Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js.

Write a test.js script that makes HTTP/2 requests.

const http2 = require('node:http2');

const client = http2.connect('https://nghttp2.org');

const req = client.request([
  ':path', '/',
  ':method', 'GET',
]);

Run it with these options:

node --inspect-wait --experimental-network-inspection test.js

Open about:inspect on Google Chrome and click on Open dedicated DevTools for Node. The Network tab will let you track your HTTP/2 calls.

Contributed by Darshan Sen in #59611.

• [7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #59570
• [4b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #59570
• [3e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #59647
• [b1d28785b2] - (SEMVER-MINOR) crypto: add Argon2 Web Cryptography algorithms (Filip Skokan) #59544
• [430691d1af] - (SEMVER-MINOR) crypto: support SLH-DSA KeyObject, sign, and verify (Filip Skokan) #59537
• [d6d05ba397] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #59428

• [d913872369] - assert: cap input size in myersDiff to avoid Int32Array overflow (Haram Jeong) #59578
• [7bbbcf6666] - benchmark: sqlite prevent create both tables on prepare selects (Bruno Rodrigues) #59709
• [44d7b92271] - benchmark: calibrate config array-vs-concat (Rafael Gonzaga) #59587
• [7f347fc551] - build: fix getting OpenSSL version on Windows (Michaël Zasso) #59609
• [4a317150d5] - build: fix 'implicit-function-declaration' on OpenHarmony platform (hqzing) #59547
• [bda32af587] - build: use windows-2025 runner (Michaël Zasso) #59673
• [a4a8ed8f6e] - build: compile bundled uvwasi conditionally (Carlo Cabrera) #59622
• [d944a87761] - crypto: refactor subtle methods to use synchronous import (Filip Skokan) #59771
• [7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #59570
• [4b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #59570
• [3e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #59647
• [b1d28785b2] - (SEMVER-MINOR) crypto: add Argon2 Web Cryptography algorithms (Filip Skokan) #59544
• [430691d1af] - (SEMVER-MINOR) crypto: support SLH-DSA KeyObject, sign, and verify (Filip Skokan) #59537
• [0d1e53d935] - deps: update uvwasi to 0.0.23 (Node.js GitHub Bot) #59791
• [68732cf426] - deps: update histogram to 0.11.9 (Node.js GitHub Bot) #59689
• [f12c1ad961] - deps: update googletest to eb2d85e (Node.js GitHub Bot) #59335
• [45af6966ae] - deps: upgrade npm to 11.6.0 (npm team) #59750
• [57617244a4] - deps: V8: cherry-pick 6b1b9bca2a8 (Xiao-Tao) #59283
• [2e6225a747] - deps: update amaro to 1.1.2 (Node.js GitHub Bot) #59616
• [1f7f6dfae6] - diagnostics_channel: revoke DEP0163 (René) #59758
• [8671a6cdb3] - doc: stabilize --disable-sigusr1 (Rafael Gonzaga) #59707
• [583b1b255d] - doc: update OpenSSL default security level to 2 (Jeetu Suthar) #59723
• [9b5eb6eb50] - doc: fix missing links in the errors page (Nam Yooseong) #59427
• [e7bf712c57] - doc: update "Type stripping in dependencies" section (Josh Kelley) #59652
• [96db47f91e] - doc: add Miles Guicent as triager (Miles Guicent) #59562
• [87f829bd0c] - doc: mark path.matchesGlob as stable (Aviv Keller) #59572
• [062b2f705e] - doc: improve documentation for raw headers in HTTP/2 APIs (Tim Perry) #59633
• [6ab9306370] - doc: update install_tools.bat free disk space (Stefan Stojanovic) #59579
• [c8d6b60da6] - doc: fix quic session instance typo (jakecastelli) #59642
• [61d0a2d1ba] - doc: fix filehandle.read typo (Ruy Adorno) #59635
• [3276bfa0d0] - doc: update migration recomendations for util.is**() deprecations (Augustin Mauroy) #59269
• [11de6c7ebb] - doc: fix missing link to the Error documentation in the http page (Alexander Makarenko) #59080
• [f5b6829bba] - doc,crypto: add description to the KEM and supports() methods (Filip Skokan) #59644
• [5bfdc7ee74] - doc,crypto: cleanup unlinked and self method references webcrypto.md (Filip Skokan) #59608
• [010458d061] - esm: populate separate cache for require(esm) in imported CJS (Joyee Cheung) #59679
• [dbe6e63baf] - esm: fix missed renaming in ModuleJob.runSync (Joyee Cheung) #59724
• [8eb0d9d834] - fs: fix wrong order of file names in cpSync error message (Nicholas Paun) #59775
• [e69be5611f] - fs: fix dereference: false on cpSync (Nicholas Paun) #59681
• [2865d2ac20] - http: unbreak keepAliveTimeoutBuffer (Robert Nagy) #59784
• [ade1175475] - http: use cached '1.1' http version string (Robert Nagy) #59717
• [74a09482de] - inspector: undici as shared-library should pass tests (Aras Abbasi) #59837
• [772f8f415a] - inspector: add http2 tracking support (Darshan Sen) #59611
• [3d225572d7] - Revert "lib: optimize writable stream buffer clearing" (Yoo) #59743
• [4fd213ce73] - lib: fix isReadable and isWritable return type value (Gabriel Quaresma) #59089
• [39befddb87] - lib: prefer TypedArrayPrototype primordials (Filip Skokan) #59766
• [0748160d2e] - lib: fix DOMException subclass support (Chengzhong Wu) #59680
• [1a93df808c] - lib: revert to using default derived class constructors (René) #59650
• [bb0755df37] - meta: bump codecov/codecov-action (dependabot[bot]) #59726
• [45d148d9be] - meta: bump actions/download-artifact from 4.3.0 to 5.0.0 (dependabot[bot]) #59729
• [01b66b122e] - meta: bump github/codeql-action from 3.29.2 to 3.30.0 (dependabot[bot]) #59728
• [34f7ab5502] - meta: bump actions/cache from 4.2.3 to 4.2.4 (dependabot[bot]) #59727
• [5806ea02af] - meta: bump actions/checkout from 4.2.2 to 5.0.0 (dependabot[bot]) #59725
• [f667215583] - path: refactor path joining logic for clarity and performance (Lee Jiho) #59781
• [0340fe92a6] - repl: do not cause side effects in tab completion (Anna Henningsen) #59774
• [a414c1eb51] - repl: fix REPL completion under unary expressions (Kingsword) #59744
• [c206f8dd87] - repl: add isValidParentheses check before wrap input (Xuguang Mei) #59607
• [0bf9775ee2] - sea: implement sea.getAssetKeys() (Joyee Cheung) #59661
• [bf26b478d8] - sea: allow using inspector command line flags with SEA (Joyee Cheung) #59568
• [92128a8fe2] - src: use DictionaryTemplate for node_url_pattern (James M Snell) #59802
• [bcb29fb84f] - src: correctly report memory changes to V8 (Yaksh Bariya) #59623
• [44c24657d3] - src: fixup node_messaging error handling (James M Snell) #59792
• [2cd6a3b7ec] - src: track async resources via pointers to stack-allocated handles (Anna Henningsen) #59704
• [34d752586f] - src: fix build on NetBSD (Thomas Klausner) #59718
• [15fa779ac5] - src: fix race on process exit and off thread CA loading (Chengzhong Wu) #59632
• [15cbd3966a] - src: separate module.hasAsyncGraph and module.hasTopLevelAwait (Joyee Cheung) #59675
• [88d1ca8990] - src: use non-deprecated Get/SetPrototype methods (Michaël Zasso) #59671
• [56ac9a2d46] - src: migrate WriteOneByte to WriteOneByteV2 (Chengzhong Wu) #59634
• [3d88aa9f2f] - src: remove duplicate code (theanarkh) #59649
• [0718a70b2a] - src: add name for more threads (theanarkh) #59601
• [0379a8b254] - src: remove JSONParser (Joyee Cheung) #59619
• [90d0a1b2e9] - src,sqlite: refactor value conversion (Edy Silva) #59659
• [5e025c7ca7] - stream: replace manual function validation with validateFunction (방진혁) #59529
• [155a999bed] - test: skip tests failing when run under root (Livia Medeiros) #59779
• [6313706c69] - test: update WPT for urlpattern to cff1ac1123 (Node.js GitHub Bot) #59602
• [41245ad4c7] - test: skip more sea tests on Linux ppc64le (Richard Lau) #59755
• [df63d37ec4] - test: fix internet/test-dns (Michaël Zasso) #59660
• [1f6c335e82] - test: mark test-inspector-network-fetch as flaky again (Joyee Cheung) #59640
• [1798683df1] - test: skip test-fs-cp* tests that are constantly failing on Windows (Joyee Cheung) #59637
• [4c48ec09e5] - test: deflake test-http-keep-alive-empty-line (Luigi Pinca) #59595
• [dcdb259e85] - test_runner: fix todo inheritance (Moshe Atlow) #59721
• [24177973a2] - test_runner: set mock timer's interval undefined (hotpineapple) #59479
• [83d11f8a7a] - tools: print appropriate output when test aborted (hotpineapple) #59794
• [1eca2cc548] - tools: use sparse checkout in build-tarball.yml (Antoine du Hamel) #59788
• [89fa1a929d] - tools: remove unused actions from build-tarball.yml (Antoine du Hamel) #59787
• [794ca3511d] - tools: do not attempt to compress tgz archive (Antoine du Hamel) #59785
• [377bdb9b7e] - tools: add v8windbg target (Chengzhong Wu) #59767
• [6696d1d6c9] - tools: improve error handling in node_mksnapshot (James M Snell) #59437
• [8dbd0f13e8] - tools: add sccache to test-internet workflow (Antoine du Hamel) #59720
• [6523c2d7d9] - tools: update gyp-next to 0.20.4 (Node.js GitHub Bot) #59690
• [19d633f40c] - tools: add script to make reviewing backport PRs easier (Antoine du Hamel) #59161
• [15e547b3a4] - typings: add typing for 'uv' (방진혁) #59606
• [ad5cfcc901] - typings: add missing properties in ConfigBinding (Lee Jiho) #59585
• [70d2d6d479] - url: add err.input to ERR_INVALID_FILE_URL_PATH (Joyee Cheung) #59730
• [e476e43c17] - util: fix numericSeparator with negative fractional numbers (sangwook) #59379
• [b2e8f40d15] - util: remove unnecessary template strings (btea) #59201
• [6f79450ea2] - util: remove outdated TODO comment (haramjeong) #59760
• [32731432ef] - util: use getOptionValue('--no-deprecation') in deprecated() (haramjeong) #59760
• [65e4e68c90] - util: hide duplicated stack frames when using util.inspect (Ruben Bridgewater) #59447
• [2086f3365f] - vm: sync-ify SourceTextModule linkage (Chengzhong Wu) #59000
• [c16163511d] - wasi: fix clean target in test/wasi/Makefile (Antoine du Hamel) #59576
• [2e54411cb6] - worker: optimize cpu profile implement (theanarkh) #59683
• [d6d05ba397] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #59428

• [f5b293ad48] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [4e6ae787c6] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [d06db658fc] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [3c6206cac9] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241

• [ea20403467] - build: fix uvwasi pkgname (Antoine du Hamel) #58270
• [c647aa4b30] - build: fix pointer compression builds (Joyee Cheung) #58171
• [d2c5e609ae] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr) #58867
• [84d5c4d244] - build: search for libnode.so in multiple places (Jan Staněk) #58213
• [068c439552] - crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan) #58942
• [edff105c34] - debugger: fix behavior of plain object exec in debugger repl (Dario Piotrowicz) #57498
• [0473e35b7f] - deps: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) #58628
• [1218dbbea5] - deps: update zlib to 1.3.0.1-motley-780819f (Node.js GitHub Bot) #57768
• [0e3cd9ec00] - deps: update zlib to 1.3.0.1-motley-788cb3c (Node.js GitHub Bot) #56655
• [a194dd9bd4] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #57335
• [cc9b79ca70] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #57335
• [82c46d5358] - deps: update cjs-module-lexer to 2.1.0 (Node.js GitHub Bot) #57180
• [43e3f9b26b] - deps: update cjs-module-lexer to 2.0.0 (Michael Dawson) #56855
• [91282ff16b] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #58566
• [b76bca6f38] - deps: update acorn to 8.15.0 (Node.js GitHub Bot) #58711
• [ae11481011] - deps: update acorn to 8.14.1 (Node.js GitHub Bot) #57382
• [142d701201] - deps: update minimatch to 10.0.3 (Node.js GitHub Bot) #58712
• [fee082d684] - deps: update llhttp to 9.3.0 (Fedor Indutny) #58144
• [c06f6f3f05] - dns: remove redundant code using common variable (Deokjin Kim) #57386
• [cded8e7e77] - dns: fix parse memory leaky (theanarkh) #58973
• [182ae67233] - dns: fix dns query cache implementation (Ethan Arrowood) #58404
• [621b66a297] - doc: add review guidelines for collaborator nominations (Antoine du Hamel) #57449
• [b1009b5b72] - doc: explicit mention arbitrary code execution as a vuln (Rafael Gonzaga) #57426
• [f5b293ad48] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [4e6ae787c6] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [530473f479] - doc: add ovflowd back to core collaborators (Claudio W.) #58911
• [38e8bbc131] - doc: add info on how project manages social media (Michael Dawson) #57318
• [d06bb4dcc2] - doc: ping nodejs/tsc for each security pull request (Rafael Gonzaga) #57309
• [d06db658fc] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [8c3bc156ed] - doc: clarify path.isAbsolute is not path traversal mitigation (Eric Fortis) #57073
• [e688410bda] - doc: fix rendering of DEP0174 description (David Sanders) #56835
• [e6a0c6a0fa] - doc: add missing assert return types (Colin Ihrig) #57219
• [026b3cab6a] - doc: add 1ilsang to triage team (1ilsang) #57183
• [3c6206cac9] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241
• [ef3a4675c7] - doc: fix web.libera.chat link in pull-requests.md (Samuel Bronson) #57076
• [1db42b76f7] - doc: remove buffered flag from performance hooks examples (Pavel Romanov) #52607
• [b73a1356ce] - doc: add module namespace object links (Dario Piotrowicz) #57093
• [09368db20f] - doc: disambiguate pseudo-code statement (Dario Piotrowicz) #57092
• [2c3dc569a1] - doc: fix wrong articles used to address modules (Dario Piotrowicz) #57090
• [cd8259cb4e] - doc: modules.md: fix distance definition (Alexander “weej” Jones) #57046
• [7b0ea9ab2d] - doc: fix wrong verb form (Dario Piotrowicz) #57091
• [14fcfc242b] - doc: add a note about require('../common') in testing documentation (Aditi) #56953
• [bc7d18b6ea] - doc: recommend writing tests in new files and including comments (Joyee Cheung) #57028
• [acd4d7f269] - doc: improve documentation on argument validation (Aditi) #56954
• [4cd6b3ca73] - doc: buffer: fix typo on Buffer.copyBytesFrom( offset option (tpoisseau) #57015
• [01220607f2] - doc: update cleanup to trust on vuln db automation (Rafael Gonzaga) #57004
• [77a0505a32] - doc: update post sec release process (Rafael Gonzaga) #56907
• [77dbcfce5f] - doc: add section about using npx with permission model (Rafael Gonzaga) #56539
• [73e51407b7] - doc: remove RedYetiDev from triagers team (Aviv Keller) #55947
• [9a36cbb792] - doc: fix relative path mention in --allow-fs (Rafael Gonzaga) #55791
• [04d9c5baeb] - doc: add scroll margin to links (Roman Reiss) #58982
• [959a67f6ff] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291
• [8757a5532f] - doc: update release key for aduh95 (Antoine du Hamel) #58877
• [6fa0626327] - doc,src,test: fix typos (Noritaka Kobayashi) #58477
• [9991788e4a] - http: coerce content-length to number (Marco Ippolito) #57458
• [ff5cf8a428] - http2: fix check for frame->hd.type (hanguanqiang) #57644
• [2f333b6c51] - lib: optimize prepareStackTrace on builtin frames (Chengzhong Wu) #56299
• [cdf985071f] - lib: suppress source map lookup exceptions (Chengzhong Wu) #56299
• [faa08b14ed] - lib: fixup incorrect argument order in assertEncoding (James M Snell) #57177
• [a683cd1232] - meta: add IlyasShabi to collaborators (Ilyas Shabi) #58916
• [b145bb28aa] - meta: bump codecov/codecov-action from 5.4.2 to 5.4.3 (dependabot[bot]) #58551
• [2c59789001] - meta: bump ossf/scorecard-action from 2.4.1 to 2.4.2 (dependabot[bot]) #58550
• [4095337e96] - meta: bump rtCamp/action-slack-notify from 2.3.2 to 2.3.3 (dependabot[bot]) #58108
• [631fed8e39] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #58456
• [7d2f7180b6] - meta: bump codecov/codecov-action from 5.4.0 to 5.4.2 (dependabot[bot]) #58110
• [1558551ea5] - meta: bump actions/download-artifact from 4.2.1 to 4.3.0 (dependabot[bot]) #58106
• [e1f12fe737] - meta: ignore mailmap changes in linux ci (Jonas Badalic) #58356
• [1b78eb1313] - meta: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot[bot]) #58111
• [2b8449c39a] - meta: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot[bot]) #58107
• [833b70bbc5] - meta: allow penetration testing on live system with prior authorization (Matteo Collina) #57966
• [c6a88561f5] - meta: bump actions/setup-python from 5.4.0 to 5.5.0 (dependabot[bot]) #57718
• [9046ef4fb3] - meta: bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 (dependabot[bot]) #57717
• [46388a4e2a] - meta: bump actions/cache from 4.2.2 to 4.2.3 (dependabot[bot]) #57715
• [d3970685bd] - meta: bump actions/setup-node from 4.2.0 to 4.3.0 (dependabot[bot]) #57714
• [47004ef37f] - meta: bump actions/upload-artifact from 4.6.1 to 4.6.2 (dependabot[bot]) #57713
• [4abe83ec03] - meta: add some clarification to the nomination process (James M Snell) #57503
• [45e9b88363] - meta: remove collaborator self-nomination (Rich Trott) #57537
• [d10949b7d8] - meta: edit collaborator nomination process (Antoine du Hamel) #57483
• [704562fb7a] - meta: move ovflowd to emeritus (Claudio W.) #57443
• [3f981b8537] - meta: bump codecov/codecov-action from 5.3.1 to 5.4.0 (dependabot[bot]) #57257
• [7e1ff7b332] - meta: bump ossf/scorecard-action from 2.4.0 to 2.4.1 (dependabot[bot]) #57253
• [8d4ec412b9] - meta: move RaisinTen back to collaborators, triagers and SEA champion (Darshan Sen) #57292
• [cc2abb5d17] - meta: bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 (dependabot[bot]) #57259
• [4fad2b8758] - meta: bump actions/cache from 4.2.0 to 4.2.2 (dependabot[bot]) #57256
• [5f5bb8b986] - meta: bump actions/upload-artifact from 4.6.0 to 4.6.1 (dependabot[bot]) #57255
• [e949359a56] - meta: bump actions/setup-python from 5.3.0 to 5.4.0 (dependabot[bot]) #56867
• [d3c5ad7510] - meta: bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (dependabot[bot]) #56866
• [56decfe2d1] - meta: bump codecov/codecov-action from 5.0.7 to 5.3.1 (dependabot[bot]) #56864
• [52e518444d] - meta: bump actions/cache from 4.1.2 to 4.2.0 (dependabot[bot]) #56862
• [9cac93d9c3] - meta: bump actions/stale from 9.0.0 to 9.1.0 (dependabot[bot]) #56860
• [ecf4252f7c] - meta: update last name for jkrems (Jan Martin) #57006
• [e8beaaaedf] - meta: bump actions/upload-artifact from 4.4.3 to 4.6.0 (dependabot[bot]) #56861
• [5462c257f8] - meta: bump actions/setup-node from 4.1.0 to 4.2.0 (dependabot[bot]) #56868
• [89c37891a0] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #56889
• [2a0175c291] - meta: add @nodejs/url as codeowner (Chengzhong Wu) #56783
• [c12aae1e78] - meta: bump github/codeql-action from 3.28.18 to 3.29.2 (dependabot[bot]) #58922
• [4ef09990f1] - meta: bump github/codeql-action from 3.28.16 to 3.28.18 (dependabot[bot]) #58552
• [889654eb2c] - meta: bump github/codeql-action from 3.28.11 to 3.28.16 (dependabot[bot]) #58112
• [091e5c1bb9] - meta: bump github/codeql-action from 3.28.10 to 3.28.13 (dependabot[bot]) #57716
• [01415153de] - meta: bump github/codeql-action from 3.28.8 to 3.28.10 (dependabot[bot]) #57254
• [72ea8aac34] - meta: bump github/codeql-action from 3.27.5 to 3.28.8 (dependabot[bot]) #56859
• [99a271e588] - meta: bump step-security/harden-runner from 2.12.0 to 2.12.2 (dependabot[bot]) #58923
• [b4c4c02490] - meta: bump step-security/harden-runner from 2.11.0 to 2.12.0 (dependabot[bot]) #58109
• [5361bb9157] - meta: bump step-security/harden-runner from 2.10.4 to 2.11.0 (dependabot[bot]) #57258
• [28e33acf30] - meta: bump step-security/harden-runner from 2.10.2 to 2.10.4 (dependabot[bot]) #56863
• [fad773cede] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957
• [2531185423] - module: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) #58598
• [ed43b69689] - module: clarify cjs global-like error on ModuleJobSync (Carlos Espa) #56491
• [6e02db1b12] - module: handle instantiated async module jobs in require(esm) (Joyee Cheung) #58067
• [badba50d30] - module: fix incorrect formatting in require(esm) cycle error message (haykam821) #57453
• [939ecf8906] - module: handle cached linked async jobs in require(esm) (Joyee Cheung) #57187
• [ba7f8a0353] - module: improve error message from asynchronicity in require(esm) (Joyee Cheung) #57126
• [c1e7fa2586] - module: handle .mjs in .js handler in CommonJS (Joyee Cheung) #55590
• [41f3dfd21b] - module: fix require.resolve() crash on non-string paths (Aditi) #56942
• [043dcdd628] - os: fix GetInterfaceAddresses memory lieaky (theanarkh) #58940
• [9b74e9bfd9] - permission: ignore internalModuleStat on module loading (Rafael Gonzaga) #55797
• [611a147b45] - readline: fix unresolved promise on abortion (Daniel Venable) #54030
• [f891ae3421] - repl: avoid deprecated require.extensions in tab completion (baki gul) #58653
• [7ba44290bf] - repl: fix tab completion not working with computer string properties (Dario Piotrowicz) #58709
• [eb842048b2] - src: do not format single string argument for THROW_ERR_* (Joyee Cheung) #57126
• [4f004937ec] - src: fixup errorhandling more in various places (James M Snell) #57852
• [5daa7fe2e2] - src: fix module buffer allocation (X-BW) #57738
• [586b1be11b] - src: fix build when using shared simdutf (Antoine du Hamel) #58407
• [563e61f012] - src: fix possible dereference of null pointer (Eusgor) #58459
• [cbec07ea0b] - src: fix FIPS init error handling (Tobias Nießen) #58379
• [80fb80e71b] - src: fix -Wunreachable-code in src/node_api.cc (Shelley Vohr) #58901
• [5e97719860] - test: skip test-http-imports on macos (Marco Ippolito) #59745
• [69c43bdfcc] - test: fix internet/test-dns (Michaël Zasso) #59660
• [6fd58e0338] - tools: update coverage GitHub Actions to fixed version (Rich Trott) #59512
• [eb7bbce73e] - tools: disable failing coverage jobs (Antoine du Hamel) #58770
• [65b1669936] - util: fix formatting of objects with built-in Symbol.toPrimitive (Shima Ryuhei) #57832
• [8a29f13bec] - util: fix parseEnv incorrectly splitting multiple ‘=‘ in value (HEESEUNG) #57421
• [077d5020c4] - v8: fix missing callback in heap utils destroy (Ruben Bridgewater) #58846
• [34ae9f8b18] - vm: import call should return a promise in the current context (Chengzhong Wu) #58309
• [0dd3a8d6d1] - win,build: fix MSVS v17.14 compilation issue (StefanStojanovic) #58902
• [1b83a2bd2d] - zlib: remove mentions of unexposed Z_TREES constant (Jimmy Leung) #58371
• [9dc9604502] - zlib: fix pointer alignment (jhofstee) #57727

• [8e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
• [e592d739c2] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
• [cda1dab6e2] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
• [1f184513e9] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
• [bace73a173] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
• [fa9a9e9c69] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
• [390a9dc20b] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
• [c12c5343ad] - lib: docs deprecate _http_* (Sebastian Beltran) #59293
• [f57ee3d71f] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
• [035da74c31] - (SEMVER-MINOR) process: add threadCpuUsage (Paolo Insogna) #56467
• [8e697d1884] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240

• [73aa0ae37f] - assert: change utils to use index instead of for...of (방진혁) #59278
• [dfe3a11eed] - benchmark: remove deprecated _extend from benchmark (Rafael Gonzaga) #59228
• [9b9d30042a] - benchmark: add fs warmup to writefile-promises (Bruno Rodrigues) #59215
• [a663f7f954] - benchmark: add calibrate-n script (Rafael Gonzaga) #59186
• [1b9b5bddd6] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #59187
• [d0ac3319f9] - benchmark: add --track to benchmark (Rafael Gonzaga) #59174
• [2044968b86] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #59172
• [4e519934cb] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #59171
• [07e173d969] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #59170
• [8440b6177f] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #59116
• [8615ea6db0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #59043
• [3deb5361d2] - build: fix node_use_sqlite for GN builds (Shelley Vohr) #59017
• [0f0ce63116] - build: remove suppressions.supp (Rafael Gonzaga) #59079
• [b30a2117dc] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #58100
• [8e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
• [e592d739c2] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
• [b5571047ed] - crypto: prepare webcrypto key import/export for modern algorithms (Filip Skokan) #59284
• [cda1dab6e2] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
• [76dab34fb7] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #58237
• [19d3ed64b6] - deps: update sqlite to 3.50.4 (Node.js GitHub Bot) #59337
• [38bafc59e0] - deps: V8: backport 493cb53691be (Chengzhong Wu) #59238
• [e8da171cc3] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132
• [fd4ba38ab6] - deps: update googletest to 7e17b15 (Node.js GitHub Bot) #59131
• [f71f427b95] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
• [79c5a8f4d2] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
• [0dcc84cf53] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
• [1f184513e9] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
• [f64f5df80e] - doc: fix --use-system-ca history (Joyee Cheung) #59411
• [e22aeaa38f] - doc: add missing section for setReturnArrays in sqlite.md (Edy Silva) #59074
• [e44ef07235] - doc: rename x509.extKeyUsage to x509.keyUsage (Filip Skokan) #59332
• [2c5d0aac5e] - doc: fix Pbkdf2Params hash attribute heading (Filip Skokan) #59395
• [fde94346e5] - doc: fix missing reference links for server.keepAliveTimeoutBuffer (Lee Jiho) #59356
• [9af8bcea58] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #59344
• [0edf17198f] - doc: run license-builder (github-actions[bot]) #59343
• [7f767a2e38] - doc: correct orthography eg. → e.g. (Jacob Smith) #59329
• [a46ed50350] - doc: clarify the need of compiler compatible with c++20 (Rafael Gonzaga) #59297
• [212263a305] - doc: clarify release candidate stability index (Filip Skokan) #59295
• [ce93b8b556] - doc: add WDYT to glossary (btea) #59280
• [ebaaf2c67f] - doc: add manpage entry for --use-system-ca (Joyee Cheung) #59273
• [43b5a21916] - doc: add path.join and path.normalize clarification (Rafael Gonzaga) #59262
• [409c66d328] - doc: fix typo in test/common/README.md (Yoo) #59180
• [cbb0a8eb13] - doc: add note on process memoryUsage (fengmk2) #59026
• [9892b15d81] - doc: format safely for doc-kit (Aviv Keller) #59229
• [bace73a173] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
• [b549deac02] - doc: copyedit SECURITY.md (Rich Trott) #59190
• [ef1bc3f344] - doc: fix broken sentence in URL.parse (Superchupu) #59164
• [3c6639e8ec] - doc: improve onboarding instructions (Joyee Cheung) #59159
• [6ffaac66bc] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #58917
• [e419d20144] - doc: add Aditi-1400 to collaborators (Aditi Singh) #59157
• [ba380f7bf3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #59111
• [fa1a532f2b] - doc: fix typo in writing-test.md (SeokHun) #59123
• [0b93ca3d19] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #59078
• [7d747aeac8] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #59050
• [0b5613f9fe] - doc: run license-builder (github-actions[bot]) #59056
• [1b6b5e72d3] - doc: fix typed list formatting (Aviv Keller) #59019
• [756c7dd639] - doc: refine util.parseArgs default definition (Slayer95) #58958
• [0b840523a2] - doc: remove unused import in zlib.md (coderaiser) #59041
• [3e9ed4b080] - doc: add stability index to the --watch-kill-signal flag (Dario Piotrowicz) #58997
• [cb08a5d43f] - doc: add missing <code> blocks (Antoine du Hamel) #58995
• [4a42360fe5] - doc: add scroll margin to links (Roman Reiss) #58982
• [9d073f32da] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #58983
• [3cc11fc9ac] - domain: remove deprecated API call (Alex Yang) #59339
• [fa9a9e9c69] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
• [177ed3b3dd] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #59020
• [4619fe0e04] - fs: fix glob TypeError on restricted dirs (Sylphy-0xd3ac) #58674
• [ad2089e32d] - fs: correct error message when FileHandle is transferred (Alex Yang) #59156
• [390a9dc20b] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
• [659002359d] - http2: set Http2Stream#sentHeaders for raw headers (Darshan Sen) #59244
• [d02831ef73] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077
• [264a838779] - lib: add trace-sigint APIs (theanarkh) #59040
• [d22d2fa6d4] - lib: optimize writable stream buffer clearing (Yoo) #59406
• [a5e9759409] - lib: do not modify prototype deprecated asyncResource (RafaelGSS) #59195
• [9254257fc0] - lib: restructure assert to become a class (Miguel Marcondes Filho) #58253
• [946eab8d77] - lib: handle superscript variants on windows device (Rafael Gonzaga) #59261
• [cd857a97b5] - lib: use validateString (hotpineapple) #59296
• [c12c5343ad] - lib: docs deprecate _http_* (Sebastian Beltran) #59293
• [a28e5f0938] - lib: add type names in source mapped stack traces (Chengzhong Wu) #58976
• [6aec5aee7c] - lib: prefer AsyncIteratorPrototype primordial (René) #59097
• [e704349858] - lib: fix incorrect ArrayBufferPrototypeGetDetached primordial type (Dario Piotrowicz) #58978
• [2fc25fd400] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #58928
• [446ee98e00] - meta: clarify pr objection process further (James M Snell) #59096
• [46c339e4f3] - meta: add mailmap entry for aditi-1400 (Aditi) #59316
• [70a586261f] - meta: add tsc and build team as codeowners building.md (Rafael Gonzaga) #59298
• [e666e06781] - meta: add nodejs/path to path files (Rafael Gonzaga) #59289
• [251b65dd6c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140
• [c8a7964da8] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #58944
• [0eec5cc492] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #59011
• [4acf7cd6d3] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957
• [f57ee3d71f] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
• [4aefcfc318] - node-api: reword "implementation in an alternative VM" as implementable (Chengzhong Wu) #59036
• [ff6be2ed5d] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #59087
• [8d60602677] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #59094
• [035da74c31] - (SEMVER-MINOR) process: add threadCpuUsage (Paolo Insogna) #56467
• [74e1aa4d06] - process: make execve's args argument optional (Allon Murienik) #58412
• [3366e60bd9] - src: use simdjson to parse SEA configuration (Joyee Cheung) #59323
• [63cc06977a] - src: mark realm leaf classes final (Anna Henningsen) #59355
• [133d410cd9] - src: use C++20 contains() method (iknoom) #59304
• [57fe96fe49] - src: added CHECK_NOT_NULL check for multiple eq_wrap_async (F3lixTheCat) #59267
• [a8f381a6c5] - src: add nullptr checks in StreamPipe::New (Burkov Egor) #57613
• [0769e5a0dc] - src: call unmask after install signal handler (theanarkh) #59059
• [1e7639e9e1] - src: use FastStringKey for TrackV8FastApiCall (Anna Henningsen) #59148
• [9075a1a4bf] - src: use C++20 consteval for FastStringKey (Anna Henningsen) #59148
• [5a0fd5689b] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093
• [c637a2c41d] - src: add cache to nearest parent package json (Ilyas Shabi) #59086
• [3375a6cfee] - test: deflake sequential/test-tls-session-timeout (Joyee Cheung) #59423
• [438cb11a15] - test: update WPT resources,WebCryptoAPI,webstorage (Filip Skokan) #59311
• [68bec19f76] - test: add known issue test for fs.cpSync dereference bug (James M Snell) #58941
• [a100cce379] - test: deflake stream-readable-to-web test (Ethan Arrowood) #58948
• [b7577d853b] - test: make test-inspector-network-resource sequential (Shima Ryuhei) #59104
• [667ee82443] - test: don't use expose internals in test-http-outgoing-buffer.js (Meghan Denny) #59219
• [feec26d3bb] - test: use mustSucceed in test-fs-read (Sungwon) #59204
• [d7e23769ab] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #58100
• [3a9aca91c6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #59158
• [3aee7625b9] - test: expand linting rules around assert w literal messages (Anna Henningsen) #59147
• [667c2ced38] - test: update WPT for WebCryptoAPI to ab08796857 (Node.js GitHub Bot) #59129
• [89ac344393] - test: update WPT for WebCryptoAPI to 19d82c57ab (Node.js GitHub Bot) #59129
• [d332957ac6] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #59014
• [a23562ff72] - test: update startCLI to set --port=0 by default (Dario Piotrowicz) #59042
• [4a12f5d83b] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #59091
• [ac4f7aa69c] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #58977
• [8dd09267e3] - test,crypto: skip unsupported ciphers (Shelley Vohr) #59388
• [45200b43ea] - tools: update coverage GitHub Actions to fixed version (Rich Trott) #59512
• [8f2b8b3dc4] - tools: allow selecting test subsystems with numbers in their names (Darshan Sen) #59242
• [f9bc2573dd] - tools: clarify README linter error message (Joyee Cheung) #59160
• [cba0de128d] - tools: add support for URLs to PR commits in merge.sh (Antoine du Hamel) #59162
• [039949ef5b] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #59119
• [6a8a73aa35] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #59037
• [d0f40f3a3a] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #58992
• [9d801a3f00] - typings: improve internal binding types (Nam Yooseong) #59351
• [6dbda6cb25] - typings: improve internal binding types (Michaël Zasso) #59176
• [e22dddf859] - util: respect nested formats in styleText (Alex Yang) #59098
• [491f390515] - worker: add cpuUsage for worker (theanarkh) #59177
• [8e697d1884] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240

OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by allowing use of NIST's post-quantum cryptography standards for future-proofing applications against quantum computing threats. The following post-quantum algorithms are now available in node:crypto:

• ML-KEM (FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard) through new crypto.encapsulate() and crypto.decapsulate() methods.
• ML-DSA (FIPS 204, Module-Lattice-Based Digital Signature Standard) in the existing crypto.sign() and crypto.verify() methods.

Contributed by Filip Skokan in #59259 and #59491.

The second substantial extension to the Web Cryptography API (globalThis.crypto.subtle) was recently accepted for incubation by WICG. The following algorithms and methods from this extension are now available in the Node.js Web Cryptography API implementation:

• AES-OCB
• ChaCha20-Poly1305
• ML-DSA
• ML-KEM
• SHA-3
• SHAKE
• subtle.getPublicKey()
• SubtleCrypto.supports()
• ... with more coming in future releases.

Contributed by Filip Skokan in #59365, #59569, #59461, and #59539.

The single executable application configuration now supports additional fields to specify Node.js execution arguments and control how they can be extended when the application is run.

• execArgv takes an array of strings for the execution arguments to be used.
• execArgvExtension takes one of the following values:
  • "none": No additional execution arguments are allowed.
  • "cli": Additional execution arguments can be provided via a special command-line flag --node-options="--flag1 --flag2=value" at run time.
  • "env" (default): Additional execution arguments can be provided via the NODE_OPTIONS environment variable at run time.

For example, with the following configuration:

{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "execArgv": ["--no-warnings"],
  "execArgvExtension": "cli",
}

If the generated single executable application is named sea, then running:

sea --node-options="--max-old-space-size=4096" user-arg1 user-arg2

Would be equivalent to running:

node --no-warnings --max-old-space-size=4096 /path/to/bundled/script.js user-arg1 user-arg2

Contributed by Joyee Cheung in #59314 and #59560.

Certificates added:

• TrustAsia TLS ECC Root CA
• TrustAsia TLS RSA Root CA
• SwissSign RSA TLS Root CA 2022 - 1

Certificates removed:

• GlobalSign Root CA
• Entrust.net Premium 2048 Secure Server CA
• Baltimore CyberTrust Root
• Comodo AAA Services root
• XRamp Global CA Root
• Go Daddy Class 2 CA
• Starfield Class 2 CA

• [d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #50353
• [6ae202fcdf] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315
• [dafee05358] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #59455
• [8dc6f5b696] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #59464

• [0fa22cbf7c] - benchmark: calibrate config v8/serialize.js (Rafael Gonzaga) #59586
• [f5ece45b45] - benchmark: reduce readfile-permission-enabled config (Rafael Gonzaga) #59589
• [8ebd4f4434] - benchmark: calibrate length of util.diff (Rafael Gonzaga) #59588
• [7dee3ffd14] - benchmark: reflect current OpenSSL in crypto key benchmarks (Filip Skokan) #59459
• [027b861ca1] - benchmark, test: replace CRLF variable with string literal (Lee Jiho) #59466
• [89dd770889] - build: do not set -mminimal-toc with clang (Richard Lau) #59484
• [e13de4542f] - child_process: remove unsafe array iteration (hotpineapple) #59347
• [89fe63551e] - crypto: load system CA certificates off thread (Joyee Cheung) #59550
• [152c5ef518] - (SEMVER-MINOR) crypto: add AES-OCB Web Cryptography algorithm (Filip Skokan) #59539
• [c6c418343d] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571
• [18a2ee5b6c] - (SEMVER-MINOR) crypto: support ML-KEM in Web Cryptography (Filip Skokan) #59569
• [72937e5144] - crypto: require HMAC key length with SHA-3 hashes in Web Cryptography (Filip Skokan) #59567
• [b7383186c7] - crypto: fix subtle.getPublicKey error for secret type key inputs (Filip Skokan) #59558
• [2d05c046db] - crypto: return cached copies from CryptoKey algorithm and usages getters (Filip Skokan) #59538
• [207ffbeb07] - crypto: use CryptoKey internal slots in Web Cryptography (Filip Skokan) #59538
• [4276516781] - crypto: normalize RsaHashedKeyParams publicExponent (Filip Skokan) #59538
• [14741539a7] - (SEMVER-MINOR) crypto: support ML-KEM, DHKEM, and RSASVE key encapsulation mechanisms (Filip Skokan) #59491
• [d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #50353
• [4fe383e45a] - (SEMVER-MINOR) crypto: support ML-DSA spki/pkcs8 key formats in Web Cryptography (Filip Skokan) #59365
• [a95386fbf9] - (SEMVER-MINOR) crypto: subject some algorithms in Web Cryptography on BoringSSL absence (Filip Skokan) #59365
• [3f47a2fb63] - (SEMVER-MINOR) crypto: add ChaCha20-Poly1305 Web Cryptography algorithm (Filip Skokan) #59365
• [6fcce9058a] - (SEMVER-MINOR) crypto: add subtle.getPublicKey() utility function in Web Cryptography (Filip Skokan) #59365
• [76cde76429] - (SEMVER-MINOR) crypto: add SHA-3 Web Cryptography digest algorithms (Filip Skokan) #59365
• [247d017501] - (SEMVER-MINOR) crypto: add SHAKE Web Cryptography digest algorithms (Filip Skokan) #59365
• [f4fbcca5ce] - (SEMVER-MINOR) crypto: add SubtleCrypto.supports feature detection in Web Cryptography (Filip Skokan) #59365
• [a55382214f] - (SEMVER-MINOR) crypto: support ML-DSA in Web Cryptography (Filip Skokan) #59365
• [c38988c860] - crypto: fix EVPKeyCtxPointer::publicCheck() (Tobias Nießen) #59471
• [61c3bcdc56] - (SEMVER-MINOR) crypto: support ML-KEM KeyObject (Filip Skokan) #59461
• [0821b446fb] - deps: update undici to 7.14.0 (Node.js GitHub Bot) #59507
• [b3af17c065] - deps: V8: cherry-pick 7b91e3e2cbaf (Milad Fa) #59485
• [9b69baf146] - deps: V8: cherry-pick 59d52e311bb1 (Milad Fa) #59485
• [b4f202c2f1] - doc: improve sqlite.backup() progress/fulfillment documentation (René) #59598
• [40b217a2f9] - doc: clarify experimental platform vulnerability policy (Matteo Collina) #59591
• [cf84fffea5] - doc: link to TypedArray.from() in signature (Aviv Keller) #59226
• [4bf6ed0bf5] - doc: fix typos in environment_variables.md (PhistucK) #59536
• [1784c35a49] - doc: add security incident reponse plan (Rafael Gonzaga) #59470
• [b962560240] - doc: clarify maxRSS unit in process.resourceUsage() (Alex Yang) #59511
• [e6a6cdb9df] - doc: add missing Zstd strategy constants (RANDRIAMANANTENA Narindra Tiana Annaick) #59312
• [a6a31cb467] - (SEMVER-MINOR) doc: compress Web Cryptography Algorithm matrix (Filip Skokan) #59365
• [8f8960cfcb] - doc: fix the version tls.DEFAULT_CIPHERS was added (Allon Murienik) #59247
• [9e76089f1a] - doc: clarify glob's exclude option behavior (hotpineapple) #59245
• [dd5f835af7] - doc: add RafaelGSS as performance strategic lead (Rafael Gonzaga) #59445
• [2b7a7a525e] - doc,crypto: add supported asymmetric key types section (Filip Skokan) #59492
• [2fafe4c3bb] - esm: link modules synchronously when no async loader hooks are used (Joyee Cheung) #59519
• [5347c4997a] - esm: show race error message for inner module job race (Joyee Cheung) #59519
• [b56d8af2fe] - esm: sync-ify module translation (Joyee Cheung) #59453
• [b4a23d6a69] - http: trim off brackets from IPv6 addresses with string operations (Krishnadas PC) #59420
• [6ae202fcdf] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315
• [dafee05358] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #59455
• [b7ea39d860] - http2: report sent headers object in client stream dcs (Darshan Sen) #59419
• [ebe9272dae] - inspector: initial support websocket inspection (Shima Ryuhei) #59404
• [b35041c7dc] - inspector: prevent propagation of promise hooks to noPromise hooks (Shima Ryuhei) #58841
• [fe7176d7c6] - lib: do not modify prototype deprecated asyncResource (encore) (Szymon Łągiewka) #59518
• [93fc80a1e2] - (SEMVER-MINOR) lib: refactor kSupportedAlgorithms (Filip Skokan) #59365
• [9a12f71ad9] - lib: simplify IPv6 checks in isLoopback() (Krishnadas) #59375
• [566fb04c82] - meta: update devcontainer to the latest schema (Aviv Keller) #54347
• [389a24bbff] - module: allow overriding linked requests for a ModuleWrap (Chengzhong Wu) #59527
• [7880978fe3] - module: correctly detect top-level await in ambiguous contexts (Shima Ryuhei) #58646
• [99128d9244] - node-api: link to other programming language bindings (Chengzhong Wu) #59516
• [65c870e6cb] - node-api: clarify enum value ABI stability (Chengzhong Wu) #59085
• [352d63541a] - sea: implement execArgvExtension (Joyee Cheung) #59560
• [c6e3d5d98d] - (SEMVER-MINOR) sea: support execArgv in sea config (Joyee Cheung) #59314
• [e7084df4db] - sqlite: add sqlite-type symbol for DatabaseSync (Alex Yang) #59405
• [e2b6bdc640] - sqlite: handle ?NNN parameters as positional (Edy Silva) #59350
• [99e4a12731] - sqlite: avoid useless call to FromMaybe() (Tobias Nießen) #59490
• [dfd4962e5f] - src: enforce assumptions in FIXED_ONE_BYTE_STRING (Tobias Nießen) #58155
• [93a368df04] - src: use simdjson to parse --snapshot-config (Joyee Cheung) #59473
• [716750fcf8] - src: fix order of CHECK_NOT_NULL/dereference (Tobias Nießen) #59487
• [44a8ecf8d4] - src: assert memory calc for max-old-space-size-percentage (Asaf Federman) #59460
• [3462b46fca] - src: use simdjson::pad (0hm☘️) #59391
• [3e1551d845] - src: move shared_ptr objects in KeyObjectData (Tobias Nießen) #59472
• [c022c1f85a] - src: add internal GetOptionsAsFlags (Pietro Marchini) #59138
• [c0f08454a3] - src: iterate metadata version entries with std::array (Chengzhong Wu) #57866
• [f87836f3ae] - src: internalize v8::ConvertableToTraceFormat in traces (Chengzhong Wu) #57866
• [852b8e46d8] - src: remove duplicate assignment of O_EXCL in node_constants.cc (Daniel Osvaldo R) #59049
• [64ffde608f] - src: add Intel CET properties to large_pages.S (tjuhaszrh) #59363
• [823dce32ec] - src: update OpenSSL pqc checks (Filip Skokan) #59436
• [8dc6f5b696] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #59464
• [b2b8383755] - test: use mustSucceed in test-repl-tab-complete-import (Sohyeon Kim) #59368
• [e3ad5cc2c6] - test: skip sea tests on Linux ppc64le (Richard Lau) #59563
• [f78f47ca5a] - test: support standalone env comment in tests (Pietro Marchini) #59546
• [0e8bc2c7ac] - test: rename test-net-server-drop-connections-in-cluster.js to -http- (Meghan Denny) #59532
• [ed339580af] - test: lazy-load internalTTy (Pietro Marchini) #59517
• [fe86bc6da8] - test: fix test-setproctitle status when ps is not available (Antoine du Hamel) #59523
• [e517792973] - test: add parseTestMetadata support (Pietro Marchini) #59503
• [31092972d6] - test: update WPT for WebCryptoAPI to ff26d9b307 (Node.js GitHub Bot) #59497
• [16afd103cc] - (SEMVER-MINOR) test: add Web Cryptography wrap/unwrap vectors (Filip Skokan) #59365
• [5598baf34e] - (SEMVER-MINOR) test: cleanup test-webcrypto-supports (Filip Skokan) #59365
• [e7809d6ddb] - test: make test-debug-process locale-independent (BCD1me) #59254
• [ca7856e73c] - test: mark test-wasi-pthread as flaky (Joyee Cheung) #59488
• [0ecd82197f] - test: split test-wasi.js (Joyee Cheung) #59488
• [0930c218d6] - test: deflake connection refused proxy tests (Joyee Cheung) #59476
• [7f457f886a] - test: use case-insensitive path checking on Windows in fs.cpSync tests (Joyee Cheung) #59475
• [37809115f9] - test: add missing hasPostData in test-inspector-emit-protocol-event (Shima Ryuhei) #59412
• [f4722b1672] - test: refactor error checks to use assert.ifError/mustSucceed (Sohyeon Kim) #59424
• [9ff71a672d] - test: fix typos (Lee Jiho) #59330
• [9a7700da62] - test: skip test-watch-mode inspect when no inspector (James M Snell) #59440
• [e964c4334e] - test_runner: do not error when getting fullName of root context (René) #59377
• [e076f7857c] - test_runner: add option to rerun only failed tests (Moshe Atlow) #59443
• [eb8b1939a4] - test_runner: fix isSkipped check in junit (Sungwon) #59414
• [4e02ea1c52] - tools: update gyp-next to 0.20.3 (Node.js GitHub Bot) #59603
• [99da7fbe11] - tools: avoid parsing test files twice (Pietro Marchini) #59526
• [9a6a8e319b] - tools: update coverage GitHub Actions to fixed version (Rich Trott) #59512
• [8d28236aff] - tools: fix return value of try_check_compiler (theanarkh) #59434
• [52ab64ec3a] - tools: bump @eslint/plugin-kit from 0.3.3 to 0.3.4 in /tools/eslint (dependabot[bot]) #59271
• [baa22893bb] - typings: add missing URLBinding methods (성우현 | Woohyun Sung) #59468
• [b68e0d1eca] - util: fix error's namespaced node_modules highlighting using inspect (Ruben Bridgewater) #59446
• [15ae21b88a] - util: add some additional error classes to wellKnownPrototypes (Mark S. Miller) #59456
• [c38b7cfa35] - worker: fix worker name with \0 (theanarkh) #59214
• [f54ace694a] - worker: add worker name to report (theanarkh) #58935

• [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
• [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259
• [201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240
• [e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
• [c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #59293
• [aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897

• [f7484575ff] - assert: change utils to use index instead of for...of (방진혁) #59278
• [269cd16185] - benchmark: remove deprecated _extend from benchmark (Rafael Gonzaga) #59228
• [848e49c20b] - benchmark: add fs warmup to writefile-promises (Bruno Rodrigues) #59215
• [8c609be1b1] - benchmark: add calibrate-n script (Rafael Gonzaga) #59186
• [6a3bf772d8] - build: fix node_use_sqlite for GN builds (Shelley Vohr) #59017
• [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
• [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259
• [a312e706cf] - crypto: prepare webcrypto key import/export for modern algorithms (Filip Skokan) #59284
• [3a7c2c3a47] - deps: update ada to 3.2.7 (Node.js GitHub Bot) #59336
• [8d9ceeaf6a] - deps: update archs files for openssl-3.5.2 (Node.js GitHub Bot) #59371
• [33b06df354] - deps: upgrade openssl sources to openssl-3.5.2 (Node.js GitHub Bot) #59371
• [fa70f1af77] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #58237
• [f834a6be59] - deps: update undici to 7.13.0 (Node.js GitHub Bot) #59338
• [db2417487e] - deps: update sqlite to 3.50.4 (Node.js GitHub Bot) #59337
• [41978adb08] - deps: V8: backport 493cb53691be (Chengzhong Wu) #59238
• [05667991ca] - deps: V8: backport 1c3e018e7d48 (Renegade334) #58818
• [fd61588bb4] - doc: rename x509.extKeyUsage to x509.keyUsage (Filip Skokan) #59332
• [a271ae4360] - doc: fix Pbkdf2Params hash attribute heading (Filip Skokan) #59395
• [72cfff165b] - doc: fix missing reference links for server.keepAliveTimeoutBuffer (Lee Jiho) #59356
• [8341916772] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #59344
• [e3e489706b] - doc: run license-builder (github-actions[bot]) #59343
• [46527e8cea] - doc: correct orthography eg. → e.g. (Jacob Smith) #59329
• [d140c3713e] - doc: clarify the need of compiler compatible with c++20 (Rafael Gonzaga) #59297
• [95e9cabf9d] - doc: clarify release candidate stability index (Filip Skokan) #59295
• [a056dd36d2] - doc: add WDYT to glossary (btea) #59280
• [1e2c52f5c4] - doc: add manpage entry for --use-system-ca (Joyee Cheung) #59273
• [31a46fdeb4] - doc: add path.join and path.normalize clarification (Rafael Gonzaga) #59262
• [cff3725ff9] - doc: fix typo in test/common/README.md (Yoo) #59180
• [31a9283591] - doc: add note on process memoryUsage (fengmk2) #59026
• [5a98bff6b8] - doc: format safely for doc-kit (Aviv Keller) #59229
• [95b8b7ea5c] - domain: remove deprecated API call (Alex Yang) #59339
• [2990f178bd] - fs: fix glob TypeError on restricted dirs (Sylphy-0xd3ac) #58674
• [e2fb4caf9c] - fs: correct error message when FileHandle is transferred (Alex Yang) #59156
• [aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897
• [e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
• [0fb005a53f] - http2: set Http2Stream#sentHeaders for raw headers (Darshan Sen) #59244
• [e055539604] - lib: add trace-sigint APIs (theanarkh) #59040
• [d2183d860a] - lib: optimize writable stream buffer clearing (Yoo) #59406
• [47543a7e17] - lib: handle windows reserved device names on UNC (Rafael Gonzaga) #59286
• [c6911f0717] - lib: do not modify prototype deprecated asyncResource (RafaelGSS) #59195
• [3c88b769bb] - lib: restructure assert to become a class (Miguel Marcondes Filho) #58253
• [e91b54df59] - lib: handle superscript variants on windows device (Rafael Gonzaga) #59261
• [4ee467905d] - lib: use validateString (hotpineapple) #59296
• [c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #59293
• [c89b67e681] - lib: add type names in source mapped stack traces (Chengzhong Wu) #58976
• [5b2363be8d] - lib: prefer AsyncIteratorPrototype primordial (René) #59097
• [41b4f4d694] - meta: clarify pr objection process further (James M Snell) #59096
• [0eb5962f1e] - meta: add mailmap entry for aditi-1400 (Aditi) #59316
• [a2b72c2304] - meta: add tsc and build team as codeowners building.md (Rafael Gonzaga) #59298
• [d69f3ee1e0] - meta: add nodejs/path to path files (Rafael Gonzaga) #59289
• [1e37eab865] - node-api: reword "implementation in an alternative VM" as implementable (Chengzhong Wu) #59036
• [64add6302a] - src: use simdjson to parse SEA configuration (Joyee Cheung) #59323
• [e9c6636585] - src: mark realm leaf classes final (Anna Henningsen) #59355
• [42ef8147d1] - src: warn about FastOneByteString invalidation (James M Snell) #59275
• [8686b8037a] - src: remove unused DSAKeyExportJob (Filip Skokan) #59291
• [1e5f632666] - src: use C++20 contains() method (iknoom) #59304
• [22d4683cfe] - src: added CHECK_NOT_NULL check for multiple eq_wrap_async (F3lixTheCat) #59267
• [6a47ff4943] - src: clear all linked module caches once instantiated (Chengzhong Wu) #59117
• [33728cb4ca] - src: add nullptr checks in StreamPipe::New (Burkov Egor) #57613
• [4a907bdad1] - src: add percentage support to --max-old-space-size (Asaf Federman) #59082
• [7c189d4f55] - test: deflake sequential/test-tls-session-timeout (Joyee Cheung) #59423
• [fb0a6fb57f] - test: exclude mock from coverage (Shima Ryuhei) #59348
• [7e10f95f13] - test: split test-fs-cp.js (Joyee Cheung) #59408
• [41bcf5f659] - test: update WPT resources,WebCryptoAPI,webstorage (Filip Skokan) #59311
• [f9f3dc94cb] - test: add known issue test for fs.cpSync dereference bug (James M Snell) #58941
• [244d0c38a8] - test: deflake stream-readable-to-web test (Ethan Arrowood) #58948
• [564e604a1a] - test: make test-inspector-network-resource sequential (Shima Ryuhei) #59104
• [7ab13b7477] - test: don't use expose internals in test-http-outgoing-buffer.js (Meghan Denny) #59219
• [319df3859a] - test,crypto: skip unsupported ciphers (Shelley Vohr) #59388
• [713c70c32a] - test_runner: remove unused callee convertion (Alex Yang) #59221
• [e4ca30e115] - tools: disable nullability-completeness warnings (Michaël Zasso) #59392
• [dab7f6b542] - tools: check for std::vector<v8::Local> in lint (Aditi) #58497
• [7b94982eb0] - tools: allow selecting test subsystems with numbers in their names (Darshan Sen) #59242
• [16bbcd8881] - typings: improve internal binding types (Nam Yooseong) #59351
• [76bc4d659b] - typings: improve internal binding types (Michaël Zasso) #59176
• [eecd3272a6] - worker: add name for worker (theanarkh) #59213
• [84c3513ce2] - worker: implements nits in Web Locks code (Antoine du Hamel) #59270
• [bd68fbd753] - worker: add cpuUsage for worker (theanarkh) #59177
• [201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240

This release is distributed with OpenSSL 3.5.1, following the announcement that OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be supported until April 2028. Read more about OpenSSL support in their blog post: https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/.

Contributed by Richard Lau in #58100.

Node.js supports both source phase imports and instance phase imports to WebAssembly modules and for WASM imports to JavaScript, in line with the current Phase 3 WebAssembly ESM Integration proposal. The implementation and the specification are still subject to change.

Contributed by Guy Bedford in #57038.

node:http and node:https now support proxies. When NODE_USE_ENV_PROXY is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY, https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the environment variables, and proxy the requests sent through the built-in http/https client accordingly.

To use global proxy support from the command line:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js

In addition, http.Agent and https.Agent now support the custom proxyEnv options.

const agent = new https.Agent({ proxyEnv: { HTTPS_PROXY: 'http://proxy.example.com:8080' } });

For reference, fetch() already supports NODE_USE_ENV_PROXY as of Node.js 24.0.0.

Contributed by Joyee Cheung in https://github.com/nodejs/node/pull/58980.

This API allows dynamically configuring CA certificates that will be used by the Node.js TLS clients by default.

Once called, the provided certificates will become the default CA certificate list returned by tls.getCACertificates('default') and used by TLS connections that don't specify their own CA certificates.

To add system CA certificates to the default bundle (which includes the Mozilla CA certificates):

tls.setDefaultCACertificates(tls.getCACertificates('default').concat(tls.getCACertificates('system')));

Contributed by Joyee Cheung in https://github.com/nodejs/node/pull/58822.

• [d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
• [c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
• [927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
• [f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
• [9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

• [5457c7a8a1] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #59187
• [28538f2255] - benchmark: add --track to benchmark (Rafael Gonzaga) #59174
• [a28d804497] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #59172
• [09717eb68e] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #59171
• [ad6757ef02] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #59170
• [7fc3143f61] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #59116
• [f2812723a0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #59043
• [e3e729ca60] - build: remove suppressions.supp (Rafael Gonzaga) #59079
• [dc66422768] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #58100
• [f5da4947d9] - cli: add --use-env-proxy (Joyee Cheung) #59151
• [d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
• [eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
• [135fca5b72] - crypto: avoid copying buffers to UTF-8 strings in crypto.hash() (Renegade334) #59067
• [998cef10e3] - deps: update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234
• [1f06ca956a] - deps: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #59234
• [55a90eed8d] - deps: upgrade npm to 11.5.1 (npm team) #59199
• [2b5d451ae0] - deps: update amaro to 1.1.1 (Node.js GitHub Bot) #59141
• [af789d9b5c] - deps: update undici to 7.12.0 (Node.js GitHub Bot) #59135
• [a34e44545e] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132
• [bfe4781c7d] - deps: update googletest to 7e17b15 (Node.js GitHub Bot) #59131
• [72adf52e51] - deps: update ada to 3.2.6 (Node.js GitHub Bot) #58966
• [2a5f35b589] - deps: V8: cherry-pick 3d750c2aa9ef (Michaël Zasso) #58750
• [3f813eaba7] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
• [fb52d0d8df] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
• [f122602f9d] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
• [c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
• [927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
• [9a8d2020ad] - doc: copyedit SECURITY.md (Rich Trott) #59190
• [3da5bc0668] - doc: fix broken sentence in URL.parse (Superchupu) #59164
• [06cd7461e0] - doc: improve onboarding instructions (Joyee Cheung) #59159
• [dfb72d158b] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #58917
• [51b8dfd5c6] - doc: add Aditi-1400 to collaborators (Aditi) #59157
• [4ffa756ce3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #59111
• [6f81b274f7] - doc: fix typo in writing-test.md (SeokHun) #59123
• [88e434e687] - doc: add new environment variables doc page (Dario Piotrowicz) #59052
• [b1a318d706] - doc: update release key for aduh95 (Antoine du Hamel) #58877
• [34c49000c9] - doc: add missing section for setReturnArrays in sqlite.md (Edy Silva) #59074
• [9b2e965aff] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #59078
• [2d1dcb87e6] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #59050
• [999b5e51e7] - doc: run license-builder (github-actions[bot]) #59056
• [1940a2cb46] - doc: fix typed list formatting (Aviv Keller) #59019
• [6cb5e0d22f] - doc: refine util.parseArgs default definition (Slayer95) #58958
• [d2e7f8e13a] - doc: remove unused import in zlib.md (coderaiser) #59041
• [9d02960149] - doc: add missing environment variables to manpage (amir lavasani) #58963
• [45ffdb34fb] - doc: add stability index to the --watch-kill-signal flag (Dario Piotrowicz) #58997
• [3924c43600] - doc: add missing <code> blocks (Antoine du Hamel) #58995
• [cb95e183f3] - doc: add scroll margin to links (Roman Reiss) #58982
• [c9ded6ba15] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #58983
• [b919fe0447] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
• [71bb6cd077] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #59020
• [8d869e6d62] - fs: fix return value of fs APIs (theanarkh) #58996
• [7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
• [85d6a28f4f] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077
• [cfaa299f2e] - lib: fix incorrect ArrayBufferPrototypeGetDetached primordial type (Dario Piotrowicz) #58978
• [d555db22ad] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #58928
• [96c9dd79e6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140
• [324d9fc9d4] - meta: enable jsdoc/check-tag-names rule (Yagiz Nizipli) #58521
• [04c751463b] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #58944
• [fe0195fdcc] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #59011
• [515b581d47] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957
• [f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
• [15e6c28d82] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #59087
• [f67b686551] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #59094
• [3d2f919f7c] - process: make execve's args argument optional (Allon Murienik) #58412
• [1a44265810] - repl: handle errors from getters during completion (Shima Ryuhei) #59044
• [467dbd31e6] - repl: fix repl crashing on variable declarations without init (Dario Piotrowicz) #59032
• [3a3eb6852d] - repl: improve REPL disabling completion on proxies and getters (Dario Piotrowicz) #58891
• [55838e79b8] - src: call unmask after install signal handler (theanarkh) #59059
• [77649ad93b] - src: use FastStringKey for TrackV8FastApiCall (Anna Henningsen) #59148
• [86babf9c4b] - src: use C++20 consteval for FastStringKey (Anna Henningsen) #59148
• [88b99eeae1] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093
• [d89390fc8f] - src: add cache to nearest parent package json (Ilyas Shabi) #59086
• [21780075e4] - src: check import attributes value types as strings (Chengzhong Wu) #58986
• [ef89c2fac9] - src,test: fix config file parsing for flags defaulted to true (Edy Silva) #59110
• [1e990866e0] - test: mark web lock held test as flaky (Ilyas Shabi) #59144
• [ba8e95a785] - test: use mustSucceed in test-fs-read (Sungwon) #59204
• [39978f507f] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #58100
• [1c3aadb9d6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #59158
• [a0d22e9c51] - test: remove timeout in test-https-proxy-request-handshake-failure (Joyee Cheung) #59165
• [7e0a0fccc1] - test: expand linting rules around assert w literal messages (Anna Henningsen) #59147
• [c6070046c3] - test: update WPT for WebCryptoAPI to ab08796857 (Node.js GitHub Bot) #59129
• [15d8cc908e] - test: update WPT for WebCryptoAPI to 19d82c57ab (Node.js GitHub Bot) #59129
• [83023e5144] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #59014
• [82d4175ec3] - test: update startCLI to set --port=0 by default (Dario Piotrowicz) #59042
• [16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
• [a9511a6066] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #59091
• [1cffcc02a3] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #58977
• [83cdf1701b] - test_runner: clean up promisified interval generation (René) #58824
• [195d6038dc] - tools: clarify README linter error message (Joyee Cheung) #59160
• [51f578a3bf] - tools: add support for URLs to PR commits in merge.sh (Antoine du Hamel) #59162
• [20be9012eb] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #59119
• [623e264e93] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #59037
• [0e547e09ab] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #58992
• [075d1968db] - util: respect nested formats in styleText (Alex Yang) #59098
• [9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

Node.js will be able to execute TypeScript files without additional configuration:

$ echo 'const foo: string = 'World'; console.log(`Hello ${foo}!`);' > file.ts
$ node file.ts
Hello World!

There are some limitations in the supported syntax documented at https://nodejs.org/api/typescript.html#type-stripping.

This feature is experimental and is subject to change. Disable it by passing --no-experimental-strip-types CLI flag.

Contributed by Marco Ippolito in #56350.

• [26f3711228] - (SEMVER-MINOR) deps: update amaro to 1.1.0 (Node.js GitHub Bot) #56350
• [d80ef2a71f] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719
• [8ab24d21c9] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
• [430e66b9b8] - (SEMVER-MINOR) esm: implement import.meta.main (Joe) #57804
• [62f7926b6a] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
• [65f19a00c3] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853
• [ccca1517f9] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #58697
• [48003e87e8] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #58951
• [fe4290a0e6] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700
• [4dc6b4c67a] - (SEMVER-MINOR) watch: add --watch-kill-signal flag (Dario Piotrowicz) #58719
• [8dbc6b210f] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #58385

• [b19ffebea7] - assert: remove dead code (Yoshiya Hinosawa) #58760
• [5bc828beae] - benchmark: add source map and source map cache (Miguel Marcondes Filho) #58125
• [f7c16985a7] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr) #58867
• [ba42c72f7f] - build: option to use custom inspector_protocol path (Shelley Vohr) #58839
• [4fd8911653] - build: fix typo 'Stoage' to 'Storage' in help text (ganglike) #58777
• [114cd95919] - crypto: fix inclusion of OPENSSL_IS_BORINGSSL define (Shelley Vohr) #58845
• [6699c75eac] - crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan) #58942
• [f99aa748c0] - deps: upgrade npm to 10.9.3 (npm team) #58847
• [02e971190b] - deps: update sqlite to 3.50.2 (Node.js GitHub Bot) #58882
• [de2b85b5ae] - deps: update googletest to 35b75a2 (Node.js GitHub Bot) #58710
• [e7591d7a19] - deps: update minimatch to 10.0.3 (Node.js GitHub Bot) #58712
• [8c61b96c43] - deps: update acorn to 8.15.0 (Node.js GitHub Bot) #58711
• [113f4e2d3c] - deps: update sqlite to 3.50.1 (Node.js GitHub Bot) #58630
• [7ccd848995] - deps: update simdjson to 3.13.0 (Node.js GitHub Bot) #58629
• [e9c51deb5c] - deps: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) #58628
• [26f3711228] - (SEMVER-MINOR) deps: update amaro to 1.1.0 (Node.js GitHub Bot) #56350
• [752dde182f] - (SEMVER-MINOR) deps: update amaro to 1.0.0 (Node.js GitHub Bot) #56350
• [258534d0dc] - (SEMVER-MINOR) deps: update amaro to 0.5.3 (Node.js GitHub Bot) #56350
• [7fcf675503] - (SEMVER-MINOR) deps: update amaro to 0.5.2 (Node.js GitHub Bot) #56350
• [81a10a67d5] - (SEMVER-MINOR) deps: update amaro to 0.5.1 (Marco Ippolito) #56350
• [25f8682a62] - (SEMVER-MINOR) deps: update amaro to 0.5.0 (nodejs-github-bot) #56350
• [4baf2167e7] - dns: fix parse memory leaky (theanarkh) #58973
• [e8f4a7df22] - dns: set timeout to 1000ms when timeout < 0 (theanarkh) #58441
• [1e373a0a25] - doc: update release key for aduh95 (Antoine du Hamel) #58877
• [d5c104246f] - doc: remove broken link to permission model source code (Juan José) #58972
• [b8885a25ff] - doc: clarify details of TSC public and private meetings (James M Snell) #58925
• [aa05823b37] - doc: mark stability markers consistent in globals.md (Antoine du Hamel) #58932
• [3856aee9b2] - doc: move "Core Promise APIs" to "Completed initiatives" (Antoine du Hamel) #58934
• [c2f9735422] - doc: fix fetch subsections in globals.md (Antoine du Hamel) #58933
• [5f4c7a9d2d] - doc: add missing Class: mentions (Antoine du Hamel) #58931
• [88ee38b37c] - doc: remove myself from security steward rotation (Michael Dawson) #58927
• [02031a9b0d] - doc: add ovflowd back to core collaborators (Claudio W.) #58911
• [9551fa3c8f] - doc: update email address for Richard Lau (Richard Lau) #58910
• [cd6bc982c0] - doc: update vm doc links (Chengzhong Wu) #58885
• [ce49303cd0] - doc: add missing comma in child_process.md (ronijames008) #58862
• [d80ef2a71f] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719
• [f8fcb1c83a] - doc: fix jsdoc definition of assert.ifError() fn in lib/assert.js (jesh) #58573
• [28fddc04ca] - doc: add array type in http request headers (Michael Henrique) #58049
• [8bd698b688] - doc: add missing colon to headers in globals.md (Aviv Keller) #58825
• [fa5818e3c1] - doc: fix stream.md section order (Antoine du Hamel) #58811
• [2384bfdcbd] - doc: fix stability 1.x links excluding the decimal digit (Dario Piotrowicz) #58783
• [4e9fe670c9] - doc: fix wrong RFC number in http2 (Deokjin Kim) #58753
• [bbe4ad7351] - doc: add history entry for TS support in hooks (Antoine du Hamel) #58732
• [ec60473ab1] - doc: run license-builder (github-actions[bot]) #58722
• [8ab24d21c9] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
• [8c641105cd] - doc: punctuation fix for Node-API versioning clarification (Jiacai Liu) #58599
• [133b10a0bb] - doc: add path rules and validation for export targets in package.json (0hm☘️) #58604
• [354a68c460] - doc: add history entries to --input-type section (Antoine du Hamel) #56350
• [430e66b9b8] - (SEMVER-MINOR) esm: implement import.meta.main (Joe) #57804
• [42c4ca6024] - esm: syncify default path of ModuleLoader.load (Jacob Smith) #57419
• [3ac8c686a3] - esm: unwrap WebAssembly.Global on Wasm Namespaces (Guy Bedford) #57525
• [c7ebf2e245] - fs: close dir before throwing if options.bufferSize is invalid (Livia Medeiros) #58856
• [38ffed8744] - fs: special input -1 on chown, lchown and fchown (Alex Yang) #58836
• [0e82f72a46] - fs: throw ERR_INVALID_THIS on illegal invocations (Livia Medeiros) #58848
• [141b2b1954] - fs: make Dir disposers idempotent (René) #58692
• [dedd9d1961] - fs: avoid computing time coefficient constants in runtime (Livia Medeiros) #58728
• [a029a06b49] - fs: add UV_ENOSPC to list of things to pass to err directly (Jacky Zhao) #56918
• [62f7926b6a] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
• [927d2e77f3] - http: fix keep-alive not timing out after post-request empty line (Shima Ryuhei) #58178
• [5cd8145612] - http2: add diagnostics channel 'http2.server.stream.close' (Darshan Sen) #58602
• [0f2b31cba4] - inspector: add protocol methods retrieving sent/received data (Chengzhong Wu) #58645
• [79428d8946] - lib: fix getTypeScriptParsingMode jsdoc (沈鸿飞) #58681
• [2c205d857c] - lib: rename validateInternalField into validateThisInternalField (LiviaMedeiros) #58765
• [f67e927a5f] - lib: make validateInternalField() throw ERR_INVALID_THIS (LiviaMedeiros) #58765
• [914701d4f8] - lib,src: support DOMException ser-des (Chengzhong Wu) #58649
• [12a75dca8b] - meta: bump step-security/harden-runner from 2.12.0 to 2.12.2 (dependabot[bot]) #58923
• [0d56fec6f0] - meta: bump github/codeql-action from 3.28.18 to 3.29.2 (dependabot[bot]) #58922
• [7f4f6e0409] - meta: add IlyasShabi to collaborators (Ilyas Shabi) #58916
• [50b62c9663] - meta: add @nodejs/inspector as codeowner (Chengzhong Wu) #58790
• [2fc89892ab] - module: fix typescript import.meta.main (Marco Ippolito) #58661
• [bfc68c8ae8] - module: convert schema-only core module on convertCJSFilenameToURL (Alex Yang) #58612
• [54634f5e53] - module: update tests for combined ambiguous module syntax error (Mert Can Altin) #55874
• [10eb3db4af] - module: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) #58598
• [fe7994eb0c] - module: improve typescript error message format (Marco Ippolito) #56350
• [c898491017] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #56350
• [c07745a436] - module: refactor commonjs typescript loader (Marco Ippolito) #56350
• [8d1f5df313] - (SEMVER-MINOR) module: unflag --experimental-strip-types (Marco Ippolito) #56350
• [a8a1c9a960] - os: fix GetInterfaceAddresses memory lieaky (theanarkh) #58940
• [65f19a00c3] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853
• [f0a165d89f] - repl: fix eval errors thrown after close throwing ERR_USE_AFTER_CLOSE (Dario Piotrowicz) #58791
• [9ef1cd1607] - repl: avoid deprecated require.extensions in tab completion (baki gul) #58653
• [22a4c60e08] - repl: fix tab completion not working with computer string properties (Dario Piotrowicz) #58709
• [ccca1517f9] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #58697
• [690525881e] - src: simplify adding fast APIs to ExternalReferenceRegistry (René) #58896
• [a381b4d990] - src: remove fast API for InternalModuleStat (Joyee Cheung) #58489
• [390654e996] - src: fix internalModuleStat v8 fast path (Yagiz Nizipli) #58054
• [b722647572] - src: fix -Wunreachable-code in src/node_api.cc (Shelley Vohr) #58901
• [6d1fe67f56] - src: -Wunreachable-code error in crypto_context.cc (Shelley Vohr) #58901
• [2d8e65c6db] - src: fix -Wunreachable-code-return in src/node_contextify.cc (Shelley Vohr) #58901
• [e07adb3b18] - src: cleanup uv_fs_req before uv_fs_stat on existSync (RafaelGSS) #58915
• [6b30c0a511] - src: -Wmismatched-new-delete in debug_utils.cc (Shelley Vohr) #58844
• [74ef07f2e7] - src: add FromV8Value<T>() for integral and enum types (Aditi) #57931
• [28bf6ed87d] - src: pass resource on permission checks for spawn (Rafael Gonzaga) #58758
• [daf65d479b] - src: replace std::array with static arrays in contextify (Mert Can Altin) #58580
• [9cb671fdb1] - src: add new CopyUtimes function to reduce code duplication (Dario Piotrowicz) #58625
• [e515eb861c] - src: replace V8 Fast API todo comment with note comment (Dario Piotrowicz) #58614
• [48003e87e8] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #58951
• [72f75bb976] - src,permission: enhance permission model debug (Rafael Gonzaga) #58898
• [66fccc252b] - (SEMVER-MINOR) test: add test for async disposable worker thread (James M Snell) #58385
• [43d2ad8599] - test: deflake test-runner-watch-mode-kill-signal (Dario Piotrowicz) #58952
• [7c54085698] - test: add known issue tests for recursive readdir calls with Buffer path (Dario Piotrowicz) #58893
• [cd2a5d9a51] - test: add known issue tests for fs.cp (James M Snell) #58883
• [26072a7953] - test: add tests to ensure that node.1 is kept in sync with cli.md (Dario Piotrowicz) #58878
• [3fd187f559] - test: replace .filter()[0] with .find() (Livia Medeiros) #58872
• [0d538abb15] - test: remove reliance on in-tree deps/undici (Richard Lau) #58866
• [e24dede403] - test: close dirs in fs-opendir test (Livia Medeiros) #58855
• [ac6b8222e6] - test: correct SIMD support comment (Richard Lau) #58767
• [9d3e451181] - test: add tests for REPL custom evals (Dario Piotrowicz) #57850
• [17a3246718] - test: reduce the use of private symbols in test-events-once.js (Yoshiya Hinosawa) #58685
• [bbf33efcd0] - test: use common.skipIfInspectorDisabled() to skip tests (Dario Piotrowicz) #58675
• [d6660baff7] - test: update WPT for dom/abort to dc928169ee (Node.js GitHub Bot) #58644
• [6d9d5deb44] - test: split indirect eval import tests (Chengzhong Wu) #58637
• [abd5b5fd20] - test: deflake async-hooks/test-improper-order on AIX (Baki Gul) #58567
• [3fc630e7cf] - test: close FileHandle objects in tests explicitly (James M Snell) #58615
• [7f0560dc4b] - test: skip broken sea on rhel8 (Marco Ippolito) #58914
• [898e68a915] - test: save the config file in a temporary directory (Luigi Pinca) #58799
• [9f2132a4f6] - test: deflake test-config-file (Luigi Pinca) #58799
• [f1b74cff9a] - test: skip tests failing when run under root (Livia Medeiros) #58610
• [4b0ee14a97] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #58921
• [a84935fb0e] - tools: update inspector_protocol to 69d69dd (Shelley Vohr) #58900
• [af805186cd] - tools: update gyp-next to 0.20.2 (Node.js GitHub Bot) #58788
• [a2d2d36bb1] - tools: make nodedownload module compatible with Python 3.14 (Lumír 'Frenzy' Balhar) #58752
• [cc8b9aa43d] - tools: include toolchain.gypi in abseil.gyp (Chengzhong Wu) #58678
• [fbbf49a7d3] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #58699
• [8db92a41c5] - tools: bump brace-expansion from 1.1.11 to 1.1.12 in /tools/eslint (dependabot[bot]) #58698
• [3a099cf88f] - tools: switch to @stylistic/eslint-plugin (Michaël Zasso) #58623
• [9798511e7c] - tools: remove config.status under make distclean (René) #58603
• [011290a4eb] - tools: edit commit-queue workflow file (Antoine du Hamel) #58667
• [a7406f56da] - tools: improve release proposal linter (Antoine du Hamel) #58647
• [c855310f83] - tools,doc: move more MDN links to types (Antoine du Hamel) #58930
• [805239c824] - typings: add Atomics primordials (Renegade334) #58577
• [d28b2aa0a2] - typings: add ZSTD_COMPRESS, ZSTD_DECOMPRESS to internalBinding (Meghan Denny) #58655
• [fe4290a0e6] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700
• [db648b92c1] - util: inspect: do not crash on an Error stack pointing to itself (Sam Verschueren) #58196
• [791ecfac14] - v8: fix missing callback in heap utils destroy (Ruben Bridgewater) #58846
• [4dc6b4c67a] - (SEMVER-MINOR) watch: add --watch-kill-signal flag (Dario Piotrowicz) #58719
• [8dbc6b210f] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #58385

This is a security release.

• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

• [db7b93fcef] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721

This is a security release.

• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

• [8cf5d66ab7] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721
• [9c0cb487ec] - win,build: fix MSVS v17.14 compilation issue (StefanStojanovic) #58902

This is a security release.

• (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
• (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

• [c33223f1a5] - (CVE-2025-27209) deps: V8: revert rapidhash commits (Michaël Zasso) nodejs-private/node-private#713
• [56f9db2aaa] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721