Skip to content

2026-02-10, Version 25.6.1 (Current)#61739

Open
github-actions[bot] wants to merge 50 commits intov25.xfrom
v25.6.1-proposal
Open

2026-02-10, Version 25.6.1 (Current)#61739
github-actions[bot] wants to merge 50 commits intov25.xfrom
v25.6.1-proposal

Conversation

@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Feb 8, 2026

Small release to address #61679

Commits
  • [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456
  • [c78c49ed6b] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
  • [4790816d9b] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #61732
  • [8c71740e8a] - deps: update undici to 7.21.0 (Node.js GitHub Bot) #61683
  • [e559ef6ab1] - deps: update googletest to 56efe3983185e3f37e43415d1afa97e3860f187f (Node.js GitHub Bot) #61605
  • [300de2bb5a] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603
  • [e71e9505ef] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #61453
  • [439b816bc7] - doc: clarify EventEmitter error handling in threat model (Matteo Collina) #61701
  • [c1c6641f23] - doc: mention default option for test runner env (Steven) #61659
  • [41ec451f98] - doc: fix --inspect security warning section (Tim Perry) #61675
  • [bb90ef2356] - doc: document url.format(urlString) as deprecated under DEP0169 (René) #61644
  • [513df82e6f] - doc: update to Visual Studio 2026 manual install (Mike McCready) #61655
  • [9409d30736] - doc: deprecation add more codemod (Augustin Mauroy) #61642
  • [75a7a67151] - doc: fix grammatical error in README.md (ayj8201) #61653
  • [821e59e884] - doc: correct tools README Boxstarter link (Mike McCready) #61638
  • [4998f539a0] - doc: update server.dropMaxConnection link (YuSheng Chen) #61584
  • [9383ac4ab7] - http: implement slab allocation for HTTP header parsing (Mert Can Altin) #61375
  • [e90eb1d561] - meta: persist sccache daemon until end of build workflows (René) #61639
  • [ade36ac367] - meta: bump github/codeql-action from 4.31.9 to 4.32.0 (dependabot[bot]) #61622
  • [26638bd67f] - meta: bump step-security/harden-runner from 2.14.0 to 2.14.1 (dependabot[bot]) #61621
  • [eaa9a96cb6] - meta: bump actions/setup-python from 6.1.0 to 6.2.0 (dependabot[bot]) #61627
  • [fd98187828] - meta: bump cachix/cachix-action (dependabot[bot]) #61626
  • [820c1d021c] - meta: bump actions/setup-node from 6.1.0 to 6.2.0 (dependabot[bot]) #61625
  • [72a4136bd5] - meta: bump actions/cache from 5.0.1 to 5.0.3 (dependabot[bot]) #61624
  • [e3ef6cb3bc] - meta: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (dependabot[bot]) #61623
  • [020a836202] - meta: bump actions/stale from 10.1.0 to 10.1.1 (dependabot[bot]) #61620
  • [0df72f07c8] - meta: bump actions/checkout from 6.0.1 to 6.0.2 (dependabot[bot]) #61619
  • [d147c08b83] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #61529
  • [a2843f8556] - net: defer synchronous destroy calls in internalConnect (RajeshKumar11) #61658
  • [7fb7030781] - repl: fix flaky test-repl-programmatic-history (Matteo Collina) #61614
  • [d4c9b5cf5b] - sqlite: avoid extra copy for large text binds (Ali Hassan) #61580
  • [aa1b3661d9] - sqlite: use DictionaryTemplate for run() result (Mert Can Altin) #61432
  • [9c8ad7e881] - src: elide heap allocation in structured clone implementation (Anna Henningsen) #61703
  • [c4ecfef93d] - src: use simdutf for one-byte string UTF-8 write in stringBytes (Mert Can Altin) #61696
  • [28905b9734] - src: consolidate C++ ReadFileSync/WriteFileSync utilities (Joyee Cheung) #61662
  • [adce20c0a1] - test: print stack immediately avoiding GC interleaving (Chengzhong Wu) #61699
  • [7643bc8999] - test: fix case-insensitive path matching on Windows (Matteo Collina) #61682
  • [23d1ecf66f] - test: fix flaky test-performance-eventloopdelay (Matteo Collina) #61629
  • [99012a88ed] - test: remove duplicate wpt tests (Filip Skokan) #61617
  • [a8b32b8ce1] - test: fix race condition in watch mode tests (Matteo Collina) #61615
  • [086a5a5a25] - test: update WPT for url to e3c46fdf55 (Node.js GitHub Bot) #61602
  • [f0574fd419] - test: use the skipIfNoWatch() utility function (Luigi Pinca) #61531
  • [b064ddc221] - test: unify assertSnapshot common patterns (Chengzhong Wu) #61590
  • [17122e521b] - test_runner: fix test enqueue when test file has syntax error (Edy Silva) #61573
  • [bad3f02dd9] - tools: enforce removal of lts-watch-* labels on release proposals (Antoine du Hamel) #61672
  • [a8f33fd6bd] - tools: use ubuntu-slim runner in meta GitHub Actions (Tierney Cyren) #61663
  • [c843e447ca] - tools: test --shared-merve in test-shared workflow (Antoine du Hamel) #61649
  • [2fedc03f96] - tools: update OpenSSL to 3.5.5 in test-shared (Antoine du Hamel) #61551
  • [1c1db94670] - tools,win: upgrade install additional tools to Visual Studio 2026 (Mike McCready) #61562

anonrig and others added 30 commits February 8, 2026 10:06
PR-URL: #61456
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #61573
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Previously the resolve hook can be invoked twice from the
synthetic module evaluation step of imported CJS in the extra
module._load() call that's invoked on the resolved full path.
Add an option to avoid it, since the resolution and loading
has already been done before.

PR-URL: #61529
Fixes: #57125
Refs: #55808
Refs: #56241
Reviewed-By: Jacob Smith <jacob@frende.me>
Unifes assertSnapshot common patterns like platform specific path
separators, line ending, line trailing spaces, Node.js version strings,
and pids in warning messages.

PR-URL: #61590
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #61603
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #61605
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61584
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Use the `skipIfNoWatch()` utility function in
`test/parallel/test-fs-promises-watch-iterator.js`.

PR-URL: #61531
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
PR-URL: #61602
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
The watch mode tests using runInBackground() had a race condition where
stdout "Failed running" message could arrive before stderr was fully
collected, causing assertions on stderr content to fail with empty
strings.

Fix by waiting for stderr 'data' event if stderr is empty when "Failed
running" is detected. This is an event-driven approach rather than
timing-based.

Refs: nodejs/reliability#1450
PR-URL: #61615
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61617
Refs: #61316
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8e8c483...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61619
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [actions/stale](https://github.com/actions/stale) from 10.1.0 to 10.1.1.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5f858e3...9971854)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61620
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.0.0 to 8.1.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@98357b1...c0f553f)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61623
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.1 to 5.0.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@9255dc7...cdf6c1f)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61624
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@395ad32...6044e13)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61625
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [cachix/cachix-action](https://github.com/cachix/cachix-action) from 0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad to 3ba601ff5bbb07c7220846facfa2cd81eeee15a1.
- [Release notes](https://github.com/cachix/cachix-action/releases)
- [Commits](cachix/cachix-action@0fc0201...3ba601f)

---
updated-dependencies:
- dependency-name: cachix/cachix-action
  dependency-version: 3ba601ff5bbb07c7220846facfa2cd81eeee15a1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61626
Refs: cachix/cachix-action@3ba601f
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@83679a8...a309ff8)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61627
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61551
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.0 to 2.14.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@20cf305...e3f713f)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61621
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.9 to 4.32.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5d4e8d1...b20883b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61622
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61375
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #61638
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
PR-URL: #61639
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Newer c-ares versions set tcp_port/udp_port to 53 instead of 0,
which caused the loopback detection to fail. This fix:

- Removes the port check from loopback detection
- Adds IPv6 loopback (::1) support
- Calls EnsureServers() before each DNS query

PR-URL: #61453
Reviewed-By: Anna Henningsen <anna@addaleax.net>
The test was flaky because the histogram sampling might not have
completed before the assertions ran. By using setImmediate before
disabling the histogram and checking values, we give the event loop
a chance to record final samples on slower systems.

Also added an explicit check for histogram.count > 0 to provide a
clearer error message if no samples are recorded.

Refs: nodejs/reliability#1450
PR-URL: #61629
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #61649
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Corrected wording for clarity in README.

PR-URL: #61653
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61432
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
PR-URL: #61562
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
RajeshKumar11 and others added 14 commits February 8, 2026 10:10
Defer socket.destroy() calls in internalConnect and
internalConnectMultiple to the next tick. This ensures that error
handlers have a chance to be set up before errors are emitted,
particularly important when using http.request with a custom
lookup function that returns synchronously.

Previously, if a synchronous lookup function returned an IP that
triggered an immediate error (e.g., via blockList), the error would
be emitted before the HTTP client had set up its error handler
(which happens via process.nextTick in onSocket). This caused
unhandled 'error' events.

Fixes: #48771
PR-URL: #61658
Refs: #51038
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
On Windows, file paths are case-insensitive but string comparison is
case-sensitive. When the drive letter case differs between the computed
project root and the actual output (e.g., 'C:/' vs 'c:/'), the path
replacement in transformProjectRoot() would fail.

This fix uses case-insensitive regex replacement on Windows to ensure
paths are correctly normalized in snapshot tests regardless of drive
letter casing.

Refs: nodejs/reliability#1453
PR-URL: #61682
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: #61683
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
PR-URL: #61675
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
This patch moves `ReadFileSync` and `WriteFileSync` from
`src/util.cc` to `src/node_file_utils.cc`, consolidates
the implementation to reuse code, and adds a few more
enhancements:

For `ReadFileSync`:

- Use fstat-based pre-allocation to minimize buffer resizing
  and repeated reads for bigger files.
- Handle various potential overflows in size conversions.
- Handle fallback for 0-byte special files.

For `WriteFileSync`:

- Handle potential partial writes for big enough files and
  support non-seekable files (with -1 as offset).
- Handle 0-byte writes correctly.

In both cases, this now avoids hard aborts and return error code
for the caller to handle as much as possible, except
`std::vector<char> ReadFileSync(FILE* fp)` which is part of the
embedder API.

This patch uses the new `ReadFileSync` to address a TODO in
node_sea.bin.cc.

PR-URL: #61662
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
When binding UTF-8 strings to prepared statements, transfer ownership of
malloc-backed Utf8Value buffers to SQLite to avoid an extra copy for
large strings. Use sqlite3_bind_blob64() when binding BLOB parameters.

PR-URL: #61580
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
PR-URL: #61696
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: #61659
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
`require(mod)` does not keep the mod in require cache if
mod throws synchronously. This fixes the tests to print
the stack immediately in case that source map cache could
be cleaned up when the CJS module is reclaimed by GC in
the next event loop tick.

PR-URL: #61699
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add documentation explaining that applications are expected to attach
'error' event handlers to EventEmitters that can emit errors, including
HTTP streams. Crashes resulting from missing error handlers are not
considered denial-of-service vulnerabilities in Node.js.

PR-URL: #61701
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Small perf improvement:

    $ node benchmark/compare.js --runs 100 \
    >   --old ./node-0da120f879 --new ./node \
    >   --filter structured-clone misc > comparison.csv && \
    >   npx node-benchmark-compare comparison.csv

    [00:02:15|% 100| 1/1 files | 200/200 runs | 3/3 configs]: Done
                                                        confidence improvement accuracy (*)   (**)  (***)
    misc/structured-clone.js n=10000 type='arraybuffer'         **      1.81 %       ±1.28% ±1.68% ±2.16%
    misc/structured-clone.js n=10000 type='object'               *      0.62 %       ±0.55% ±0.73% ±0.93%
    misc/structured-clone.js n=10000 type='string'             ***      8.30 %       ±1.46% ±1.92% ±2.47%

    Be aware that when doing many comparisons the risk of a false-positive result increases.
    In this case, there are 3 comparisons, you can thus expect the following amount of false-positive results:
      0.15 false positives, when considering a   5% risk acceptance (*, **, ***),
      0.03 false positives, when considering a   1% risk acceptance (**, ***),
      0.00 false positives, when considering a 0.1% risk acceptance (***)

PR-URL: #61703
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #61732
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
PR-URL: #61730
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Notable changes:

build,deps:
  * replace cjs-module-lexer with merve (Yagiz Nizipli) #61456

PR-URL: #61739
@github-actions github-actions bot added release Issues and PRs related to Node.js releases. v25.x Issues that can be reproduced on v25.x or PRs targeting the v25.x-staging branch. labels Feb 8, 2026
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/releasers

@aduh95 aduh95 marked this pull request as ready for review February 8, 2026 16:05
@aduh95 aduh95 requested a review from a team as a code owner February 8, 2026 16:05
@aduh95 aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. label Feb 8, 2026
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 8, 2026
@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented Feb 8, 2026

@codecov
Copy link

codecov bot commented Feb 8, 2026

Codecov Report

❌ Patch coverage is 77.50678% with 83 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.70%. Comparing base (f8a81d1) to head (fbc836e).
⚠️ Report is 1 commits behind head on v25.x.

Files with missing lines Patch % Lines
src/node_file_utils.cc 62.31% 30 Missing and 22 partials ⚠️
src/node_cjs_lexer.cc 77.55% 8 Missing and 3 partials ⚠️
src/cares_wrap.cc 11.11% 8 Missing ⚠️
src/node_http_parser.cc 88.70% 1 Missing and 6 partials ⚠️
lib/internal/modules/esm/translators.js 75.00% 3 Missing ⚠️
lib/net.js 92.30% 1 Missing ⚠️
src/node_sqlite.cc 96.55% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##            v25.x   #61739      +/-   ##
==========================================
+ Coverage   88.80%   89.70%   +0.89%     
==========================================
  Files         679      681       +2     
  Lines      204193   204388     +195     
  Branches    39151    39276     +125     
==========================================
+ Hits       181328   183339    +2011     
+ Misses      15113    13350    -1763     
+ Partials     7752     7699      -53     
Files with missing lines Coverage Δ
lib/internal/modules/cjs/loader.js 98.35% <100.00%> (+3.85%) ⬆️
lib/internal/repl/history.js 93.60% <100.00%> (+1.17%) ⬆️
lib/internal/source_map/source_map_cache_map.js 99.17% <100.00%> (+0.02%) ⬆️
lib/internal/test_runner/runner.js 93.14% <100.00%> (+0.02%) ⬆️
lib/repl.js 94.15% <100.00%> (+0.02%) ⬆️
src/node_binding.cc 82.74% <ø> (ø)
src/node_builtins.cc 76.14% <ø> (-0.05%) ⬇️
src/node_internals.h 82.35% <ø> (ø)
src/node_messaging.cc 82.53% <100.00%> (+0.35%) ⬆️
src/node_metadata.cc 92.95% <100.00%> (ø)
... and 11 more

... and 98 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@aduh95
Copy link
Contributor

aduh95 commented Feb 8, 2026

@legendecas I'm suspecting b064ddc to be the cause of the failures, could you take a look?

@legendecas
Copy link
Member

#61748 could be a fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Issues and PRs related to Node.js releases. v25.x Issues that can be reproduced on v25.x or PRs targeting the v25.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.