import-source"
  dependency-version: 8.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: eslint
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
...

PR-URL: https://github.com/nodejs/node/pull/63075
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* crypto: align verifyOneShot accepted types

Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63280
Fixes: https://github.com/nodejs/node/issues/62903
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* test: deflake watch mode worker test

Trigger watch restarts by appending whitespace instead of rewriting
watched modules. This avoids transient empty or partial ESM dependency
contents while the restarted worker is loading.

Use a separate temporary directory for each subtest so concurrent
subtests do not share worker and dependency file names.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63384
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* test: avoid repeated writes in watch helper

Use performFileOperation() for test runner watch updates so the
run() API path schedules a single delayed write instead of rewriting
the file until the second run completes.

Repeated writes can trigger another watch restart while the previous
rerun is still active. The runner then terminates the in-flight child
process with SIGTERM, which can make the captured output include both
a failed file-level subtest and the next successful run.

Also count only root summary duration lines when detecting completed
runs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63386
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* doc: update http2's `push` and `trailers` events with `rawHeaders` param

Signed-off-by: Yu-Sheng Chen <samuel871211@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63259
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* doc: remove the bi-monthly contributor spotlight section

PR-URL: https://github.com/nodejs/node/pull/62734
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* doc: fix article usage before vowel-sound acronyms

Several prose references to HTTP, HTTPS, SSL, HPE_HEADER_OVERFLOW
and ECMAScript used the article "a" where the acronym starts with
a vowel sound and should take "an". The rule is based on
pronunciation, not spelling: HTTP is read "aitch-tee-tee-pee",
SSL is read "ess-es-el", ECMAScript is read "ek-mah-script",
and HPE is read "aitch-pee-ee" — all starting with a vowel sound.

Affected files:

* doc/api/crypto.md — "disable a SSL 3.0/TLS 1.0 vulnerability"
* doc/api/http.md — five occurrences ("a HTTP '400 Bad Request'",
  "a HTTP '431 Request Header Fields Too Large'", "a HTTP/1.1 102
  Processing message", two copies of "use a HTTP parser") plus
  two references to "a HPE_HEADER_OVERFLOW"
* doc/api/http2.md — two code-sample comments reading
  "// Detects if it is a HTTPS request or HTTP/2"
* doc/api/module.md — "compiles a CommonJS, a ECMAScript Module,
  or a TypeScript module" (only the middle article changes; the
  adjacent "a CommonJS" and "a TypeScript" are both correct)
* doc/api/tls.md — two references to "part of a SSL/TLS handshake"
  in tlsSocket.getFinished() and tlsSocket.getPeerFinished()

No behavior changes, documentation only.

Signed-off-by: João Victor Oliveira <joao.oliveira@softtor.com.br>
PR-URL: https://github.com/nodejs/node/pull/62696
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>

* test: deflake connection refused proxy tests

Use 127.0.0.1:10, matching existing refused-connection tests, instead
of binding and releasing an ephemeral port that can be reused before
the child process connects.

Clear NO_PROXY and no_proxy so local proxy bypass settings do not skip
the proxy connection attempt.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63395
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-15.md#jstest-failure
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* test: disable Maglev in near-heap-limit worker test

The test expects the worker to run out of memory during startup while
creating the message port. With Maglev enabled, the tiny worker heap
can be exhausted earlier while generating deoptimization data, which
changes the failure mode.

Disable Maglev so the induced OOM reaches the path covered by the test.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63398
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-18.md#jstest-failure
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

* meta: move one or more collaborators to emeritus

PR-URL: https://github.com/nodejs/node/pull/63402
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

* doc: remove unsupported template type from v8.md

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/63410
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* Revert "stream: noop pause/resume on destroyed streams"

This reverts commit 29b196694c78fa5f2fd7a9cd5083278deb69241d.

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/63834
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>

* test_runner: preserve run duration when using test-rerun

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/63429
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>

* test_runner: show replayed-from-attempt hint in spec reporter

Signed-off-by: Moshe Atlow <moshe@atlow.co.il>
PR-URL: https://github.com/nodejs/node/pull/63429
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>

* src: expose `node::RegisterContext` to make a node managed context

Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/62322
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

* test: wait for ok before initial break after restart

Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62807
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* doc: fix typo in deprecations

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63434
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

* meta: add additional gitignore entries

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* quic: fixup linting issue after other changes

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* quic: implement rate limiting for version nego and immediate close

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* quic: add reusePort option to QuicEndpoint

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

* stream: fix Writable.toWeb() hang on synchronous drain

A race condition in the Writable.toWeb() adapter caused the stream
to hang if the underlying Node.js Writable emit…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Renegade334 Renegade334 Renegade334 left review comments
@addaleax addaleax addaleax approved these changes
@cjihrig cjihrig cjihrig approved these changes

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. quic Issues and PRs related to the QUIC implementation / HTTP/3.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@legendecas @nodejs-github-bot @addaleax @cjihrig @Renegade334 @avivkeller