node - 米舟开源

nodejs/node

Watch

Star

Fork

简介统计版本

2 days ago

node

nodejs

2026-01-26, Version 25.5.0 (Current), @aduh95

Notable Changes

[99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
[fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167
[0feab0f083] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #61167
[e91b296001] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #61433
[b351910af1] - (SEMVER-MINOR) sea: add --build-sea to generate SEA directly with Node.js binary (Joyee Cheung) #61167
[957292e233] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #61167
[f289817ff8] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #61266
[069f3603e2] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #61311
[5a984b9a09] - src: use node- prefix on thread names (Stewart X Addison) #61307
[75c06bc2a8] - (SEMVER-MINOR) test: migrate to --build-sea in existing SEA tests (Joyee Cheung) #61167
[cabd58f1cb] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #61167
[ff1fcabfc9] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #60669

Commits

[778a56f3c9] - assert,util: fix deep comparison for sets and maps with mixed types (Ruben Bridgewater) #61388
[32cd18e37f] - async_hooks: enabledHooksExist shall return if hooks are enabled (Gerhard Stöbich) #61054
[482b2568bc] - benchmark: add SQLite benchmarks (Guilherme Araújo) #61401
[e9a34263bb] - buffer: make methods work on Uint8Array instances (Neal Beeken) #56578
[8255cdefcf] - build: add --shared-nbytes configure flag (Antoine du Hamel) #61341
[8dd379d110] - build: update android-patches/trap-handler.h.patch (Mo Luo) #60369
[1b4b5eb0e4] - build: update devcontainer.json to use paired nix env (Joyee Cheung) #61414
[86e2a763ad] - build: infer cargo mode with gyp var build_type directly (Chengzhong Wu) #61354
[7e211e6942] - build: add embedtest into native suite (Joyee Cheung) #61357
[637470e79f] - build: fix misplaced comma in ldflags (hqzing) #61294
[a1a0f77a45] - build: fix crate vendor file checksums on windows (Chengzhong Wu) #61329
[d597b8e342] - build,tools: fix addon build deadlock on errors (Vladimir Morozov) #61321
[b5cdc27ba4] - build,win: improve logs when ClangCL is missing (Mike McCready) #61438
[ef01f0c033] - build,win: update WinGet configurations to Python 3.14 (Mike McCready) #61431
[d8a1cdeefe] - child_process: treat ipc length header as unsigned uint32 (Ryuhei Shima) #61344
[588b00fafa] - cluster: fix port reuse between cluster (Ryuhei Shima) #60141
[99a4e51f93] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #61419
[048f7a5c9c] - deps: upgrade npm to 11.8.0 (npm team) #61466
[fbe4da5725] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167
[0feab0f083] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #61167
[4bb00d7e3c] - deps: update googletest to 85087857ad10bd407cd6ed2f52f7ea9752db621f (Node.js GitHub Bot) #61417
[6a3c614f27] - deps: update sqlite to 3.51.2 (Node.js GitHub Bot) #61339
[13c0397d6d] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523
[098ec6f196] - deps: update ada to v3.4.0 (Yagiz Nizipli) #61315
[320b576125] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #61135
[98f5e7cf51] - deps: V8: cherry-pick highway@dcc0ca1cd42 (Richard Lau) #61008
[e326df79c9] - deps: V8: backport 209d2db9e24a (Zhijin Zeng) #61322
[ccfd9d9b30] - doc: remove v prefix for version references (Mike McCready) #61488
[b6cc5d77a1] - doc: mention constructor comparison in assert.deepStrictEqual (Hamza Kargin) #60253
[236d7ee635] - doc: add CVE delay mention (Rafael Gonzaga) #61465
[0729fb6ee7] - doc: update previous version links in BUILDING (Mike McCready) #61457
[0fb464252f] - doc: include OpenJSF handle for security stewards (Rafael Gonzaga) #61454
[3331bdca7c] - doc: clarify process.argv[1] behavior for -e/--eval (Jeevankumar S) #61366
[94b34c38e2] - doc: remove Windows Dev Home instructions from BUILDING (Mike McCready) #61434
[a17016ee81] - doc: clarify TypedArray properties on Buffer (Roman Reiss) #61355
[214fac9d7e] - doc: update Python 3.14 manual install instructions (Windows) (Mike McCready) #61428
[6a32a685a6] - doc: note resume build should not be done on node-test-commit (Stewart X Addison) #61373
[2a8e8dfaf3] - doc: refine WebAssembly error documentation (sangwook) #61382
[f3caf27f8b] - doc: add deprecation history for url.parse (Eng Zer Jun) #61389
[5ab8057856] - doc: add marco and rafael in last sec release (Marco Ippolito) #61383
[f83cb1e785] - doc: packages: example of private import switch to internal (coderaiser) #61343
[3d23bcd0e2] - doc: add esm and cjs examples to node:v8 (Alfredo González) #61328
[1d159550e0] - doc: added 'secure' event to tls.TLSSocket (ikeyan) #61066
[90080d2892] - doc: restore @watilde to collaborators (Daijiro Wachi) #61350
[a87f7a50f8] - doc: run license-builder (github-actions[bot]) #61348
[adf5c84701] - doc: clean up writing-and-running-benchmarks.md (Hardanish Singh) #61345
[2be98add0c] - doc: document ALPNCallback option for TLSSocket constructor (ikeyan) #61331
[2db4893c8d] - esm: ensure watch mode restarts after syntax errors (Xavier Stouder) #61232
[828feb2e6b] - events: remove redundant todo (Gürgün Dayıoğlu) #60595
[e91b296001] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #61433
[606184fae5] - fs: remove duplicate getValidatedPath calls (Mert Can Altin) #61359
[434fcd7f8f] - fs: fix errorOnExist behavior for directory copy in fs.cp (Nicholas Paun) #60946
[bacba16f5e] - fs: fix ENOTDIR in globSync when file is treated as dir (sangwook) #61259
[7697ce0310] - fs: remove duplicate fd validation in sync functions (Mert Can Altin) #61361
[8abd54f597] - gyp: aix: change gcc version detection so CXX="ccache g++" works (Stewart X Addison) #61464
[24033ee7ea] - http: fix rawHeaders exceeding maxHeadersCount limit (Max Harari) #61285
[cf56327939] - http2: validate initialWindowSize per HTTP/2 spec (Matteo Collina) #61402
[696935eeeb] - inspector: initial support storage inspection (Ryuhei Shima) #61139
[3d5e718e38] - lib: fix typo in util.js comment (Taejin Kim) #61365
[f55a5fea00] - lib: fix TypeScript support check in jitless mode (sangwook) #61382
[b3fbc3c375] - meta: do not fast-track npm updates (Antoine du Hamel) #61475
[2423ecdaef] - meta: fix typos in issue template config (Daijiro Wachi) #61399
[e2df85a33a] - meta: label v8 module PRs (René) #61325
[bc9e5f7d4d] - node-api: fix node_api_create_object_with_properties name (Vladimir Morozov) #61319
[4f30c21c59] - node-api: use Node-API in comments (Vladimir Morozov) #61320
[62d71eb28d] - quic: copy options.certs buffer instead of detaching (Chengzhong Wu) #61403
[4bbbe75ba1] - quic: move quic behind compile time flag (Matteo Collina) #61444
[b351910af1] - (SEMVER-MINOR) sea: add --build-sea to generate SEA directly with Node.js binary (Joyee Cheung) #61167
[957292e233] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #61167
[f289817ff8] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #61266
[6442229880] - sqlite: add some tests (Guilherme Araújo) #61410
[069f3603e2] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #61311
[df02d00d61] - src: improve StringBytes::Encode perf on UTF8 (Сковорода Никита Андреевич) #61131
[e35814ba80] - src: add missing override specifier to Clean() (Tobias Nießen) #61429
[803ff7d3de] - src: cache context lookup in vectored io loops (Mert Can Altin) #61387
[58abe99cbf] - src: cache missing package.json files in the C++ package config cache (Michael Smith) #60425
[2a542094e4] - src: use starts_with instead of rfind/find (Tobias Nießen) #61426
[77cacf6d9d] - src: use C++ nullptr in sqlite (Tobias Nießen) #61416
[344cc629d4] - src: use C++ nullptr in webstorage (Tobias Nießen) #61407
[9f25cad26c] - src: fix pointer alignment (jhofstee) #61336
[5a984b9a09] - src: use node- prefix on thread names (Stewart X Addison) #61307
[d4cf423a65] - stream: export namespace object from internal end-of-stream module (René) #61455
[7d8232e34c] - test: add some validation for JSON doc output (Antoine du Hamel) #61413
[75c06bc2a8] - (SEMVER-MINOR) test: migrate to --build-sea in existing SEA tests (Joyee Cheung) #61167
[cabd58f1cb] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #61167
[bcffca8911] - test: aix: mark test_threadsafe_function/test flaky on AIX (Stewart X Addison) #61452
[29399501c1] - test: add implicit test for fs dispose handling with using (Ilyas Shabi) #61140
[3bb481571a] - test: reveal wpt evaluation errors in status files (Chengzhong Wu) #61358
[a132be7f71] - test: check new WebCryptoAPI enum values (Filip Skokan) #61406
[72f1463735] - test: split test-esm-loader-hooks (Joyee Cheung) #61374
[39105e4c5f] - test: aix: mark test-emit-on-destroyed as flaky (Stewart X Addison) #61381
[3f17acfb1c] - test: add webidl web-platform tests (Yagiz Nizipli) #61316
[89983cf747] - test: update url web-platform tests (Yagiz Nizipli) #61315
[73c0a242d7] - test: forbid use of named imports for fixtures (Antoine du Hamel) #61228
[a49d54308e] - test: enforce better never-settling-promise detection (Antoine du Hamel) #60976
[335cb0b5cc] - test: ensure assertions are reached on all tests (Antoine du Hamel) #60845
[5ee02c789a] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60763
[141fb82ffb] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60760
[edf90ce457] - test: use RegExp.escape to improve test reliability (Antoine du Hamel) #60803
[f5f9b2dcf6] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60728
[ec1cbbe0b6] - test_runner: fix memory leaks in runner (Abhishek Kv. Savani) #60860
[399ac68427] - test_runner: fix coverage report when a directory is named file (Heath Dutton🕴️) #61169
[6e1beda333] - test_runner: print info when test restarts (Xavier Stouder) #61160
[f5803ccb86] - test_runner: fix rerun ambiguous test failures (Moshe Atlow) #61392
[a5a4c3eb44] - test_runner: nix dead reporter code (Vas Sudanagunta) #59700
[ff1fcabfc9] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #60669
[ade4fc2338] - tools: copyedit Nix files (Antoine du Hamel) #61447
[7c2242beb9] - tools: validate release commit diff as part of lint-release-proposal (Antoine du Hamel) #61440
[ca4ebed258] - tools: use ad-hoc flag to lint Nix files (Antoine du Hamel) #61405
[05ce2c87f3] - tools: fix vcbuild lint-js-build (Vladimir Morozov) #61318
[41adb54a37] - tools: enforce trailing commas in test/es-module (Antoine du Hamel) #60891
[eebd732a52] - tools: enforce trailing commas in test/sequential (Antoine du Hamel) #60892
[8b73739e03] - typings: add typing for string_decoder (Taejin Kim) #61368
[e88dd012ad] - v8: changing total_allocated_bytes to avoid ABI changes (Caio Lima) #60800
[c75ad3d87d] - v8: add GCProfiler support for erm (Ilyas Shabi) #61191
[611c179663] - zlib: validate write_result array length (Ryuhei Shima) #61342

9 days ago

node

nodejs

2026-01-19, Version 25.4.0 (Current), @RafaelGSS

Notable Changes

[8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959
[bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
[7930d7a19b] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
[44f61dfb92] - doc: add @avivkeller to collaborators (Aviv Keller) #61115
[45903ee884] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
[77faa14d99] - doc: mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) #60954
[aefbe4ba47] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #60214
[8470e2993b] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #60953
[24384d7438] - meta: add Renegade334 to collaborators (Renegade334) #60714
[c1acef6d0f] - module: mark require(esm) as stable (Joyee Cheung) #60959
[2e39f3ed6b] - module: mark module compile cache as stable (Joyee Cheung) #60971
[e6a05cfb4f] - (SEMVER-MINOR) module: allow subpath imports that start with #/ (Jan Martin) #60864
[fa927c31da] - (SEMVER-MINOR) process: preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) #60913
[bd0942f4f5] - (SEMVER-MINOR) stream: do not pass readable.compose() output via Readable.from() (René) #60907
[5051d90100] - (SEMVER-MINOR) util: add convertProcessSignalToExitCode utility (Erick Wendel) #60963
[408f024906] - v8: mark v8.queryObjects() as stable (Joyee Cheung) #60957

Commits

[e61cfdbf50] - assert: use a set instead of an array for faster lookup (Ruben Bridgewater) #61076
[11861084fd] - assert,util: improve comparison performance (Ruben Bridgewater) #61176
[4ef4f759cb] - assert,util: fix deep comparing invalid dates skipping properties (Ruben Bridgewater) #61076
[c8fccd585f] - assert,util: improve deep comparison performance (Ruben Bridgewater) #61076
[13661a0123] - benchmark: use boolean options in benchmark tests (SeokhunEom) #60129
[36dead3433] - benchmark: allow boolean option values (SeokhunEom) #60129
[376056eaef] - benchmark: add microbench on isInsideNodeModules (Chengzhong Wu) #60991
[22d3e85b7a] - benchmark: fix incorrect base64 input in byteLength benchmark (semimikoh) #60841
[5016f75522] - benchmark: use typescript for import cjs benchmark (Joyee Cheung) #60663
[012a08f6eb] - buffer: let Buffer.of use heap (Сковорода Никита Андреевич) #60503
[65696e42ba] - build: add --shared-hdr-histogram configure flag (Antoine du Hamel) #61280
[6155b8836e] - build: add --shared-gtest configure flag (Antoine du Hamel) #61279
[e80127f49c] - build: expose libplatform symbols in shared libnode (Joyee Cheung) #61144
[d99805049e] - build: fix inconsistent quoting in Makefile (Antoine du Hamel) #60511
[3213de08e8] - build: support building crates (temporal) on windows (沈鸿飞) #61163
[1ad8788391] - build: remove temporal updater (Chengzhong Wu) #61151
[e6e25d65be] - build: add --debug-symbols to build with -g without enabling DCHECKs (Joyee Cheung) #61100
[7040ec94c8] - build: update test-wpt-report to use NODE instead of OUT_NODE (Filip Skokan) #61024
[990da3518d] - build: skip build-ci on actions with a separate test step (Chengzhong Wu) #61073
[3259e395c9] - build: run embedtest with node_g when BUILDTYPE=Debug (Chengzhong Wu) #60850
[af42ca569f] - build: ignore built-in temporal when building with shared lib (Chengzhong Wu) #60703
[bec7fce07a] - build: add temporal_capi gyp (Chengzhong Wu) #60703
[d2f50047f7] - build: fix OpenSSL version parsing for OpenSSL < 3 (Richard Lau) #60775
[91b20c52df] - build: add flag to compile V8 with Temporal support (Antoine du Hamel) #60701
[0aaed248f0] - build: add support for Visual Studio 2026 (Michaël Zasso) #60727
[8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959
[bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
[7930d7a19b] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
[1b15453602] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #61271
[118fa97c95] - deps: update nbytes to 0.1.2 (Node.js GitHub Bot) #61270
[9b136db814] - deps: update ngtcp2 to 1.19.0 (Node.js GitHub Bot) #61156
[5635f23a50] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #61187
[9ec35c0977] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046
[4d7d37f701] - deps: update timezone to 2025c (Node.js GitHub Bot) #61138
[2c1e3ab19d] - deps: nghttp2: revert 7784fa979d0b (Antoine du Hamel) #61136
[56a6513648] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136
[f2692c5534] - deps: remove independent temporal (Chengzhong Wu) #61072
[3acbf3f129] - deps: apply cargo vendor (Chengzhong Wu) #61072
[d2759f4805] - deps: add vendor depenency crate (Chengzhong Wu) #61072
[6330385174] - deps: update simdjson to 4.2.4 (Node.js GitHub Bot) #61056
[9835860115] - deps: update googletest to 065127f1e4b46c5f14fc73cf8d323c221f9dc68e (Node.js GitHub Bot) #61055
[d2e6dff2f9] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
[27da9ca1c7] - deps: upgrade npm to 11.7.0 (npm team) #61011
[398ba68793] - deps: V8: cherry-pick 72b0e27bd936 (pthier) #60706
[a8ae3b9557] - deps: update sqlite to 3.51.1 (Node.js GitHub Bot) #60899
[4e1edae655] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #60898
[49b5954e74] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842
[6ae415361f] - deps: upgrade npm to 11.6.4 (npm team) #60853
[3cc857001a] - deps: add temporal_rs 0.1.0 (Chengzhong Wu) #60703
[660788cd4b] - deps: update sqlite to 3.51.0 (Node.js GitHub Bot) #60614
[c6d7a7b7cd] - deps: upgrade npm to 11.6.3 (npm team) #60785
[062e15bddf] - deps: update brotli to 1.2.0 (Node.js GitHub Bot) #60540
[db053988db] - deps: update simdjson to 4.2.2 (Node.js GitHub Bot) #60740
[ea5deab531] - deps: update googletest to 1b96fa13f549387b7549cc89e1a785cf143a1a50 (Node.js GitHub Bot) #60739
[c23f40cca4] - deps: update minimatch to 10.1.1 (Node.js GitHub Bot) #60543
[479c9290b9] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #60643
[e42911eddd] - deps: update inspector_protocol to 1b1bcbbe060e8c8cd8704f00f78978c50991 (Node.js GitHub Bot) #60705
[d908c83330] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #60646
[96530a4ca6] - deps: update simdjson to 4.2.1 (Node.js GitHub Bot) #60644
[6b0926ef20] - deps,src: prepare for cpplint update (Michaël Zasso) #60901
[5ed71efa3e] - doc: fix v25 changelog after security release (Marco Ippolito) #61371
[c2791069a2] - doc: correct description of error.stack accessor behavior (René) #61090
[134780c035] - doc: add documentation for process.traceProcessWarnings (Alireza Ebrahimkhani) #53641
[3b08efcebb] - doc: add sqlite session disposal method (René) #61273
[ec1847a097] - doc: fix filename typo (Hardanish Singh) #61297
[2c651ce460] - doc: fix typos and grammar in BUILDING.md & onboarding.md (Hardanish Singh) #61267
[28fe6ea4a8] - doc: mention --newVersion release script (Rafael Gonzaga) #61255
[2fb35d897d] - doc: correct typo in BUILDING doc (Mike McCready) #61261
[8dc2501a25] - doc: correct typo in api contributing doc (Mike McCready) #61260
[69e357a9d4] - doc: add PR-URL requirement for security backports (Rafael Gonzaga) #61256
[73326ae103] - doc: add reusePort error behavior to net module (mag123c) #61250
[67fbf4d371] - doc: note corepack package removal in distribution doc (Mike McCready) #61207
[0792859e49] - doc: fix tls.connect() timeout documentation (Azad Gupta) #61079
[72f42b9985] - doc: missing passed, error and passed properties on TestContext (Xavier Stouder) #61185
[f418fcc635] - doc: clarify threat model for application-level API exposure (Rafael Gonzaga) #61184
[bd4710769a] - doc: correct options for net.Socket class and socket.connect (Xavier Stouder) #61179
[387b65ca08] - doc: document error event on readline InterfaceConstructor (Xavier Stouder) #61170
[6d886e10e4] - doc: add a smooth scrolling effect to the sidebar (btea) #59007
[23fb3a64ec] - doc: fix test settime docs (Efe) #61117
[808eb437ee] - doc: correct invalid collaborator profile (JJ) #61091
[5e8eb5fe6c] - doc: add a tip about developer mode on Windows (Joyee Cheung) #61112
[a4248776da] - doc: exclude compile-time flag features from security policy (Matteo Collina) #61109
[44f61dfb92] - doc: add @avivkeller to collaborators (Aviv Keller) #61115
[08b5347b41] - doc: warn about short GCM tags visibly (Tobias Nießen) #61082
[45903ee884] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
[ce5d6e22ef] - doc: update MDN links (Livia Medeiros) #61062
[657cbd4af3] - doc: mark sync module hooks as release candidate (Joyee Cheung) #60960
[a46368a82b] - doc: reorganize docs of module customization hooks (Joyee Cheung) #60960
[9851278e99] - doc: mark crypto.hash as stable (Joyee Cheung) #60994
[77faa14d99] - doc: mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) #60954
[6d5f9ffc6d] - doc: add File modes cross-references in fs methods (Mohit Raj Saxena) #60286
[521b25a27d] - doc: add missing zstd to mjs example of zlib (Deokjin Kim) #60915
[9a9bed9b3a] - doc: clarify fileURLToPath security considerations (Rafael Gonzaga) #60887
[bebb4731b1] - doc: show the use of string expressions in the SQLTagStore example (schliepa) #60873
[f247c24cb0] - doc: replace column with columnNumber in example of util.getCallSites (Deokjin Kim) #60881
[487c1080aa] - doc: correct spelling in BUILDING.md (Rich Trott) #60875
[5751e3f736] - doc: update debuglog examples to use 'foo-bar' instead of 'foo' (xiaoyao) #60867
[ec8336b7a0] - doc: correct 'event handle' to 'event handler' in Utf8Stream drop event (Riddhi) #60692
[95ef052751] - doc: fix typos in changelogs (Rich Trott) #60855
[a10b3130c6] - doc: mark module.register as active development (Chengzhong Wu) #60849
[bfe8c62a2d] - doc: add fullName property to SuiteContext (PaulyBearCoding) #60762
[2799f594e3] - doc: add additional codemods for deprecation (Augustin Mauroy) #60811
[2b51d5d113] - doc: keep sidebar module visible when navigating docs (Botato) #60410
[2fa9917b07] - doc: fix webstorage config file property (Marco Ippolito) #60798
[a0691d6eb6] - doc: correct concurrency wording in test() documentation (Azad Gupta) #60773
[d26842c523] - doc: clarify that CQ only picks up PRs targeting main (René) #60731
[3e84428ffe] - doc: clarify license section and add contributor note (KaleruMadhu) #60590
[745ea1d61f] - doc: correct and expand documentation for SQLTagStore (René) #60200
[a442c27c0a] - doc: correct tls ALPNProtocols types (René) #60143
[d90001a579] - doc: remove mention of SMS 2FA (Antoine du Hamel) #60707
[7525a3fa4b] - doc: add info about renamed flag in cli.md (Antoine du Hamel) #60690
[db0a86897b] - doc: fix incorrect slh-dsa oids in crypto.md (Artsiom Malakhau) #60681
[e5ede89a94] - doc: domain.add() does not accept timer objects (René) #60675
[36ba9d99ba] - Revert "doc, assert: correct order of changes entries" (Michaël Zasso) #60774
[e6e5ed7665] - doc,test: add documentation and test on how to use addons in SEA (Joyee Cheung) #59582
[f12eb28489] - esm: avoid throw when module specifier is not url (Craig Macomber (Microsoft)) #61000
[a7b92e0677] - esm: improve error messages for ambiguous module syntax (mag123c) #60376
[6da85b576b] - events: remove eventtarget custom inspect branding (Efe) #61128
[aefbe4ba47] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #60214
[dc19409f36] - fs: validate statfs path (Efe) #61230
[206e353a4a] - fs: fix rmSync to handle non-ASCII characters (Yeaseen) #61108
[feee377b83] - fs: remove broken symlinks in rmSync (sangwook) #61040
[6b577c80bb] - fs: detect dot files when using globstar (Robin van Wijngaarden) #61012
[8470e2993b] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #60953
[a731463a60] - http,https: fix double ERR_PROXY_TUNNEL emission (Shima Ryuhei) #60699
[b2736646b6] - http2,zlib: prefer call() over apply() if argument list is not array (Livia Medeiros) #60834
[86bce15e96] - lib: implement all 1-byte encodings in js (Сковорода Никита Андреевич) #61093
[8156738b97] - lib: gbk decoder is gb18030 decoder per spec (Сковорода Никита Андреевич) #61099
[d8f1dea0d3] - lib: enforce use of URLParse (Antoine du Hamel) #61016
[9023b3f9ce] - lib: add lint rules for reflective function calls (Antoine du Hamel) #60825
[2979113136] - lib: prefer call() over apply() if argument list is not array (Livia Medeiros) #60796
[2b36433f4a] - lib: add support for readable byte streams to .toWeb() (Hans Klunder) #58664
[1a0c3dddb9] - lib: use FastBuffer for empty buffer allocation (Gürgün Dayıoğlu) #60558
[9209cf67a4] - lib: refactor JWK import PQC support check (Filip Skokan) #60586
[42666c241a] - lib,src: isInsideNodeModules should test on the first non-internal frame (Chengzhong Wu) #60991
[4a22647609] - lib,src,test: fix tests without SQLite (Antoine du Hamel) #60906
[24795530bb] - lib,test: enforce use of assert.fail via a lint rule (Antoine du Hamel) #61004
[1977348ae0] - lib,test: fix jsdoc comments (Michaël Zasso) #60870
[3549cf14ce] - meta: remove t.js (RafaelGSS) #61369
[5cf54abad7] - meta: bump step-security/harden-runner from 2.13.2 to 2.14.0 (dependabot[bot]) #61245
[b57bab72e1] - meta: bump actions/setup-node from 6.0.0 to 6.1.0 (dependabot[bot]) #61244
[42117b5069] - meta: bump actions/cache from 4.3.0 to 5.0.1 (dependabot[bot]) #61243
[fee3edd38e] - meta: bump actions/download-artifact from 6.0.0 to 7.0.0 (dependabot[bot]) #61242
[a96c3160ff] - meta: bump github/codeql-action from 4.31.6 to 4.31.9 (dependabot[bot]) #61241
[b4233e18a9] - meta: bump codecov/codecov-action from 5.5.1 to 5.5.2 (dependabot[bot]) #61240
[c5d7dd3731] - meta: bump actions/checkout from 6.0.0 to 6.0.1 (dependabot[bot]) #61239
[d83cec1534] - meta: bump actions/upload-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #61238
[d4bfd26f06] - meta: bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 (dependabot[bot]) #61237
[9246c6ab12] - meta: bump cachix/install-nix-action from 31.8.4 to 31.9.0 (dependabot[bot]) #61236
[1b378cfd5e] - meta: move lukekarrys to emeritus (Node.js GitHub Bot) #60985
[f3bfa68d78] - meta: bump actions/setup-python from 6.0.0 to 6.1.0 (dependabot[bot]) #60927
[f1935d19e9] - meta: bump github/codeql-action from 4.31.3 to 4.31.6 (dependabot[bot]) #60926
[0a4a4c090d] - meta: bump actions/checkout from 5.0.1 to 6.0.0 (dependabot[bot]) #60925
[d76f95117b] - meta: bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 (dependabot[bot]) #60924
[4dd153f8c3] - meta: bump github/codeql-action from 4.31.2 to 4.31.3 (dependabot[bot]) #60770
[a90bf3ece1] - meta: bump step-security/harden-runner from 2.13.1 to 2.13.2 (dependabot[bot]) #60769
[ecc945d7ec] - meta: bump cachix/install-nix-action from 31.8.2 to 31.8.4 (dependabot[bot]) #60768
[5578327a4f] - meta: bump actions/checkout from 5.0.0 to 5.0.1 (dependabot[bot]) #60767
[24384d7438] - meta: add Renegade334 to collaborators (Renegade334) #60714
[2d560e42fa] - module: fix sync resolve hooks for require with node: prefixes (Joyee Cheung) #61088
[15c3655b9a] - module: preserve URL in the parent created by createRequire() (Joyee Cheung) #60974
[c1acef6d0f] - module: mark require(esm) as stable (Joyee Cheung) #60959
[2e39f3ed6b] - module: mark module compile cache as stable (Joyee Cheung) #60971
[e6a05cfb4f] - (SEMVER-MINOR) module: allow subpath imports that start with #/ (Jan Martin) #60864
[1983cd6692] - node-api: add napi_set_prototype (siaeyy) #60711
[350b0ea895] - node-api: fix data race and use-after-free in napi_threadsafe_function (Mika Fischer) #55877
[cb3f79273a] - node-api: add support for Float16Array (Ilyas Shabi) #58879
[bdf359b3d1] - node-api: support SharedArrayBuffer in napi_create_dataview (Kevin Eady) #60473
[3c5dc03f06] - os: freeze signals constant (Xavier Stouder) #61038
[ca5c4c9752] - process: improve process.cwd() error message (TseIan) #61164
[fa927c31da] - (SEMVER-MINOR) process: preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) #60913
[571cec49e0] - repl: fix getters triggering side effects during completion (Dario Piotrowicz) #61043
[377aed336c] - repl: tab completion targets <class> instead of new <class> (Đỗ Trọng Hải) #60319
[cb8bc3466d] - sqlite: improve error messages for tag store (Pramit Sharma) #61096
[324ea4fa2d] - sqlite: make SQLTagStore.prototype.size a getter (René) #60246
[874c50296d] - src: dump snapshot source with node:generate_default_snapshot_source (Joyee Cheung) #61101
[0692b4f014] - src: improve StringBytes::Encode perf on ASCII (Сковорода Никита Андреевич) #61119
[754271a1f0] - src: add HandleScope to edge loop in heap_utils (Mert Can Altin) #60885
[8f46bd9352] - src: remove redundant CHECK (Tobias Nießen) #61130
[5e6ffd9aa0] - src: remove unused private field in SQLTagStore (Michaël Zasso) #61027
[550e8a7a69] - src: implement Windows-1252 encoding support and update related tests (Mert Can Altin) #60893
[3f9c0e07b4] - src: fix off-thread cert loading in bundled cert mode (Joyee Cheung) #60764
[7eaf815341] - src: handle DER decoding errors from system certificates (Joyee Cheung) #60787
[6e76cec44a] - src: use static_cast instead of C-style cast (Michaël Zasso) #60868
[103e55487e] - src: handle indexed properties in process.env (Michaël Zasso) #60826
[83d1f41752] - src: simply uint32 to string as it must not fail (Chengzhong Wu) #60846
[2dfdc6f01e] - src: mark unused private field as such (Michaël Zasso) #60802
[920f02539e] - src: implicitly enable namespace in config (Marco Ippolito) #60798
[47c5bd9b7c] - src: add permission flag to config file (Marco Ippolito) #60798
[d9df3f710d] - src: add test flag to config file (Marco Ippolito) #60798
[831256cb92] - src: rename config file testRunner to test (Marco Ippolito) #60798
[6c2b75ba87] - src: split inspector protocol domains files (Chengzhong Wu) #60754
[51cf032a5e] - src: add permission support to config file (Marco Ippolito) #60746
[413db7c635] - src: build v8 tick processor as built-in source text modules (Joyee Cheung) #60518
[428d24acf5] - src,permission: fix permission.has on empty param (Rafael Gonzaga) #60674
[a60aa72a87] - src,permission: add debug log on is_tree_granted (Rafael Gonzaga) #60668
[bd0942f4f5] - (SEMVER-MINOR) stream: do not pass readable.compose() output via Readable.from() (René) #60907
[90c12a252a] - stream: fix isErrored/isWritable for WritableStreams (René) #60905
[9ac774c15b] - test: asserts that import.meta.resolve invokes sync loader hooks (Chengzhong Wu) #61158
[c08afc5712] - test: check util.parseArgs argv parsing with actual process execution (René) #61089
[182f2e4b5a] - test: update WPT for urlpattern to a2e15ad405 (Node.js GitHub Bot) #61134
[9f7cc779f5] - test: make buffer sizes 32bit-aware in test-internal-util-construct-sab (René) #61026
[c6a8234963] - test: remove unneccessary repl magic_mode tests (Dario Piotrowicz) #61053
[fa2fe0930f] - test: skip sea tests on riscv64 (Stewart X Addison) #61111
[b209f6ba19] - test: simplify test-cli-node-options-docs (Antoine du Hamel) #61006
[c9153c7d4f] - test: mark stringbytes-external-max flaky on AIX (Stewart X Addison) #60995
[2cbddfefb7] - test: update test426 fixtures (Rich Trott) #60982
[c7190e6876] - test: update WPT for urlpattern to aed1f3d244 (Node.js GitHub Bot) #60642
[92649e2873] - test: deflake test-repl-paste-big-data (Livia Medeiros) #60975
[e4bc345442] - test: skip tests not passing without NODE_OPTIONS support (Antoine du Hamel) #60912
[63299a47ec] - test: improve config-file permission test coverage (Rafael Gonzaga) #60929
[9a0c420a33] - test: skip SEA inspect test if inspector is not available (Livia Medeiros) #60872
[e97daea17c] - test: update WPT for WebCryptoAPI to 1e4933113d (Node.js GitHub Bot) #60896
[ac367b3550] - test: lint more assert(regexp.test(...)) cases (René) #60878
[ca5720e7b5] - test: use assert.match for non-literal regexp tests (René) #60879
[5d30d3fc2d] - test: fix embedtest in debug windows (Vladimir Morozov) #60806
[8caeb03a52] - test: skip failing tests when compiled without amaro (Yuki Okita) #60815
[242e20bf9a] - test: fix debug test crashes caused by sea tests (Vladimir Morozov) #60807
[b890362e1a] - test: add lint rule to forbid use of assert.ok(/regex/.test(…)) (Antoine du Hamel) #60832
[b08cb5657e] - test: replace deprecated regex test assertions in http trailers test (Aditya Chopra) #60831
[47ed95965e] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60761
[79d48f9441] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60759
[585e200b40] - test: prefer major GC in cppgc-object teardown (sangwook) #60672
[9426ff6b08] - test: add basic temporal presence check (Chengzhong Wu) #60703
[ffebf8e55c] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60726
[adc6776c6a] - test: ensure assertions are reached on HTTP2 tests (Antoine du Hamel) #60730
[3dae49c6ce] - test: ensure assertions are reached on HTTP tests (Antoine du Hamel) #60729
[5203b09fea] - test: skip test that cause timeout on IBM i (SRAVANI GUNDEPALLI) #60700
[6d2fe36747] - test: add missing r.close() calls in REPL multiline tests (sangwook) #60226
[bbee2ef5e0] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60634
[a2764d450d] - test: update WPT for WebCryptoAPI to c58b6f4e0e (Node.js GitHub Bot) #60702
[1176fe43a7] - test: fix test-buffer-zero-fill-cli to be effective (Сковорода Никита Андреевич) #60623
[1a66dc1292] - test: limit the concurrency of WPTRunner for RISC-V (Levi Zim) #60591
[36076846d4] - test: fix test-strace-openat-openssl for RISC-V (Levi Zim) #60588
[5a976cb507] - test: split test-runner-run-watch.mjs (Joyee Cheung) #60653
[8f611b9bce] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60641
[3e550d30d6] - test_runner: fix lazy test.assert accessor (René) #61097
[ec142be1ed] - test_runner: propagate V8 options to child process (Pietro Marchini) #60999
[3127a2b1e7] - test_runner: fix line feed escaping in JUnit (Aliaksandr) #60274
[08fb6c9ba4] - test_runner: simplify code and make it more consistent (Antoine du Hamel) #60777
[102b217cf3] - tools: bump the eslint group in /tools/eslint with 2 updates (dependabot[bot]) #61246
[97b6b61165] - tools: unpin ngtcp2 version updates (Michaël Zasso) #61155
[7e95edc3de] - tools: only report commit validation failure on Slack (Antoine du Hamel) #61124
[3a7ed257a3] - tools: use sparse-checkout in linter jobs (Antoine du Hamel) #61123
[b655edf1bf] - tools: simplify notify-on-push (Antoine du Hamel) #61050
[230155749d] - tools: fix update-nghttp2 signature verification (Richard Lau) #61035
[e8646a7d10] - tools: improve log output of create-release-proposal (Antoine du Hamel) #61028
[a4b2614912] - tools: fix vcbuild test when path contain spaces (stduhpf) #56481
[9769c359f8] - tools: do not run test-linux workflow for changes on vcbuild.bat (Antoine du Hamel) #60979
[2ceaf6eb3c] - tools: add some options and comments to shell.nix (Antoine du Hamel) #60911
[611135abdc] - tools: bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /tools/doc (dependabot[bot]) #60930
[b4bad20a6c] - tools: ignore more paths in GHA CI (Antoine du Hamel) #60920
[47b7cb4e9e] - tools: run tests --without-amaro on test-shared macOS (Antoine du Hamel) #60902
[b0ec8c9c2a] - tools: replace deprecated eslint-plugin-markdown (Michaël Zasso) #60908
[46dacf686e] - tools: remove deprecated ESLint plugins (Michaël Zasso) #60908
[1a4ec6e830] - tools: update ESLint dependencies (Michaël Zasso) #60908
[4e442b286d] - tools: refloat 10 Node.js patches to cpplint.py (Michaël Zasso) #60901
[fa90d09de6] - tools: update cpplint to 2.0.2 (Michaël Zasso) #60901
[4d944c5198] - tools: disable some new cpplint rules before update (Michaël Zasso) #60901
[eaebae1eed] - tools: don't fetch V8 deps in the source tree (Richard Lau) #60883
[256770944a] - tools: add temporal updater (Chengzhong Wu) #60828
[1c38f808bd] - tools: dump config.gypi as json (Chengzhong Wu) #60794
[ed89b35291] - tools: bump js-yaml from 4.1.0 to 4.1.1 in /tools/lint-md (dependabot[bot]) #60781
[c98c0881c5] - tools: fix linter warning in test-shared.yml (Antoine du Hamel) #60772
[aa44406ed7] - tools: bump js-yaml from 4.1.0 to 4.1.1 in /tools/doc in the doc group (dependabot[bot]) #60766
[b756154ed9] - tools: fix paths-ignore in gha files (Antoine du Hamel) #60753
[18ed53fb7a] - tools: update install_tools.bat old echo from 2019 to 2022 (David Hidalgo) #60736
[cf79940d5c] - tools: remove unsupported cooldown from Dependabot config (Antoine du Hamel) #60747
[8ea73ffd64] - tools: update sccache to v0.12.0 (Michaël Zasso) #60723
[578f8bdfa0] - tools: update x64 macOS runner (Antoine du Hamel) #60676
[3b6cf316c0] - tools: update gyp-next to 0.21.0 (Node.js GitHub Bot) #60645
[7d55b8c00f] - tools,doc: fix format-md files list (Stefan Stojanovic) #61147
[a617942a4a] - url: add fast path to getPathFromURL decoder (Gürgün Dayıoğlu) #60749
[a6ac8bd2a5] - url: remove array.reduce usage (Gürgün Dayıoğlu) #60748
[09b5396523] - util: optimize toASCIILower function using V8s native toLowerCase (Mert Can Altin) #61107
[1dd15c9502] - util: limit inspect to only show own properties (Ruben Bridgewater) #61032
[5051d90100] - (SEMVER-MINOR) util: add convertProcessSignalToExitCode utility (Erick Wendel) #60963
[98b6dc1181] - util: fix parseArgs skipping positional arg with --eval and --print (azadgupta1) #60814
[862eaf8a09] - util: assert getCallSites does not invoke Error.prepareStackTrace (Chengzhong Wu) #60922
[c2e79aa5fb] - util: improve textencoder encodeInto performance (Yagiz Nizipli) #60843
[b6903aaf8d] - util: safely inspect getter errors whose message throws (Yves M.) #60684
[408f024906] - v8: mark v8.queryObjects() as stable (Joyee Cheung) #60957
[b00ee5222c] - worker: update code examples for node:worker_threads module (fisker Cheung) #58264
[2409839f19] - worker: remove not implemented declarations (Artur Gawlik) #60655
[c09417a2b1] - zlib: add CHECK to validate fast path input (Matteo Collina) #61175

15 days ago

node

nodejs

2026-01-13, Version 20.20.0 'Iron' (LTS), @marco-ippolito

This is a security release.

Notable Changes

lib:

(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802
(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797 lib,permission:
(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760 src:
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773 src,lib:
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759 tls:
(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796

Commits

[8f9ba3f623] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
[97fc9b0eb7] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#792
[14fbbb510c] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#802
[1febc48d5b] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
[494f62dc23] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
[d7a5c587c0] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
[51f4de4b4a] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
[85f73e7057] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

15 days ago

node

nodejs

2026-01-13, Version 22.22.0 'Jod' (LTS), @marco-ippolito

This is a security release.

Notable Changes

lib:

(CVE-2025-59465) add TLSSocket default error handler
(CVE-2025-55132) disable futimes when permission model is enabled lib,permission:
(CVE-2025-55130) require full read and write to symlink APIs src:
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks src,lib:
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle tls:
(CVE-2026-21637) route callback exceptions through error handlers

Commits

[6badf4e6f4] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
[37509c3ff0] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#791
[eb8e41f8db] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
[ebbf942a83] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
[6b4849583a] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
[ddadc31f09] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
[d4d9f3915f] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
[25d6799df6] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

15 days ago

node

nodejs

2026-01-13, Version 24.13.0 'Krypton' (LTS), @marco-ippolito

This is a security release.

Notable Changes

lib:

(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797
(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748 lib,permission:
(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760 src:
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773 src,lib:
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759 tls:
(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796

Commits

[2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
[3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283
[4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
[89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
[7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
[ac030753c4] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
[20075692fe] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
[20591b0618] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

15 days ago

node

nodejs

2026-01-13, Version 25.3.0 (Current), @RafaelGSS

This is a security release.

Notable Changes

lib:

(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750 permission:
(CVE-2026-21636) add network check on pipe_wrap connect (RafaelGSS) https://github.com/nodejs-private/node-private/pull/784
(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748 src:
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773 src,lib:
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759 tls:
(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/790

Commits

[a6a74b89a7] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
[5100614e26] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283
[f0a8916887] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#750
[b4b887c5f7] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
[26be208039] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
[bdf5873d44] - (CVE-2026-21636) permission: add network check on pipe_wrap connect (RafaelGSS) nodejs-private/node-private#784
[0578e3e921] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
[4d6b55a6d1] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
[c357a39e14] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#790

2025-12-11 00:30:26

node

nodejs

2025-12-10, Version 24.12.0 'Krypton' (LTS), @targos

Notable Changes

[1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778
[ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
[8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
[92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
[b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217
[e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178
[a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #58797
[92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #59711
[05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #59807

Commits

[e4a23a35ac] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #60603
[b6114ae5c9] - benchmark: add per-suite setup option (Joyee Cheung) #60574
[ac8e90af7c] - buffer: speed up concat via TypedArray#set (Gürgün Dayıoğlu) #60399
[acbc8ca13e] - build: upgrade Python linter ruff, add rules ASYNC,PERF (Christian Clauss) #59984
[f97a609a07] - console: optimize single-string logging (Gürgün Dayıoğlu) #60422
[6cd9bdc580] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
[0fafe24d9b] - crypto: fix argument validation in crypto.timingSafeEqual fast path (Joyee Cheung) #60538
[54421e0419] - debugger: fix event listener leak in the run command (Joyee Cheung) #60464
[c361a628b4] - deps: V8: cherry-pick 72b0e27bd936 (pthier) #60732
[c70f4588dd] - deps: V8: cherry-pick 6bb32bd2c194 (Erik Corry) #60732
[881fe784c5] - deps: V8: cherry-pick 0dd2318b5237 (Erik Corry) #60732
[457c33efcc] - deps: V8: cherry-pick df20105ccf36 (Erik Corry) #60732
[0bf45a829c] - deps: V8: backport e5dbbbadcbff (Darshan Sen) #60524
[4993bdc476] - deps: V8: cherry-pick 5ba9200cd046 (Juan José Arboleda) #60620
[1e9abe0078] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842
[3f704ed08f] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #60643
[04e360fdb1] - deps: V8: cherry-pick 06bf293610ef, 146962dda8d2 and e0fb10b5148c (Michaël Zasso) #60713
[fcbd8dbbde] - deps: patch V8 to 13.6.233.17 (Michaël Zasso) #60712
[28e9433f39] - deps: V8: cherry-pick 87356585659b (Joyee Cheung) #60069
[3cac85b243] - deps: V8: backport 2e4c5cf9b112 (Michaël Zasso) #60654
[1daece1970] - deps: call OPENSSL_free after ANS1_STRING_to_UTF8 (Rafael Gonzaga) #60609
[5f55a9c9ea] - deps: nghttp2: revert 7784fa979d0b (Antoine du Hamel) #59790
[1d9e7c1f4d] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790
[3140415068] - deps: update simdjson to 4.1.0 (Node.js GitHub Bot) #60542
[d911f9f1b8] - deps: update amaro to 1.1.5 (Node.js GitHub Bot) #60541
[daaaf04a32] - deps: V8: cherry-pick 2abc61361dd4 (Richard Lau) #60177
[b4f63ee5f8] - doc: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) #60650
[effcf7a8ab] - doc: fix link in --env-file=file section (N. Bighetti) #60563
[7011736703] - doc: fix linter issues (Antoine du Hamel) #60636
[5cc79d8945] - doc: add missing history entry for sqlite.md (Antoine du Hamel) #60607
[bbc649057c] - doc: correct values/references for buffer.kMaxLength (René) #60305
[ea7ecb517b] - doc: recommend events.once to manage 'close' event (Dan Fabulich) #60017
[58bff04cc2] - doc: highlight module loading difference between import and require (Ajay A) #59815
[bbcbff9b4d] - doc: add CJS code snippets in sqlite.md (Allon Murienik) #60395
[f8af33d5a7] - doc: fix typo in process.unref documentation (우혁) #59698
[df105dc351] - doc: add some entries to glossary.md (Mohataseem Khan) #59277
[4955cb2b5b] - doc: improve agent.createConnection docs for http and https agents (JaeHo Jang) #58205
[6283bb5cc9] - doc: fix pseudo code in modules.md (chirsz) #57677
[d5059ea537] - doc: add missing variable in code snippet (Koushil Mankali) #55478
[900de373ae] - doc: add missing word in single-executable-applications.md (Konstantin Tsabolov) #53864
[5735044c8b] - doc: fix typo in http.md (Michael Solomon) #59354
[2dee6df831] - doc: update devcontainer.json and add documentation (Joyee Cheung) #60472
[8f2d98d7d2] - doc: add haramj as triager (Haram Jeong) #60348
[bbd7fdfff4] - doc: clarify require(esm) description (dynst) #60520
[33ad11a764] - doc: instantiate resolver object (Donghoon Nam) #60476
[81a61274f3] - doc: correct module loading descriptions (Joyee Cheung) #60346
[77911185fe] - doc: clarify --use-system-ca support status (Joyee Cheung) #60340
[185f6e95d9] - doc,crypto: link keygen to supported types (Filip Skokan) #60585
[772d6c6608] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708
[ad98e11ac2] - esm: use sync loading/resolving on non-loader-hook thread (Joyee Cheung) #60380
[1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778
[5703ce68bc] - http: replace startsWith with strict equality (btea) #59394
[2b696ffad8] - http2: add diagnostics channels for client stream request body (Darshan Sen) #60480
[dbdf4cb5a5] - inspector: inspect HTTP response body (Chengzhong Wu) #60572
[9dc9a7d33d] - inspector: support inspecting HTTP/2 request and response bodies (Darshan Sen) #60483
[89fa2befe4] - inspector: fix crash when receiving non json message (Shima Ryuhei) #60388
[ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
[33baaf42c8] - lib: replace global SharedArrayBuffer constructor with bound method (Renegade334) #60497
[b047586a08] - meta: bump actions/download-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #60532
[64192176d7] - meta: bump actions/upload-artifact from 4.6.2 to 5.0.0 (dependabot[bot]) #60531
[af6d4a6b9b] - meta: bump github/codeql-action from 3.30.5 to 4.31.2 (dependabot[bot]) #60533
[c17276fd24] - meta: bump actions/setup-node from 5.0.0 to 6.0.0 (dependabot[bot]) #60529
[6e8b52a7dc] - meta: bump actions/stale from 10.0.0 to 10.1.0 (dependabot[bot]) #60528
[a12658595b] - meta: call create-release-post.yml post release (Aviv Keller) #60366
[8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
[36da413663] - module: fix directory option in the enableCompileCache() API (Joyee Cheung) #59931
[92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
[545162b0d4] - node-api: use local files for instanceof test (Vladimir Morozov) #60190
[526c011d89] - perf_hooks: fix stack overflow error (Antoine du Hamel) #60084
[1de0476939] - perf_hooks: move non-standard performance properties to perf_hooks (Chengzhong Wu) #60370
[07ec1239ef] - repl: fix pasting after moving the cursor to the left (Ruben Bridgewater) #60470
[b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217
[273c9661fd] - sqlite,doc: fix StatementSync section (Edy Silva) #60474
[d92ec21a4c] - src: use CP_UTF8 for wide file names on win32 (Fedor Indutny) #60575
[baef0468ed] - src: move Node-API version detection to where it is used (Anna Henningsen) #60512
[e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178
[a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #58797
[566add0b19] - src: avoid C strings in more C++ exception throws (Anna Henningsen) #60592
[9b796347c1] - src: add internal binding for constructing SharedArrayBuffers (Renegade334) #60497
[3b01cbb411] - src: move napi_addon_register_func to node_api_types.h (Anna Henningsen) #60512
[02fb7f4ecb] - src: remove unconditional NAPI_EXPERIMENTAL in node.h (Chengzhong Wu) #60345
[bd09ae24e4] - src: clean up generic counter implementation (Anna Henningsen) #60447
[cd6bf51dbd] - src: add enum handle for ToStringHelper + formatting (Burkov Egor) #56829
[92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #59711
[ac3dbe48f7] - stream: don't try to read more if reading (Robert Nagy) #60454
[790288a93b] - test: ensure assertions are reachable in test/internet (Antoine du Hamel) #60513
[0a85132989] - test: fix status when compiled without inspector (Antoine du Hamel) #60289
[2f57673172] - test: deflake test-perf-hooks-timerify-histogram-sync (Joyee Cheung) #60639
[09726269de] - test: apply a delay to watch-mode-kill-signal tests (Joyee Cheung) #60610
[45537b9562] - test: async iife in repl (Tony Gorez) #44878
[4ca81f101d] - test: parallelize sea tests when there's enough disk space (Joyee Cheung) #60604
[ea71e96191] - test: only show overridden env in child process failures (Joyee Cheung) #60556
[06b2e348c7] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60498
[de9c8cb670] - test: ensure assertions are reachable in test/es-module (Antoine du Hamel) #60501
[75bc40fced] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60485
[1a6084cfd3] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60500
[2c651c90cf] - test: split test-perf-hooks-timerify (Joyee Cheung) #60568
[6e8b5f7345] - test: add more logs to test-esm-loader-hooks-inspect-wait (Joyee Cheung) #60466
[9dea7ffa30] - test: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) #60565
[0b3c3b710a] - test: split test-esm-wasm.js (Joyee Cheung) #60491
[a15b795b34] - test: correct conditional secure heap flags test (Shelley Vohr) #60385
[38b77b3a44] - test: fix flaky test-watch-mode-kill-signal-* (Joyee Cheung) #60443
[e8d7598057] - test: capture stack trace in debugger timeout errors (Joyee Cheung) #60457
[674befeb81] - test: ensure assertions are reachable in test/sequential (Antoine du Hamel) #60412
[952c08a735] - test: ensure assertions are reachable in more folders (Antoine du Hamel) #60411
[bbca57584b] - test: split test-runner-watch-mode (Joyee Cheung) #60391
[e78e0cf6e7] - test: move test-runner-watch-mode helper into common (Joyee Cheung) #60391
[84576ef021] - test: ensure assertions are reachable in test/addons (Antoine du Hamel) #60142
[1659078c11] - test: ignore EPIPE errors in https proxy invalid URL test (Joyee Cheung) #60269
[79ffee80ec] - test: ensure assertions are reachable in test/client-proxy (Antoine du Hamel) #60175
[e5a812243a] - test: ensure assertions are reachable in test/async-hooks (Antoine du Hamel) #60150
[e924fd72e3] - test,crypto: handle a few more BoringSSL tests (Shelley Vohr) #59030
[a55ac11611] - test,crypto: update x448 and ed448 expectation when on boringssl (Shelley Vohr) #60387
[55d5e9ec73] - tls: fix leak on invalid protocol method (Shelley Vohr) #60427
[5763c96e7c] - tools: replace invalid expression in dependabot config (Riddhi) #60649
[b6e21b47d7] - tools: skip unaffected GHA jobs for changes in test/internet (Antoine du Hamel) #60517
[999664c76d] - tools: do not use short hashes for deps versioning to avoid collision (Antoine du Hamel) #60407
[ada856d0fb] - tools: only add test reporter args when node:test is used (Joyee Cheung) #60551
[1812c56bb3] - tools: fix update-icu script (Michaël Zasso) #60521
[747040438a] - tools: fix linter for semver-major release proposals (Antoine du Hamel) #60481
[f170551e40] - tools: fix failing release-proposal linter for LTS transitions (Antoine du Hamel) #60465
[2db4ea0ce4] - tools: remove undici from daily wpt.fyi job (Filip Skokan) #60444
[2a85aa4e7b] - tools: add lint rule to ensure assertions are reached (Antoine du Hamel) #60125
[48299ef5fb] - tools,doc: update JavaScript primitive types to match MDN Web Docs (JustApple) #60581
[7ec04cf936] - util: fix stylize of special properties in inspect (Ge Gao) #60479
[05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #59807
[884fe884a1] - vm: hint module identifier in instantiate errors (Chengzhong Wu) #60199
[a2caf19f70] - watch: fix interaction with multiple env files (Marco Ippolito) #60605

2025-11-25 20:19:41

node

nodejs

2025-11-25, Version 20.19.6 'Iron' (LTS), @marco-ippolito

Notable Changes

[6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
[082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
[db68cec4cb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #58313

Commits

[0f644df42e] - build: fix 'implicit-function-declaration' on OpenHarmony platform (hqzing) #59547
[fba0025b9c] - build: use windows-2025 runner (Michaël Zasso) #59673
[3456ec946d] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956
[6277910a15] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
[1788fb5f3d] - deps: update undici to 6.22.0 (Matteo Collina) #60112
[5d61b55f24] - deps: update uvwasi to 0.0.23 (Node.js GitHub Bot) #59791
[9f1e5e4637] - deps: update histogram to 0.11.9 (Node.js GitHub Bot) #59689
[d0edb01d25] - deps: update googletest to eb2d85e (Node.js GitHub Bot) #59335
[576242ff39] - deps: V8: cherry-pick a0d0d4fc4f19 (Ho Cheung) #60716
[a07a277020] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314
[fa5c5af8ce] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
[556113e2fc] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
[cd1536ca90] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
[acec79989e] - deps: V8: cherry-pick 6b1b9bca2a8 (zhoumingtao) #59283
[e65b930aa7] - deps: V8: backport 2e4c5cf9b112 (Michaël Zasso) #60654
[1b75a601f7] - doc: fix typo on child_process.md (Angelo Gazzola) #60114
[a2bcb217c6] - doc: fix typo in section on microtask order (Tobias Nießen) #59932
[2426d3f3ff] - doc: add security escalation policy (Ulises Gascón) #59806
[e7f6f04758] - doc: add Miles Guicent as triager (Miles Guicent) #59562
[e51ef3f48b] - doc: update install_tools.bat free disk space (Stefan Stojanovic) #59579
[8a504d900a] - doc: fix missing link to the Error documentation in the http page (Alexander Makarenko) #59080
[8c5c8aa71d] - doc: clarify experimental platform vulnerability policy (Matteo Collina) #59591
[109c4bff77] - doc: add security incident reponse plan (Rafael Gonzaga) #59470
[4f004efdf3] - doc: add RafaelGSS as performance strategic lead (Rafael Gonzaga) #59445
[caa2db4bac] - doc: fix links in test.md (Vas Sudanagunta) #58876
[082e50d4a2] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
[19a66365d9] - doc: clarify DEP0194 scope (Antoine du Hamel) #58504
[db68cec4cb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #58313
[3b2368774f] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291
[960d05ad7d] - doc: add history entries to --input-type section (Antoine du Hamel) #58175
[20616f1750] - http2: do not crash on mismatched ping buffer length (René) #60135
[9eb94232c8] - lib: handle superscript variants on windows device (Rafael Gonzaga) #59261
[dc58b4e35f] - meta: move Michael to emeritus (Michael Dawson) #60070
[d943cfb260] - meta: bump actions/setup-node from 4.4.0 to 5.0.0 (dependabot[bot]) #60093
[de9a3aaf0f] - meta: bump step-security/harden-runner from 2.12.2 to 2.13.1 (dependabot[bot]) #60094
[b4b5d4a4d7] - meta: bump ossf/scorecard-action from 2.4.2 to 2.4.3 (dependabot[bot]) #60096
[e5b4eee901] - meta: bump actions/setup-python from 5.6.0 to 6.0.0 (dependabot[bot]) #60090
[7cb032c2c1] - meta: update devcontainer to the latest schema (Aviv Keller) #54347
[bb108191aa] - meta: call create-release-post.yml post release (Aviv Keller) #60366
[2a11d50526] - module: correctly detect top-level await in ambiguous contexts (Shima Ryuhei) #58646
[144233b71a] - process: fix wrong asyncContext under unhandled-rejections=strict (Shima Ryuhei) #60103
[409cb773a4] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #59857
[d1c9d80cac] - repl: add isValidParentheses check before wrap input (Xuguang Mei) #59607
[b8d145db2c] - src: fix order of CHECK_NOT_NULL/dereference (Tobias Nießen) #59487
[2c8a73f95f] - src: remove duplicate assignment of O_EXCL in node_constants.cc (Daniel Osvaldo R) #59049
[b1da374503] - test: fix typo of test-benchmark-readline.js (Deokjin Kim) #59993
[4b4e38f497] - test: mark sea tests flaky on macOS x64 (Richard Lau) #60068
[cbf4fc34c3] - test: skip more sea tests on Linux ppc64le (Richard Lau) #59755
[9543facad7] - test: mark test-inspector-network-fetch as flaky again (Joyee Cheung) #59640
[4f858d22ac] - test: skip test-fs-cp* tests that are constantly failing on Windows (Joyee Cheung) #59637
[3ec534dbe8] - test: skip sea tests on Linux ppc64le (Richard Lau) #59563
[a7a109f926] - test: fix typos (Lee Jiho) #59330
[fd9d43da46] - test: skip failing test on macOS 15.7+ (Antoine du Hamel) #60419
[bc3ffbd713] - test_runner: fix isSkipped check in junit (Sungwon) #59414
[0cace96472] - test_runner: correct "already mocked" error punctuation placement (Jacob Smith) #58840
[76001f9480] - tools: remove unused actions from build-tarball.yml (Antoine du Hamel) #59787
[69904844bb] - tools: do not attempt to compress tgz archive (Antoine du Hamel) #59785
[a6e7adb173] - tools: fix return value of try_check_compiler (theanarkh) #59434
[6443ad2da5] - tools: drop deprecated macos-13 runner (Richard Lau) #60679
[45ec702ef7] - tools: fix tools/make-v8.sh for clang (Richard Lau) #59893
[393ff7226e] - util: fix numericSeparator with negative fractional numbers (sangwook) #59379
[9e8beff0f4] - util: fix error's namespaced node_modules highlighting using inspect (Ruben Bridgewater) #59446

2025-11-17 17:36:07

node

nodejs

2025-11-17, Version 25.2.1 (Current), @aduh95

This release reverts the spec-compliant behavior of sometimes throwing on localStorage access. We received feedback that this change on an experimental API was too breaking for a semver-minor release, so we decided to push it back for Node.js 26.0.0.

Commits

[ff89b7b6c7] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
[5316b580eb] - deps: V8: backport 2e4c5cf9b112 (Michaël Zasso) #60654
[ca878bc90e] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708
[a4dee613fd] - Revert "lib: throw from localStorage getter on missing storage path" (Antoine du Hamel) #60750

2025-11-12 06:25:56

node

nodejs

2025-11-11, Version 25.2.0 (Current), @aduh95

Notable Changes

[a37c01e6a1] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
[4fbb1ab101] - lib: throw from localStorage getter on missing storage path (René) #60351
[727560a96d] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
[506b79e888] - (SEMVER-MINOR) net: increase network family autoselection timeout to 500ms (Rod Vagg) #60334
[166c72ec02] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
[399b340022] - (SEMVER-MINOR) v8: adding total_allocated_bytes to HeapStatistics (Caio Lima) #60573

Commits

[d5158a0a2d] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #60603
[26a5305fa9] - benchmark: add per-suite setup option (Joyee Cheung) #60574
[4810e4b82d] - buffer: speed up concat via TypedArray#set (Gürgün Dayıoğlu) #60399
[94a94a6b3a] - console: optimize single-string logging (Gürgün Dayıoğlu) #60422
[ad376c31db] - crypto: fix argument validation in crypto.timingSafeEqual fast path (Joyee Cheung) #60538
[dc38a45a55] - debugger: fix event listener leak in the run command (Joyee Cheung) #60464
[a61e5d8e05] - deps: call OPENSSL_free after ANS1_STRING_to_UTF8 (Rafael Gonzaga) #60609
[51e5030afa] - deps: nghttp2: revert 7784fa979d0b (Antoine du Hamel) #59790
[eef838f499] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790
[13120a43d4] - deps: update simdjson to 4.1.0 (Node.js GitHub Bot) #60542
[6e1b23dab8] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550
[a02e05c486] - deps: update amaro to 1.1.5 (Node.js GitHub Bot) #60541
[b9ba3a7947] - deps: V8: backport fe81545e6d14 (Caio Lima) #60429
[07bcd28494] - deps: V8: cherry-pick 7ef6a001762 (Xiao-Tao) #60259
[3e11658243] - doc: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) #60650
[b8e40e4d38] - doc: fix link in --env-file=file section (N. Bighetti) #60563
[9558c1c0df] - doc: fix linter issues (Antoine du Hamel) #60636
[cdf70de563] - doc: add missing history entry for sqlite.md (Antoine du Hamel) #60607
[e3c5dcf1ea] - doc: correct values/references for buffer.kMaxLength (René) #60305
[a25d76c924] - doc: recommend events.once to manage 'close' event (Dan Fabulich) #60017
[795f32bf91] - doc: highlight module loading difference between import and require (Ajay A) #59815
[212775410b] - doc: add CJS code snippets in sqlite.md (Allon Murienik) #60395
[263c06096d] - doc: fix typo in process.unref documentation (우혁) #59698
[356bdae408] - doc: add some entries to glossary.md (Mohataseem Khan) #59277
[9632c398de] - doc: improve agent.createConnection docs for http and https agents (JaeHo Jang) #58205
[f72880dbe3] - doc: fix pseudo code in modules.md (chirsz) #57677
[a9c70cefe8] - doc: add missing variable in code snippet (Koushil Mankali) #55478
[2892d151d4] - doc: add missing word in single-executable-applications.md (Konstantin Tsabolov) #53864
[9c99ab6571] - doc: fix typo in http.md (Michael Solomon) #59354
[3446cf375f] - doc: update devcontainer.json and add documentation (Joyee Cheung) #60472
[519c537875] - doc: add haramj as triager (Haram Jeong) #60348
[62889d7e99] - doc: clarify require(esm) description (dynst) #60520
[0b9ef68705] - doc: instantiate resolver object (Donghoon Nam) #60476
[cd5c1ad29f] - doc: correct module loading descriptions (Joyee Cheung) #60346
[74719dad7a] - doc: clarify Linux runtime requirements for >=25 (Joyee Cheung) #60484
[ca39540785] - doc: clarify --use-system-ca support status (Joyee Cheung) #60340
[dbf204c714] - doc,crypto: link keygen to supported types (Filip Skokan) #60585
[3bcf86d56d] - esm: use sync loading/resolving on non-loader-hook thread (Joyee Cheung) #60380
[69b3d2c845] - http: replace startsWith with strict equality (btea) #59394
[a38e2f5975] - http2: add diagnostics channels for client stream request body (Darshan Sen) #60480
[c047e73a00] - inspector: inspect HTTP response body (Chengzhong Wu) #60572
[d2087bae92] - inspector: support inspecting HTTP/2 request and response bodies (Darshan Sen) #60483
[003121c475] - inspector: fix crash when receiving non json message (Shima Ryuhei) #60388
[a37c01e6a1] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
[219d2e978d] - lib: replace global SharedArrayBuffer constructor with bound method (Renegade334) #60497
[4fbb1ab101] - lib: throw from localStorage getter on missing storage path (René) #60351
[ca8934f44d] - meta: bump cachix/install-nix-action from 31.6.1 to 31.8.2 (dependabot[bot]) #60534
[166490230a] - meta: bump github/codeql-action from 3.30.5 to 4.31.2 (dependabot[bot]) #60533
[b722236a12] - meta: bump actions/download-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #60532
[3314b0bc60] - meta: bump actions/upload-artifact from 4.6.2 to 5.0.0 (dependabot[bot]) #60531
[d1d9891feb] - meta: bump actions/github-script from 7.0.1 to 8.0.0 (dependabot[bot]) #60530
[995596a34f] - meta: bump actions/setup-node from 5.0.0 to 6.0.0 (dependabot[bot]) #60529
[b60157a0fe] - meta: bump actions/stale from 10.0.0 to 10.1.0 (dependabot[bot]) #60528
[07fa6c9081] - meta: call create-release-post.yml post release (Aviv Keller) #60366
[727560a96d] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
[506b79e888] - (SEMVER-MINOR) net: increase network family autoselection timeout to 500ms (Rod Vagg) #60334
[166c72ec02] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
[6ab83cf979] - node-api: use local files for instanceof test (Vladimir Morozov) #60190
[3671851879] - perf_hooks: move non-standard performance properties to perf_hooks (Chengzhong Wu) #60370
[6ddee4a7ed] - repl: fix pasting after moving the cursor to the left (Ruben Bridgewater) #60470
[edc3033905] - sqlite,doc: fix StatementSync section (Edy Silva) #60474
[e9b68e60d4] - src: move import.meta initializer to native land (Joyee Cheung) #60603
[0ebf839a4f] - src: use CP_UTF8 for wide file names on win32 (Fedor Indutny) #60575
[a31ad37714] - src: show original file name in FileHandle GC close errors (Anna Henningsen) #60593
[a6c221324b] - src: avoid C strings in more C++ exception throws (Anna Henningsen) #60592
[fdff838ce3] - src: add internal binding for constructing SharedArrayBuffers (Renegade334) #60497
[4385b0b65f] - src: move napi_addon_register_func to node_api_types.h (Anna Henningsen) #60512
[de78da7887] - src: move Node-API version detection to where it is used (Anna Henningsen) #60512
[b606d46c3f] - src: remove unconditional NAPI_EXPERIMENTAL in node.h (Chengzhong Wu) #60345
[5941341889] - src: clean up generic counter implementation (Anna Henningsen) #60447
[7015f30e62] - src: add enum handle for ToStringHelper + formatting (Burkov Egor) #56829
[39dfcbad6e] - stream: don't try to read more if reading (Robert Nagy) #60454
[ee333c9177] - test: deflake test-perf-hooks-timerify-histogram-sync (Joyee Cheung) #60639
[f0d81c91e7] - test: apply a delay to watch-mode-kill-signal tests (Joyee Cheung) #60610
[68791e2ccc] - test: async iife in repl (Tony Gorez) #44878
[c4eb9c3383] - test: parallelize sea tests when there's enough disk space (Joyee Cheung) #60604
[be8c4172d9] - test: only show overridden env in child process failures (Joyee Cheung) #60556
[8cae858f88] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60498
[759d69331e] - test: ensure assertions are reachable in test/es-module (Antoine du Hamel) #60501
[6aaf18c333] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60485
[bc41acf087] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60500
[22fd621daf] - test: split test-perf-hooks-timerify (Joyee Cheung) #60568
[5efe4f722e] - test: add more logs to test-esm-loader-hooks-inspect-wait (Joyee Cheung) #60466
[2a57268f34] - test: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) #60565
[2c199f7f61] - test: split test-esm-wasm.js (Joyee Cheung) #60491
[bc8f7db5bb] - test: correct conditional secure heap flags test (Shelley Vohr) #60385
[3bf42a5dd3] - test: spin longer on flaky platforms for test-worker-prof (Joyee Cheung) #60492
[eca6227e7e] - test: ensure assertions are reachable in test/internet (Antoine du Hamel) #60513
[313983453b] - test: fix flaky test-watch-mode-kill-signal-* (Joyee Cheung) #60443
[ccc26377b5] - test: capture stack trace in debugger timeout errors (Joyee Cheung) #60457
[12e9213a24] - test: ensure assertions are reachable in test/sequential (Antoine du Hamel) #60412
[781a2661de] - test: ensure assertions are reachable in more folders (Antoine du Hamel) #60411
[1e979e6eb7] - test: split test-runner-watch-mode (Joyee Cheung) #60391
[8c31cbb99b] - test: move test-runner-watch-mode helper into common (Joyee Cheung) #60391
[c94c6555cc] - test,crypto: handle a few more BoringSSL tests (Shelley Vohr) #59030
[fd63c27444] - test,crypto: update x448 and ed448 expectation when on boringssl (Shelley Vohr) #60387
[bf0de92446] - tls: fix leak on invalid protocol method (Shelley Vohr) #60427
[7e8373b378] - tools: replace invalid expression in dependabot config (Riddhi) #60649
[ac08760547] - tools: extract Nix dependency lists to separate files (Antoine du Hamel) #60495
[ae91a6cc3a] - tools: only add test reporter args when node:test is used (Joyee Cheung) #60551
[97ed560222] - tools: skip unaffected GHA jobs for changes in test/internet (Antoine du Hamel) #60517
[44ca97b404] - tools: fix update-icu script (Michaël Zasso) #60521
[07b0b5a5ba] - tools: fix linter for semver-major release proposals (Antoine du Hamel) #60481
[97d74224c3] - tools: fix failing release-proposal linter for LTS transitions (Antoine du Hamel) #60465
[019af5bc27] - tools: skip running test-shared on deps changes (Antoine du Hamel) #60433
[3ec9764151] - tools: pin OpenSSL to 3.5.4 on test-shared workflow (Antoine du Hamel) #60428
[fe2d6d44d4] - tools: remove undici from daily wpt.fyi job (Filip Skokan) #60444
[d09ba98398] - tools: document that nixpkgs updates should not be backported (Antoine du Hamel) #60431
[7fc99319e7] - tools: do not use short hashes for deps versioning to avoid collision (Antoine du Hamel) #60407
[815edb0c3a] - tools,doc: update JavaScript primitive types to match MDN Web Docs (JustApple) #60581
[6877139a2d] - util: fix stylize of special properties in inspect (Ge Gao) #60479
[399b340022] - (SEMVER-MINOR) v8: adding total_allocated_bytes to HeapStatistics (Caio Lima) #60573
[d64795b318] - watch: fix interaction with multiple env files (Marco Ippolito) #60605