11801 Commits
Author SHA1 Message Date
Guy Bedford ec7a28f2e0 module: cache compiled WebAssembly modules in the compile cache
Extends the module compile cache to WebAssembly modules loaded through
the ES module integration. A new kWasm entry type is keyed on the module
URL with the wire bytes as the hashed source, and stores the serialized
CompiledWasmModule. On load, cached code is deserialized through
v8::WasmModuleCompilation with the same compile options the translator
uses (js-string builtins and imported string constants), falling back
to compilation when V8 rejects it.

As for JavaScript, the cache entry is generated right after compilation.
V8 only serializes optimized tier code, so with the default lazy
baseline compilation there is nothing to cache and no entry is written;
a complete cache requires --no-liftoff --no-wasm-lazy-compilation, which
is documented as the way to use the compile cache for WebAssembly.

Signed-off-by: Guy Bedford <guybedford@gmail.com>
Assisted-by: Claude Code
PR-URL: https://github.com/nodejs/node/pull/66191
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2026-10-28 01:46:44 +00:00
Philipp Dunkel 7622ebb3d7 zlib: add raw content read methods to ZipEntry
zipEntry.rawContent was a getter that exposed the retained buffer of an
in-memory entry and returned null for a file-backed or streaming one,
so the still-compressed bytes of a member read through ZipFile could
not be obtained at all.

Replace it with rawContent(), rawContentSync() and
rawContentIterator(), which mirror content(), contentSync() and
contentIterator() but return the bytes as stored, without
decompressing or verifying them. They work for every entry that has
readable content, return caller-owned buffers from the buffered
variants, and accept a maxSize bound on the compressed size.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/66801
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2026-10-27 17:45:32 +00:00
Rafael Gonzaga 7abbd56cfd doc: document the alpha release process
Document how to prepare, version, tag and promote the Alpha releases
introduced by the new release schedule, starting with Node.js 27, and
how the first Alpha and semver-major releases are prepared with
git node release.

Refs: https://github.com/nodejs/Release/issues/1187
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66796
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-10-26 16:32:08 +00:00
Antoine du Hamel 1ae40765d6 Revert "build, doc: move to redesign"
This reverts commit 18a9ba509a.

PR-URL: https://github.com/nodejs/node/pull/67015
Refs: https://github.com/nodejs/node/issues/66571
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
2026-10-26 16:08:31 +01:00
Ravi Arnan Irianto ba3c34a93a doc: fix grammar and phrasing in typescript.md
Fix grammatical issues and heading phrasing in `doc/api/typescript.md`:
- Correct subject-verb agreement ("files that contains" -> "files that
  contain").
- Add missing indefinite article ("result in an ... error").
- Change heading from "Paths aliases" to "Path aliases" to match
  standard TypeScript terminology.
- Clarify verb parallelism ("won't be transformed and will therefore
  produce an error").

Signed-off-by: Ravi Arnan <raviarnankeren@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66977
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
2026-10-26 07:56:41 +00:00
Filip Skokan a2cd8aa883 crypto,https,tls: end OpenSSL engine support
OpenSSL removed support for engines in version 4. Remove the Node.js
APIs, constants, native bindings, and implementation that depend on
ENGINE.

Keep recognizing the former TLS and HTTPS engine options so their use
fails explicitly instead of appearing to work while being ignored.

Move DEP0183 directly from Documentation-only to End-of-Life after
reverting its unreleased Runtime deprecation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-25 22:36:38 +01:00
Filip Skokan b61e682fc0 Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs (DEP0183)"
This reverts commit da516920fc.

PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-25 22:36:37 +01:00
Filip Skokan fb8d52d75a crypto: move DEP0093 to End-of-Life
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-25 22:36:36 +01:00
Filip Skokan 7f16850ef6 doc: remove OpenSSL 1.x references
Rename the openssl30 footnote, which marks APIs unavailable on
BoringSSL rather than ones requiring OpenSSL. Remove obsolete version
qualifiers from the provider and FIPS documentation, drop the "As of
OpenSSL 1.1.0" anchor from the PSK size limits, and point the man1.1.1
links at man3.0.

Document BoringSSL as the only backend with numeric key adapters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-25 22:36:33 +01:00
Filip Skokan b12bad4b11 build,deps,tools: prepare to update to OpenSSL 4.1
Update the updater script and files under `deps/openssl/config` in
preparation for updating `deps/openssl` to OpenSSL 4.1.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66758
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-10-23 23:47:23 +00:00
Rafael Gonzaga 2e4f8cfa20 doc: add rafael and antoine as last security release stewards
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66909
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
2026-10-23 22:37:13 +00:00
Rafael Gonzaga 84f8e2f3a9 doc: document --allow-fs-vfs in the permission model page
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66793
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-23 17:20:07 +00:00
Filip Skokan 952dcb2dc2 doc: update config schema for test-forbid-only
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66945
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
2026-10-23 10:22:44 +02:00
joao-oliveira-softtor 45b6626457 test_runner: add option to forbid exclusive tests
Add --test-forbid-only and the forbidOnly run() option to detect
accidentally committed exclusive tests. Reject only declarations and
runOnly(true) in both isolation modes, and record a run-level failure
so TODO and expected failures cannot absorb the error.

Document the runtime-only detection and add regression coverage for
filtering, option inheritance, both isolation modes, and disabled
guards.

Refs: https://github.com/nodejs/node/issues/60917
Assisted-by: a coding agent
Signed-off-by: João Victor <joao.oliveira@softtor.com.br>
PR-URL: https://github.com/nodejs/node/pull/66578
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
2026-10-23 07:04:37 +00:00
Guilherme Araújo 6d4646731e doc: mark test runner watch mode as stable
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66708
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Tierney Cyren <hello@bnb.im>
2026-10-22 22:59:58 +00:00
Rafael Gonzaga a7e06d975d permission: reject wildcard references when dropping env
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66773
Reviewed-By: James M Snell <jasnell@gmail.com>
2026-10-22 20:12:12 +00:00
Filip Skokan 936b20c074 doc,crypto: mark raw key formats as stable
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66829
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
2026-10-21 14:28:48 +00:00
Antoine du Hamel b85dd8021c 2026-10-21, Version 22.23.4 'Jod' (LTS)
This is a security release.

Notable changes:

* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel)
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
* deps: update timezone to 2026e (Node.js GitHub Bot)
* deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
* deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
* deps: update undici to 6.29.1 (Node.js GitHub Bot)

PR-URL: https://github.com/nodejs-private/node-private/pull/1010
2026-10-21 12:04:28 +02:00
Antoine du Hamel b29989dda4 2026-10-21, Version 24.22.1 'Krypton' (LTS)
This is a security release.

Notable changes:

* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
* (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel)
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
* deps: update timezone to 2026e (Node.js GitHub Bot)
* deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
* deps: update undici to 7.30.1 (Node.js GitHub Bot)

PR-URL: https://github.com/nodejs-private/node-private/pull/1012
2026-10-21 12:03:11 +02:00
RafaelGSS 18aaee07d6 2026-10-21, Version 26.12.1 (Current)
This is a security release.

Notable changes:

* (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
* (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) – High
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
* (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
* (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
* deps: V8: backport 93cd21e8254b (Joyee Cheung)
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
* tls: reject chains containing blocked public keys (Ulises Gascon)
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
* tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
* crypto: harden X.509 conversion and formatting (Filip Skokan)

PR-URL: https://github.com/nodejs-private/node-private/pull/1013
2026-10-21 12:02:46 +02:00
Marco Ippolito 67d0e5faca doc: update node-config-schema.json
Regenerate the schema with tools/doc/generate-json-schema.mjs. It had
fallen out of date because test-config-json-schema was not running in
CI.

Assisted-by: claude:opus-5.5
Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66827
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-21 04:58:22 +00:00
Philipp Dunkel df2ea49e00 zlib: add crc32c
Add zlib.crc32c(data[, value]), which computes the CRC-32C checksum
(Castagnoli polynomial, RFC 3720 section 12.1). CRC-32C has better
error detection properties than the CRC-32 of zlib.crc32() and is the
checksum required by many current protocols, formats and services,
among them:

- iSCSI header and data digests (RFC 7143)
- SCTP packet checksums (RFC 9260)
- iWARP MPA framing (RFC 5044)
- NVMe/TCP header and data digests
- ext4, Btrfs and XFS metadata checksums
- the Snappy framing format
- Apache Kafka record batches
- LevelDB and RocksDB block checksums
- TensorFlow TFRecord files
- Google Cloud Storage and Amazon S3 object checksums

Implementing any of these in JavaScript currently needs a userland
CRC-32C, which is far slower than native code.

The function mirrors zlib.crc32(): it accepts a string (encoded as
UTF-8) or an ArrayBufferView, takes an optional 32-bit unsigned
starting value so a checksum can be continued across chunks, and has a
V8 fast API path.

The checksum is computed by absl::ExtendCrc32c() from the bundled
Abseil, which is already built and linked into node, so this adds no
new dependency and no new checksum implementation. absl_crc32c is
added to the libraries linked with --shared-abseil.

Abseil selects its hardware-accelerated CRC-32C path (SSE4.2 and
PCLMULQDQ on x64, the CRC32 and PMULL extensions on arm64) at compile
time, so with node's default compiler flags the portable table-driven
implementation is used. It runs at about the same speed as zlib.crc32()
(about 6.5 GB/s on a recent x64 machine), while the hardware path
reaches about 38 GB/s. Builds whose target CPU baseline already
includes those instructions get the hardware path without changes.
Enabling it for generic builds is left out on purpose: on x64, Abseil
uses the accelerated code for unrecognized CPUs without a runtime
feature check, so compiling it in unconditionally would fault on CPUs
without SSE4.2.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/66828
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-10-20 12:33:08 +00:00
Efe Karasakal 1a54c4fe8c quic: truncate CONNECTION_CLOSE frame reason field
Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: https://github.com/nodejs/node/pull/66644
Reviewed-By: Tim Perry <pimterry@gmail.com>
2026-10-20 11:01:08 +00:00
Guy Bedford 8ae0ad0683 module: add "worker" condition for Web Worker threads
Adds a "worker" package condition that is applied within Web Worker
threads created via the `Worker` global, for the worker entry point,
its dependencies, `import()`, `require()` and `import.meta.resolve()`.
Threads created via `worker_threads`, including from within a Web
Worker, do not apply the condition. Other conditions are unaffected.

Assisted-by: OpenCode
Signed-off-by: Guy Bedford <guybedford@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66635
Reviewed-By: James M Snell <jasnell@gmail.com>
2026-10-19 17:09:42 +00:00
Rafael Gonzaga 8df2dd89d0 doc: update V8 ABI release policy
Document the V8-related native addon ABI policy discussed in
nodejs/TSC#1852.

Starting with Node.js 27, V8 updates may land during Alpha and
Current even when they require a `NODE_MODULE_VERSION` bump, as
long as the ABI change is documented in release notes.

Refs: https://github.com/nodejs/TSC/issues/1852#issuecomment-4566968175

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/64196
Refs: https://github.com/nodejs/TSC/issues/1852
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-10-19 16:27:15 +00:00
Marco Ippolito 2052d0dcdf module: add --experimental-strip-private-modules
Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63869
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
2026-10-19 13:03:51 +00:00
Tim Perry 135b70e670 tls: add tlsSocket.socket, to access the raw stream beneath TLS
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66598
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-19 12:35:59 +00:00
Marco 1a885caa6e fs: add mkstemp()
Add fs.mkstemp(), fs.mkstempSync() and fsPromises.mkstemp(), which
create and open a unique temporary file in one operation. They expose
uv_fs_mkstemp(), the file counterpart of the function behind
fs.mkdtemp().

The callback and sync versions return the path and a file descriptor,
the promise version returns the path and a FileHandle.

libuv clears the path of the request when mkstemp() fails, so the
template is saved in the request and used for the path of the error.

The functions are also supported on mounted virtual file systems.

Refs: https://github.com/nodejs/node/pull/33549
Refs: https://github.com/nodejs/node/issues/33890
Refs: https://github.com/nodejs/node/issues/5332
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66484
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-19 02:34:09 +00:00
Matteo Collina 9a9f7e87b8 process: return unregister fn from finalization
process.finalization.register() and registerBeforeExit() now return
a function that removes only that registration, leaving other
registrations for the same object in place. The function does not
hold a strong reference to the object.

Each registration now uses its WeakRef as the unregister token, which
also makes process.finalization.unregister() remove the entries from
the FinalizationRegistry; previously it passed the object as the
token, which was never registered, so the call had no effect.

Refs: https://github.com/nodejs/node/pull/66482

Signed-off-by: Matteo Collina <matteo.collina@gmail.com>
Assisted-by: pi
PR-URL: https://github.com/nodejs/node/pull/66482
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
2026-10-18 06:36:43 +00:00
Efe Karasakal f88a1d25e9 quic: validate stream error codes
Assisted-by: Codex
Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: https://github.com/nodejs/node/pull/66650
Reviewed-By: Tim Perry <pimterry@gmail.com>
2026-10-17 21:42:53 +00:00
Rafael Gonzaga 62ca1bae5a vfs: allow mounting in permission audit mode
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66745
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-17 00:53:49 +00:00
Guilherme Araújo f513ec7e7c test_runner: add mockReturnValue and promise helpers
Add mockReturnValue(), mockResolvedValue() and mockRejectedValue()
to MockFunctionContext as shorthands for common mockImplementation()
patterns.

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66631
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
2026-10-16 18:06:44 +00:00
Chengzhong Wu 5926201795 doc: add doc on when to backport V8 patches to main
Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: https://github.com/nodejs/node/pull/66710
Refs: https://github.com/nodejs/node/issues/66393
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2026-10-16 15:59:30 +00:00
David Babenko-Sanders 9df97a7c2b doc: reserve NMV 154 for Electron 46
Signed-off-by: David Babenko-Sanders <dsanders11@ucsbalum.com>
PR-URL: https://github.com/nodejs/node/pull/66712
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-10-16 14:53:36 +00:00
Paul Bouchon c0c8ce80a8 doc: warn against awaiting replies in module hooks
Awaiting a reply from the registering thread inside a resolve or load
hook deadlocks: resolution is synchronous from that thread's
perspective, so it is blocked in the request and cannot answer.

Fixes: https://github.com/nodejs/node/issues/63085
Signed-off-by: Paul Bouchon <mail@bitpshr.net>
PR-URL: https://github.com/nodejs/node/pull/65590
Reviewed-By: Jacob Smith <jacob@frende.me>
2026-10-16 12:44:49 +00:00
Philipp Dunkel 9f2fb935fd sea: mount vfsArchive at layer 0 and in workers
A single executable application built with "vfsArchive" mounted its
archive at the next free layer, like any file system a program mounts
itself, and only in the main thread. A worker had no mount at all, so
a path into the archive, such as the main script's __filename, could
not be loaded there.

Mount the archive at the layer reserved for --vfs-load instead, so it
is at the same mount point in every thread, and mount it in each
worker as well, with the main script placed at its root just as in
the main thread. The worker reads the main script through a new
getMainCode() binding, since no main script is handed to it. Unlike
the --vfs-load source, the archive needs no provider that a preload
could register, so its mount in a worker is not deferred past
--import.

Since the archive takes that mount point, reject --vfs-load alongside
it: --build-sea refuses it in "execArgv", and the executable refuses it
at startup when it comes from --node-options or from the execArgv of a
worker.

Also fix the example in vfs.md, which showed a file system a program
mounts itself at layer 0, the layer reserved for these mounts.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/66709
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-16 12:44:35 +00:00
Joyee Cheung d9264eb6f2 src: update NODE_MODULE_VERSION to 153
Major V8 updates are usually API/ABI incompatible with previous
versions. This commit adapts NODE_MODULE_VERSION for V8 15.6.

Refs: https://github.com/nodejs/CTC/blob/master/meetings/2016-09-28.md
PR-URL: https://github.com/nodejs/node/pull/66601
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
2026-10-15 16:35:48 +02:00
James M Snell a7c156fd37 stream: construct the options passed to stream/iter transforms
pull() passes every stateless transform call a new
`{ __proto__: null, signal }` options object, which V8 creates in
dictionary mode, once per batch and transform.

Create the options with a TransformOptions constructor instead, for
stateful transforms as well so that both forms receive the same kind of
object. Each call still gets its own object, as the pipeline requires.
Its prototype is a single frozen object with no %Object.prototype% in
its chain, so a transform cannot pass state to other transforms through
it, and with a non-enumerable `constructor` so that util.inspect()
prints `TransformOptions { signal }`.

With 300,000 single-chunk batches, pull() is about 2% faster with one
stateless transform and about 8% faster with four.

This is observable: the options object's prototype is no longer null.
A new test covers the options contract, and the documentation now
describes it, including that pullSync() passes transforms no options.

Assisted-by: OpenCode
Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66648
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-15 13:26:49 +00:00
James M Snell 5bcade91de stream: make endSync() optional in pipeToSync()
pipeToSync() threw ERR_INVALID_ARG_TYPE before writing anything when
the writer had no endSync() method and preventClose was not set.
endSync() is optional: the spec (pipeToSync() step 7) only calls it if
the writer has it, and pipeTo() already treats it that way. A writer
without endSync() now receives the data and is not closed. pipeToSync()
still never falls back to the async end().

This also fixes the from-sync-writev case of
benchmark/streams/iter-from-batching.js, whose writer has no endSync().

testPipeToSyncNoEndSync asserted the previous rejection and now checks
that the data is written and end() is not called. The documentation of
the writer requirements is corrected as well: only writeSync() is
required.

Assisted-by: OpenCode
Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66648
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
2026-10-15 13:26:45 +00:00
Filip Skokan a5af6440be tools: update OpenSSL on the selected branch
Use the selected workflow branch as the PR base and prefix PR titles
for branches other than the repository's default branch.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66704
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-10-15 12:45:32 +00:00
Matteo Collina 49ad95045a vfs: unflag
Enable node:vfs by default. --no-experimental-vfs disables node:vfs
exposure and --vfs-load.

Assisted-by: pi
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/66318
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
2026-10-15 07:53:03 +00:00
Sebastian Beltran 12ce81920a lib: deprecate _http_*
Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/58535
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
2026-10-15 00:52:34 +00:00
Kisnner Obando 4381c4730e doc: correct QuicStream direction and id types
Signed-off-by: Kisnner Obando <kisnnerobando7@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66687
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
2026-10-14 19:49:23 +00:00
Node.js GitHub Bot 496b48b477 2026-10-14, Version 26.12.0 (Current)
Notable changes:

doc,lib,src:
  * (SEMVER-MINOR) throw on missing WebAssembly or RX support (Paolo Insogna) https://github.com/nodejs/node/pull/66533
http:
  * (SEMVER-MINOR) add websocketMask() and websocketUnmask() (James M Snell) https://github.com/nodejs/node/pull/66335

PR-URL: https://github.com/nodejs/node/pull/66684
Signed-off-by: Richard Lau <richard.lau@ibm.com>
2026-10-14 15:17:15 +00:00
Node.js GitHub Bot b22fea5f25 2026-10-14, Version 24.22.0 'Krypton' (LTS)
Notable changes:

crypto:
  * (SEMVER-MINOR) add crypto.parsePKCS12() (Brian Muenzenmeyer) https://github.com/nodejs/node/pull/65627
  * (SEMVER-MINOR) add a generic MAC API (Filip Skokan) https://github.com/nodejs/node/pull/65553
  * (SEMVER-MINOR) discover ciphers from OpenSSL providers (Filip Skokan) https://github.com/nodejs/node/pull/65484
  * (SEMVER-MINOR) discover hashes from OpenSSL providers (Filip Skokan) https://github.com/nodejs/node/pull/65484
  * (SEMVER-MINOR) enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) https://github.com/nodejs/node/pull/63411
doc:
  * add araujogui to collaborators (Guilherme Araújo) https://github.com/nodejs/node/pull/66090
  * deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) https://github.com/nodejs/node/pull/65593
net:
  * (SEMVER-MINOR) support sending net.BoundSocket to threads and child processes (Guy Bedford) https://github.com/nodejs/node/pull/64725
perf_hooks:
  * (SEMVER-MINOR) implement SlidingWindowHistogram (James M Snell) https://github.com/nodejs/node/pull/65825
  * (SEMVER-MINOR) implement qrde analysis support in Histogram (James M Snell) https://github.com/nodejs/node/pull/65806
  * (SEMVER-MINOR) implement Histogram meanCI API (James M Snell) https://github.com/nodejs/node/pull/65606
  * (SEMVER-MINOR) add CBOR export/import for histogram exchange (James M Snell) https://github.com/nodejs/node/pull/65434
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.close() (Guilherme Araújo) https://github.com/nodejs/node/pull/64232
  * (SEMVER-MINOR) add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) https://github.com/nodejs/node/pull/64232
src,lib:
  * (SEMVER-MINOR) add util.markPromiseAsHandled (James M Snell) https://github.com/nodejs/node/pull/65805
util:
  * (SEMVER-MINOR) implement util.throttle (James M Snell) https://github.com/nodejs/node/pull/65899
  * (SEMVER-MINOR) implement debounce (James M Snell) https://github.com/nodejs/node/pull/65899

PR-URL: https://github.com/nodejs/node/pull/66667
2026-10-14 14:58:26 +00:00
Chris Swithinbank 04fb145b6a doc: clarify hex code usage in styleText docs
Signed-off-by: Chris Swithinbank <swithinbank@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66539
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
2026-10-13 20:17:24 +00:00
Antoine du Hamel 3f0c2e4c8b Revert "sea: mount vfsArchive at layer 0 and in workers"
This reverts commit ac9d85c418.

PR-URL: https://github.com/nodejs/node/pull/66706
Fixes: https://github.com/nodejs/node/issues/66703
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
2026-10-13 15:48:49 +02:00
Rafael Gonzaga 886c7b41f3 doc: list openssl-store channel and drop field in permissions
The node:permission-model:openssl-store diagnostics channel and the
--allow-openssl-store flag were introduced in
https://github.com/nodejs/node/pull/63949, but the Audit Mode section
of the permissions documentation was not updated to list them.

Refs: https://github.com/nodejs/node/pull/63949
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66558
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
2026-10-13 13:33:38 +00:00
Rafael Gonzaga 280ea2743b doc: list futimes among fd APIs disabled by the permission model
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/66649
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2026-10-13 09:04:24 +00:00
Philipp Dunkel ac9d85c418 sea: mount vfsArchive at layer 0 and in workers
A single executable application built with "vfsArchive" mounted its
archive at the next free layer, like any file system a program mounts
itself, and only in the main thread. A worker had no mount at all, so
a path into the archive, such as the main script's __filename, could
not be loaded there.

Mount the archive at the layer reserved for --vfs-load instead, so it
is at the same mount point in every thread, and mount it in each
worker as well, with the main script placed at its root just as in
the main thread. The worker reads the main script through a new
getMainCode() binding, since no main script is handed to it. Unlike
the --vfs-load source, the archive needs no provider that a preload
could register, so its mount in a worker is not deferred past
--import.

Since the archive takes that mount point, reject --vfs-load alongside
it: --build-sea refuses it in "execArgv", and the executable refuses it
at startup when it comes from --node-options or from the execArgv of a
worker.

Also fix the example in vfs.md, which showed a file system a program
mounts itself at layer 0, the layer reserved for these mounts.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/66614
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2026-10-13 10:09:55 +02:00