2026-07-22, Version 24.19.0 'Krypton' (LTS)#64654
Open
github-actions[bot] wants to merge 241 commits into
Open
2026-07-22, Version 24.19.0 'Krypton' (LTS)#64654github-actions[bot] wants to merge 241 commits into
github-actions[bot] wants to merge 241 commits into
Conversation
Replace the O(n) case-insensitive algorithm-name scan
with an O(1) SafeMap lookup. The map is pre-built at
module init alongside kSupportedAlgorithms.
Hoist the opts object literal used in normalizeAlgorithm
to module level to avoid allocating identical
{ prefix, context } objects on every call.
Pre-compute ObjectKeys() for simpleAlgorithmDictionaries
entries at module init to avoid allocating a new keys
array on every normalizeAlgorithm call.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62756
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Replace object spread in nested WebIDL conversion options with stable-shape ordinary objects. This keeps hot dictionary and sequence conversion paths from allocating null-prototype spread results. Apply the same pattern to Web Crypto converter wrappers that override allowResizable or enable [EnforceRange]. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #62756 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: Matteo Collina <matteo.collina@gmail.com> PR-URL: #62562 Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Nad Alaba <37968805+nadalaba@users.noreply.github.com> PR-URL: #63117 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: avivkeller <me@aviv.sh> PR-URL: #63493 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Rename WebCrypto operation parameters and local variables to match the spec terminology. Use operation, algorithm, and key names consistently between the docs and implementation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63518 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Drive the regression test from the WebCrypto algorithm registry so all supported algorithms and operations must add explicit coverage regardless of whether they are native-job backed or js-based. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63520 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Mert Can Altin <mertgold60@gmail.com> PR-URL: #63385 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Fix build warnings by casting the number literals to the size_t constants they are compared against. Signed-off-by: Maya Lekova <maya@igalia.com> PR-URL: #63490 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: #63668 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #63669 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #63293 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
This function call can fail with `Z_VERSION_ERROR` if the compiled
library vs loaded library mismatched in version number or in
stream structure size.
In those cases, zlib doesn't initialize the `strm_.msg` field to
null. Therefore, when a `CompressionError` object is created via
`ErrorForMessage()`, it can read a stale or uninitialized `strm_.msg`
pointer that will cause a crash.
Example ASAN report:
```
AddressSanitizer: SEGV on unknown address
#0 __strlen_avx2
string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1 strlen (/work/node/out/Debug/node+0x1a42ab7)
#2 v8::(anonymous namespace)::StringLength(char const*)
/work/node/out/../deps/v8/src/api/api.cc:7581:16
#3 v8::(anonymous namespace)::StringLength(unsigned char const*)
/work/node/out/../deps/v8/src/api/api.cc:7587:10
#4 v8::String::NewFromOneByte(v8::Isolate*,
unsigned char const*, v8::NewStringType, int)
/work/node/out/../deps/v8/src/api/api.cc:7677:3
#5 node::OneByteString(v8::Isolate*,
char const*, int, v8::NewStringType)
/work/node/out/../src/util-inl.h:166:10
#6 node::(anonymous namespace)::CompressionStream<
node::(anonymous namespace)::ZlibContext>
::EmitError(node::(anonymous namespace)
::CompressionError const&)
/work/node/out/../src/node_zlib.cc:565:7
#7 node::(anonymous namespace)::CompressionStream<
node::(anonymous namespace)::ZlibContext>
::CheckError()
/work/node/out/../src/node_zlib.cc:519:5
#8 node::(anonymous namespace)::CompressionStream<
node::(anonymous namespace)::ZlibContext>
::AfterThreadPoolWork(int)
/work/node/out/../src/node_zlib.cc:543:10
#9 node::ThreadPoolWork::ScheduleWork()
::'lambda'(uv_work_s*, int)
::operator()(uv_work_s*, int) const
/work/node/out/../src/threadpoolwork-inl.h:57:15
#10 node::ThreadPoolWork::ScheduleWork()
::'lambda'(uv_work_s*, int)
::__invoke(uv_work_s*, int)
/work/node/out/../src/threadpoolwork-inl.h:48:7
#11 uv__work_done /work/libuv-1.51.0/src/threadpool.c:330:5
#12 uv__async_io.part.0
/work/libuv-1.51.0/src/unix/async.c:208:5
```
Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: #63476
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: arbinger <alphaleadershipyt@protonmail.com> PR-URL: #63050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: #63670 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: #63644 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Update the setRawMode documentation to specify that raw mode disables special processing of input characters only. Output processing, such as newline translation on Unix terminals, is not affected. Fixes: #63059 Signed-off-by: zeeshan56656 <zeeshan130710@gmail.com> PR-URL: #63438 Reviewed-By: Anna Henningsen <anna@addaleax.net>
A recursively watched directory can be removed after a parent watcher observes it but before the non-native recursive watcher scans it. Ignore ENOENT from the directory scan so this deletion race does not emit an unhandled watcher error. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #63686 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-06-01.md#jstest-failure Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Use common.nodeProcessAborted() for the intentional abort path so platform-specific abort signals such as SIGILL are accepted. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #63687 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-06-01.md#jstest-failure Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com> PR-URL: #63700 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #63707 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add shared bit-length helpers for WebCrypto operations that accept bit sequences whose length is not byte-aligned. Use the helpers for cSHAKE output, ECDH-derived bits, HMAC/KMAC key generation/import/derivation, and KMAC sign/verify output. Preserve the requested bit length in CryptoKey algorithm metadata while storing and exporting rounded-up byte material with unused low bits cleared. Keep byte-multiple validation for algorithms whose specs require it. Extend the lower-end of KMAC's key length support. Enable cSHAKE customization and functionName parameters. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63988 Backport-PR-URL: #64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Return false for Ed25519 and Ed448 one-shot verification when the public key or signature R component is a known low-order point. This keeps key import behavior unchanged while making WebCrypto verification match WPT expectations across OpenSSL variants. Remove the stale WPT expected-failure entry and add focused regression coverage for both curves. Closes: #54572 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #64026 Backport-PR-URL: #64629 Fixes: #54572 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Original commit message:
optimize ascii fast path in WriteUtf8V2
Change-Id: If28168cb4395b953d0ec642ef4fc618ce963dbcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124103
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Erik Corry <erikcorry@chromium.org>
Reviewed-by: Erik Corry <erikcorry@chromium.org>
Cr-Commit-Position: refs/heads/main@{#103542}
Refs: v8/v8@64b36b4
PR-URL: #61712
Backport-PR-URL: #64630
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Add a samplePerIteration option to monitorEventLoopDelay that records event loop delay from libuv event loop iterations instead of the timer interval sampler. The default remains interval-based; existing uses of monitorEventLoopDelay() keep behaving the same unless the samplePerIteration option is passed through. Signed-off-by: Pablo Erhard <pablo.erhardhernandez@datadoghq.com> PR-URL: #62935 Backport-PR-URL: #64480 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Collaborator
|
Review requested:
|
github-actions
Bot
added
release
nodejs-github-bot
added a commit
that referenced
this pull request
Jul 21, 2026
Notable changes: buffer: * (SEMVER-MINOR) implement blob.textStream() (Matthew Aitken) #64036 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 * mark stream.compose stable (Matteo Collina) #62562 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 fs: * (SEMVER-MINOR) support caller-supplied readFile() buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) add httpValidation option to configure header value validation (RajeshKumar11) #61597 net: * (SEMVER-MINOR) support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825 stream: * (SEMVER-MINOR) expose ReadableStreamTee (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 * (SEMVER-MINOR) add certificateCompression option (Tim Perry) #62217 PR-URL: #64654
aduh95
force-pushed
the
v24.19.0-proposal
branch
from
July 21, 2026 14:02
56edd6b to
ee44a24
Compare
aduh95
added a commit
that referenced
this pull request
Jul 21, 2026
Notable changes: buffer: * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) #64036 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 * mark `stream.compose` stable (Matteo Collina) #62562 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 fs: * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) #61597 net: * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in setKeepAlive (Guy Bedford) #63825 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) #62935 stream: * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217 PR-URL: #64654
aduh95
marked this pull request as ready for review
July 21, 2026 14:11
This comment was marked as duplicate.
This comment was marked as duplicate.
Original commit message:
[api] Add V8::GetWasmMemoryReservationSizeInBytes()
When the system does not have enough virtual memory for the wasm
cage, installing the trap handler would cause any code allocating
wasm memory to throw. Therefore it's useful for the embedder to
know when the system doesn't have enough virtual address space
to allocate enough wasm cages and in that case, skip the
trap handler installation so that wasm code can at least work
(even not at the maximal performance).
Node.js previously has a command line option
--disable-wasm-trap-handler to fully disable trap-based bound checks,
this new API would allow it to adapt automatically while keeping the
optimization in the happy path, since it's not always possible for
end users to opt-into disabling trap-based bound checks (for example,
when a VS Code Server is loaded in a remote server for debugging).
Refs: #62132
Refs: microsoft/vscode#251777
Change-Id: I345c076af2b2b47700e5716b49c3133fdf8a0981
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7638233
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#105702}
Refs: v8/v8@bef0d9c
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #62132
Backport-PR-URL: #64338
Refs: microsoft/vscode#251777
Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7638233
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #62132 Backport-PR-URL: #64338 Refs: microsoft/vscode#251777 Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7638233 Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
Notable changes: buffer: * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) #64036 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 * mark `stream.compose` stable (Matteo Collina) #62562 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 fs: * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) #61597 net: * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in setKeepAlive (Guy Bedford) #63825 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) #62935 src: * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) #61610 stream: * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217 PR-URL: #64654
aduh95
force-pushed
the
v24.19.0-proposal
branch
from
July 21, 2026 15:29
ee44a24 to
802e8a8
Compare
aduh95
approved these changes
Jul 21, 2026
github-actions
Bot
removed
the
request-ci
Collaborator
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## v24.x #64654 +/- ##
==========================================
- Coverage 89.92% 89.88% -0.04%
==========================================
Files 686 695 +9
Lines 208683 213984 +5301
Branches 40118 41083 +965
==========================================
+ Hits 187652 192347 +4695
- Misses 13268 13690 +422
- Partials 7763 7947 +184 🚀 New features to boost your workflow:
|
RafaelGSS
requested changes
Jul 21, 2026
RafaelGSS
left a comment
RafaelGSS
left a comment
Member
There was a problem hiding this comment.
Please, let's release it after the security release https://nodejs.org/en/blog/vulnerability/july-2026-security-releases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
afd262f710] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #6403689ceffa260] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #622174bc1a093e5] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #63050b8f7e6d080] - doc: markstream.composestable (Matteo Collina) #62562bac5f170de] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #6230000522e6960] - (SEMVER-MINOR) fs: support caller-suppliedreadFile()buffers (Matteo Collina) #63634cf5e1b5ad3] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597443a43cdde] - (SEMVER-MINOR) net: supportTCP_KEEPINTVLandTCP_KEEPCNTin setKeepAlive (Guy Bedford) #6382570ebe66a96] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935a446480fdd] - (SEMVER-MINOR) src: allow empty--experimental-config-file(Marco Ippolito) #616101492bc52f1] - (SEMVER-MINOR) stream: exposeReadableStreamTee(Matteo Collina) #64195e3c0fd74b8] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119a31378a449] - (SEMVER-MINOR) tls: addcertificateCompressionoption (Tim Perry) #62217Commits
f79c0ef318] - benchmark: trim down the argon2 sets (Filip Skokan) #64218dfefe0355d] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929885fd5be0f] - buffer: remove unreachable overflow check in atob (haramjeong) #601616a57c8c999] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169afd262f710] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036f0b3a1cb0b] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747ef88b5304b] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626c84011b6b5] - build: support setting an emulator from configure script (Ivan Trubach) #53899efb9193da5] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629d0a574856b] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #641188826c3e36d] - build: suppress compiler warnings for histogram (Richard Lau) #6398073295d5f43] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #6341376bf86f2a2] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972b9f6ea79a2] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930b351fa5eee] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #6393381bfbb2c30] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026e3e371973e] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988cedc8f4ce3] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975b88f7b4a97] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #636224ce77bbf0c] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556eaeb9b60be] - crypto: reject invalid raw key imports (Filip Skokan) #63134898e70fa20] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #631042f690d774f] - crypto: fix large DH generator validation (Tobias Nießen) #640928e769b1ff1] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942622f4e1a6d] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910521e6c13bf] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #6326115ca68c6cb] - crypto: handle cipher context allocation failures (Tian Teng) #6354212986ba26e] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644400c54dc6b] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #634907607ad4e61] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #6275641eb9f34d6] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #638954f4245dc8f] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704cb467410c1] - debugger: add more logs to probe mode (Joyee Cheung) #6366361aca1f49b] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437857f7c0e64] - debugger: disambiguate probe location binding (Joyee Cheung) #632860440ddd85a] - debugger: lazily wait for initial break output (Trivikram Kamat) #6396916c511c05a] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608a42aa0a351] - debugger: await initialization after run and restart (Trivikram Kamat) #63607f6074a323a] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #6352438e03dfeb9] - deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #62132f67161c905] - deps: V8: cherry-pick 64b36b441179 (Dan Carney) #617127599d2da6b] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #6418160a3720217] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #641801078da9827] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #641103b0aca3028] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #6403976ee60649b] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #6390189ceffa260] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217ae097c6999] - deps: upgrade npm to 11.17.0 (npm team) #6385722b4005708] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #638214f36fd1a08] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #637752e2b9ed09a] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774adc3d3ce8e] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773353a2c0ff2] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670aced087ad6] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669571058fca1] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932f8c967cd83] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838ec02d3f3eb] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133020029216a] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556732e80b23b] - doc: improvefs.StatFsproperties descriptions (aymanxdev) #625788b56dffdc8] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #631996db6944c61] - doc: remove typo comma from man page (Vas Sudanagunta) #63080a23e0926c6] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187f072603344] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256f67e2e769d] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #642130776aaa788] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223e49a577806] - doc: fix typo in examples (Vas Sudanagunta) #6418464942999bd] - doc: clarify defense-in-depth issues (Matteo Collina) #642155bc303db88] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #636859238b34df0] - doc: updateHttp2Server.close&Http2SecureServer.close(YuSheng Chen) #6329870064f7804] - doc: update list of people inSECURITY.md(Richard Lau) #64152c40b6156cb] - doc: add missing option to man page (Richard Lau) #641561e793f167f] - doc: fix callback example import in fs docs (Kamal Rawal) #639127fad2004b0] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974289c648178] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193a6bd0ddf9e] - doc: add aduh95 to last security release steward (Antoine du Hamel) #6398150d0728715] - doc: fix typo in util.md (Daijiro Wachi) #63961d73c8321e1] - doc: clarify callback exceptions (Matteo Collina) #639396723b1e799] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656b7b5706850] - doc: fix typo in cli.md (Daijiro Wachi) #638839bbb9f9fd8] - doc: fix typo in vm.md (Daijiro Wachi) #63881388421eb5d] - doc: fix typo in packages.md (Daijiro Wachi) #63882d79d016a0e] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #637667a391578e3] - doc: update npm supported versions link (hojeong park) #63672683de5de16] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717556d15093c] - doc: add webstreams to args forpipelinefromstream/promises(David Sanders) #63628be256f4ab7] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #637002a710736ca] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #6343828f789da00] - doc: add worker_threads history entries (Bob Put) #635454bc1a093e5] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #630505715f25bcf] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493b8f7e6d080] - doc: mark stream.compose stable (Matteo Collina) #625628490456509] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #639245d2dc844d2] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518bac5f170de] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #623009ad3013e2e] - events: improveaddAbortListenerperf by caching options object (Raz Luvaton) #52367c6601786c4] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #6370900522e6960] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634f9b161bc05] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095b4037ae2fd] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686a7bdf3d748] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #6355658e08bbaee] - gyp: update deps gypfiles (Nad Alaba) #631174943ea5e0c] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108cf5e1b5ad3] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597a5fd145b2f] - http: fix drain event with cork/uncork (David Evans) #64038a764d89c37] - http2: retain header memory in session accounting (Matteo Collina) #63752e541150edf] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209afb8cdc045] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837b496823f84] - lib: fix missing lazyDOMException import (Filip Skokan) #6403379d9886155] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174e62b075ea8] - lib: use__proto__: nullwhen callingObjectDefineProperty(Antoine du Hamel) #64239ed86fe7622] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #6370224c8908dd3] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #636981e33e80246] - lib: add Iterator global to primordials (Renegade334) #63698e87143f85f] - lib: makeNavigator#languagegetter throw on invalidthis(Mohamed Sayed) #63601638e07c13c] - lib: optimize webidl conversion options (Filip Skokan) #62756757950a79c] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #637266d13e91bec] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850a595d80fd8] - meta: fix linter warning instale.yml(Antoine du Hamel) #6428172a7394d04] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #642482bc0c92043] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #6424739ff59a981] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #642469a8af939b6] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #642448a8428038c] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243cd9d5ac979] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242d7fde73fe2] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #642403401dde801] - meta: clarify V8 flags are outside threat model (Matteo Collina) #642241457aa1f1a] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057924daf0417] - meta: update status of past strategic initiatives (Joyee Cheung) #634801f3c82feef] - meta: speed up stale bot (Aviv Keller) #6407548a766cee2] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724273315f181] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847e7c645710d] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #6372592ac12076b] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #637288be2b1e43a] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #637276bf6251be2] - module: enable import support for addons by default (Chengzhong Wu) #6422198ce551fc0] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #637050725b90fad] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951443a43cdde] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825e69f82c897] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #6355670ebe66a96] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935deeeaacf8d] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877cc08f2a97c] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #640876fb5bb5126] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #638741d62b24a82] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854b28fe96d6b] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640a446480fdd] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #616104b70bcfc86] - src: add test flag to config file (Marco Ippolito) #60798f07d76613e] - src: rename config file testRunner to test (Marco Ippolito) #60798b459d10632] - src: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) #62132d38c790ac3] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #6408919c0eff0ea] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053fa710c2dd6] - src: avoid redundant call tostd::get_if<>()(Tobias Nießen) #64094f9cabf87d2] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #639436387105874] - src: guard OpenSSL compression header include (Filip Skokan) #64009f29949e1c6] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #6388553df1584ab] - src: do not track weakBaseObjects as childrens ofRealms (Anna Henningsen) #63842747aa0c262] - src: allow tracking children inMemoryTrackerwith weak edges (Anna Henningsen) #63842e75d973efd] - src: use C++14 deprecated attribute forNODE_DEPRECATED(Anna Henningsen) #63755e9659f5280] - src: add cleanup hooks tonode::ObjectWrap(Anna Henningsen) #636422f4e596fa0] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476b81f1b10b5] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #633850ba5cc467a] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #635290d24deade5] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #6425270e9390c86] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876b9ae1d0ecb] - stream: optimize pipeTo promise handling (Matteo Collina) #635725caf5e657e] - stream: preserve half-open duplexes in async iteration (Efe) #642751492bc52f1] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195492d7182d5] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #640486ba4e880cc] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986af215a8637] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #639641bac08661a] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909e55eeafd4f] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #6383397590e8680] - stream: check done before backpressure in stream reader (Daijiro Wachi) #636995a356ac784] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #639008aa5c840a8] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #635470f08fc2c58] - test: make blob desiredSize assertion robust (Trivikram Kamat) #641064a0ff0e5c7] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #640378c8ff866d5] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049c76dd4a4a5] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085562b09855d] - test: fix typo from overriden to overridden (parkhojeong) #63403227033df94] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #640541be32f377f] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #640522ccc4c6a86] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #640516f345594ed] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937d2dc033e1b] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #640066f3e3429b9] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899b8d3f5efa3] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #6389841e78113c3] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765d86c1d9f94] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743b4e941c4c3] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #637642b50ee30bb] - test: add coverage outside SEA (Daijiro Wachi) #637449386db5442] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #637714a2303a525] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389a6b5163169] - test: add regression test for usingObjectWrapin worker (Mohamed Akram) #6364285487ceaf6] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #636879c417fd2e0] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293f9f192a125] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668fc2c6c9999] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #63520d6b2834aaa] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748494d8e0192] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675c048b3afc7] - test_runner: cacheshouldSkipFileCoverageresult per URL (sangwook) #636757f3f9de083] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #635103ae5f8c1d2] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #635331cdef79adc] - test_runner: add parentId to test events with testId (Moshe Atlow) #63435b2f155e10c] - test_runner: fix hooks test context (Moshe Atlow) #63285872910a065] - test_runner: add tags option and tag-name filter (Chemi Atlow) #63221a0cab5aee4] - test_runner: addgetTestContext()(Moshe Atlow) #62501439694dbdc] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056610db93fba] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #640500cd81ec86a] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029d24afc262b] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847ebd2b91326] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #6369088c1699651] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #64254e3c0fd74b8] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641196f75a89a89] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093a31378a449] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217cf039e2650] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822dff51131ea] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249a7a3174797] - tools: update c-ares updater script (Antoine du Hamel) #64194e5ad190e02] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #6407062a7ff09f0] - tools: update sccache to v0.16.0 (Michaël Zasso) #630785c9e1b5eac] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #639487278e4d6ab] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #6394702cbcc3baa] - tools: update the llhttp updater script (Antoine du Hamel) #63819b82d8cd923] - tools: align Bash snippets in GHA withlint-shconventions (Antoine du Hamel) #638290f5467360b] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #637301692fdbb4c] - tools: fix zlib updater script (Antoine du Hamel) #63707fb4d8db0fa] - typings: add typing for crypto (Filip Skokan) #64122898c4a81ee] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #637829ce79b28b0] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #640227e85198d14] - util: fix scientific notation formatting (Daijiro Wachi) #638234e8db7fc92] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815991956e819] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706066120125e] - watch: print name of changed file that triggers restart (Marco) #6378128f380d588] - watch: cancel pending restart on shutdown (Trivikram Kamat) #633838170bbcb63] - zlib: validate flush king for all streams (Ic3b3rg) #6374600ae7a61f6] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746ccbe0819cf] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023a58a224797] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023be4b3fe966] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556