mirrors/node
0
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-10-28 18:25:13 +08:00
Code Activity
49,265 Commits 74 Branches 969 Tags
main
Commit Graph
464 Commits
Author SHA1 Message Date
Node.js GitHub Bot 496b48b477 2026-10-14, Version 26.12.0 (Current) 
Notable changes:

doc,lib,src:
  * (SEMVER-MINOR) throw on missing WebAssembly or RX support (Paolo Insogna) https://github.com/nodejs/node/pull/66533
http:
  * (SEMVER-MINOR) add websocketMask() and websocketUnmask() (James M Snell) https://github.com/nodejs/node/pull/66335

PR-URL: https://github.com/nodejs/node/pull/66684
Signed-off-by: Richard Lau <richard.lau@ibm.com>
 2026-10-14 15:17:15 +00:00
Efe Karasakal 855e3f74b5 doc: clarify http Agent keepSocketAlive behavior 
Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: https://github.com/nodejs/node/pull/66252
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-10-08 13:36:20 +00:00
Efe Karasakal 145e490768 doc: document keepAliveTimeoutBuffer server option 
Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: https://github.com/nodejs/node/pull/66286
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-10-08 13:36:05 +00:00
Efe Karasakal 24a10f67b6 doc: fix request.reusedSocket timeout example 
Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: https://github.com/nodejs/node/pull/66286
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-10-08 13:36:04 +00:00
Node.js GitHub Bot 4fa5145b06 2026-10-07, Version 26.11.0 (Current) 
Notable changes:

buffer:
  * (SEMVER-MINOR) add isLatin1 (James M Snell) https://github.com/nodejs/node/pull/66298
  * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) https://github.com/nodejs/node/pull/66064
build, doc:
  * move to redesign (Aviv Keller) https://github.com/nodejs/node/pull/62045
doc:
  * promote Alpine Linux to tier 2 support (Stewart X Addison) https://github.com/nodejs/node/pull/63737
http:
  * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) https://github.com/nodejs/node/pull/66334
http2:
  * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) https://github.com/nodejs/node/pull/65619
perf_hooks:
  * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) https://github.com/nodejs/node/pull/66115
  * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) https://github.com/nodejs/node/pull/66114
  * (SEMVER-MINOR) add histogram.diff() (James M Snell) https://github.com/nodejs/node/pull/66099
  * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) https://github.com/nodejs/node/pull/66099
  * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) https://github.com/nodejs/node/pull/66098
process:
  * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) https://github.com/nodejs/node/pull/66213
sqlite:
  * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) https://github.com/nodejs/node/pull/65988
src:
  * (SEMVER-MINOR) add --process-timeout=N (James M Snell) https://github.com/nodejs/node/pull/66138
  * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) https://github.com/nodejs/node/pull/65737
  * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) https://github.com/nodejs/node/pull/66067

PR-URL: https://github.com/nodejs/node/pull/66546
 2026-10-07 16:40:44 +02:00
James M Snell 3a4454151a http: add websocketMask() and websocketUnmask() 
Add websocketMask(source, mask, output[, offset[, length]]) and
websocketUnmask(buffer, mask), which XOR data with a repeating 4-byte
key. This is the masking that WebSocket clients apply to every frame
they send (RFC 6455, Section 5.3), and that servers undo on every frame
they receive.

Userland WebSocket implementations do this either with a byte-by-byte
JS loop (undici, and ws without optional dependencies) or with the
bufferutil native addon. bufferutil is installed for only about 3% of
ws downloads and has no linux-arm64 prebuild, so almost all users run
the JS loop. The signature matches bufferutil, so existing users can
switch with a feature check, as ws did for buffer.isUtf8().

The implementation uses a V8 fast API call and processes 8-byte words,
which the compiler vectorizes. It handles overlapping source and output
views, and treats every view type as raw bytes. It is about 20x faster
than the JS loop at 1 KiB and 40x faster at 64 KiB, and faster than
bufferutil at every size from 32 bytes up.

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: https://github.com/nodejs/node/pull/66335
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
 2026-10-06 11:36:02 +00:00
James M Snell 44ba289f55 http: add isValidHeaderName() and isValidHeaderValue() 
Add non-throwing counterparts of http.validateHeaderName() and
http.validateHeaderValue() that return a boolean instead of throwing.

Rejecting an invalid header with the existing validators costs a few
microseconds, because an error object and its stack trace are created,
compared to ~20ns for the boolean check. Userland HTTP implementations
such as undici (fetch Headers, request options) therefore keep private
copies of the token and field-value tables from _http_common. These new
functions let them reuse the core implementation.

isValidHeaderValue() accepts an optional `httpValidation` option
('strict' or 'relaxed') that has the same meaning as the option of the
same name on http.createServer() and http.request().

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66334
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-09-29 04:38:26 +00:00
XadillaX 5ebf690dcf http: preserve socket errors as response error causes 
Keep the original socket error as the cause of ECONNRESET errors emitted
when an HTTP response closes before completion. Preserve the existing
aborted message, error code, and event order. Leave cause absent when
there is no underlying error.

Allow ConnResetException to accept Error options, document the behavior,
and cover TLS record errors, TCP resets, explicit destruction, and
premature closure without a socket error.

This follows investigation of #66001 and addresses lost error context.
The original TLS decryption failure remains unresolved.

Refs: https://github.com/nodejs/node/issues/66001
Signed-off-by: XadillaX <i@2333.moe>
PR-URL: https://github.com/nodejs/node/pull/66061
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-09-25 21:31:04 +02:00
Matteo Collina e5778f78c5 http: reject responses exceeding header limit 
Previously, ClientRequest silently truncated responses that exceeded
request.maxHeadersCount while llhttp continued using omitted headers.

Reject these responses with HPE_HEADER_OVERFLOW so parser state and
exposed headers cannot diverge. This is a semver-major behavior change.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/65010
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-09-14 08:39:17 +00:00
Node.js GitHub Bot b7ca36421c 2026-08-26, Version 24.20.0 'Krypton' (LTS) 
Notable changes:

async_hooks:
  * (SEMVER-MINOR) add `using` scopes to `AsyncLocalStorage` (Stephen Belanger) https://github.com/nodejs/node/pull/61674
benchmark:
buffer:
  * (SEMVER-MINOR) add `end` parameter (Robert Nagy) https://github.com/nodejs/node/pull/62390
crypto:
  * update root certificates to NSS 3.125 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/64746
doc:
  * add MikeMcC399 as collaborator (Mike McCready) https://github.com/nodejs/node/pull/64656
lib,permission:
  * (SEMVER-MINOR) add `permission.drop` (Rafael Gonzaga) https://github.com/nodejs/node/pull/62672
loader:
  * (SEMVER-MINOR) implement package maps (Maël Nison) https://github.com/nodejs/node/pull/62239
src,permission:
  * (SEMVER-MINOR) add `--permission-audit` (RafaelGSS) https://github.com/nodejs/node/pull/61869
stream:
  * (SEMVER-MINOR) implement `node:stream/iter` (James M Snell) https://github.com/nodejs/node/pull/62066
test_runner:
  * (SEMVER-MINOR) add `context.log()` and `test:log` event (Moshe Atlow) https://github.com/nodejs/node/pull/64389
  * (SEMVER-MINOR) report `entryFile` in `TestStream` events (Moshe Atlow) https://github.com/nodejs/node/pull/64309
wasm:
  * (SEMVER-MINOR) enable JSPI (Guy Bedford) https://github.com/nodejs/node/pull/59941

PR-URL: https://github.com/nodejs/node/pull/65461
 2026-08-26 16:23:36 +02:00
Aryn H 056e2ae333 doc: fix default limit of maxHeadersCount 
The documented limit of 2000 refers to header pairs (counting both
keys and values), which gives an effective limit of 1000 headers.

This applies to both client and server; they have the same mechanism.

Signed-off-by: Aryn H <arynh@protonmail.com>
PR-URL: https://github.com/nodejs/node/pull/65472
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
 2026-08-25 11:59:18 +00:00
Antoine du Hamel 3f2fc8aaef 2026-08-05, Version 26.7.0 (Current) 
Notable changes:

crypto:
  * (SEMVER-MINOR) support loading private keys through STORE loaders (Filip Skokan) https://github.com/nodejs/node/pull/63949
  * update root certificates to NSS 3.125 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/64746
lib:
  * (SEMVER-MINOR) add perfetto support (Chengzhong Wu) https://github.com/nodejs/node/pull/64565
module:
  * (SEMVER-MINOR) implement `Symbol.dispose` in ModuleHooks (Remco Haszing) https://github.com/nodejs/node/pull/63928
test_runner:
  * (SEMVER-MINOR) add support for `--test-coverage-include-all` (avivkeller) https://github.com/nodejs/node/pull/64830

PR-URL: https://github.com/nodejs/node/pull/65027
 2026-08-05 18:21:40 +02:00
Antoine du Hamel 401ea64c3e 2026-08-03, Version 24.19.0 'Krypton' (LTS) 
Notable changes:

buffer:
  * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) https://github.com/nodejs/node/pull/64036
deps:
  * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) https://github.com/nodejs/node/pull/62217
doc:
  * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) https://github.com/nodejs/node/pull/63050
  * mark `stream.compose` stable (Matteo Collina) https://github.com/nodejs/node/pull/62562
esm:
  * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) https://github.com/nodejs/node/pull/62300
fs:
  * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) https://github.com/nodejs/node/pull/63634
http:
  * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) https://github.com/nodejs/node/pull/61597
net:
  * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) https://github.com/nodejs/node/pull/63825
perf_hooks:
  * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) https://github.com/nodejs/node/pull/62935
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) https://github.com/nodejs/node/pull/61610
stream:
  * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) https://github.com/nodejs/node/pull/64195
tls:
  * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) https://github.com/nodejs/node/pull/64119
  * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) https://github.com/nodejs/node/pull/62217

PR-URL: https://github.com/nodejs/node/pull/64654
 2026-08-03 15:30:35 +02:00
greenhead 808904f229 doc: fix typos in documentation 
Signed-off-by: greenhead <shren0812@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64900
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-08-03 11:44:23 +00:00
Archkon f8f8aa2ca9 http: avoid aborting IncomingMessage signal on normal close 
IncomingMessage 'close' is emitted when request handling completes, not
only when the underlying connection is closed. Using that event to abort
IncomingMessage.signal makes the signal abort after a request body is
read normally.

Track the underlying socket close instead, and detach the listener when
the request or response completes normally. This keeps the signal from
being aborted by normal stream completion or later keep-alive socket
closure, while still aborting it when the connection closes during the
active request lifecycle.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64392
Fixes: https://github.com/nodejs/node/issues/64390
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-07-29 13:57:08 +00:00
Matteo Collina 26079c0cfa doc: clarify proxy threat model 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64366
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-07-10 16:53:10 +00:00
Matteo CollinaandAntoine du Hamel 90d6955e85 doc: clarify HTTP/1.1 response ordering 
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64213
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-07-06 11:22:23 +00:00
Joyee Cheung fd3419178e http: document and validate options.path when it's in absolute-form 
When `options.path` passed to `http.request()` contains an absolute
URL, `http.request` has been sending it directly as the request target
in the HTTP 1.1 message. If the receiving server is a proxy,
the proxy server typically forwards the request to the destination
specified in the request target and ignores the Host header.
This means eventually the request can be forwarded to a destination
that is not consistent with `options.host`, depending on how the
receiving server behaves. Mimatched Host header and request target
also violates RFC 9112 Section 3.2, which we have been entirely
leaving to the users to verify.

This patch documents this behavior and warns that the user needs
to ensure the `path`, `option` and `headers` conform to the RFC.
If the receiving server is known to be a proxy server because
the request is routed by Node.js' built-in HTTP proxy support,
we now do a best-effort check to verify that the authority in
`options.path` (if absolute), Host headers and `options.host`
agree at request construction time. Node.js will give up on the
require target rewriting and throw an error when they don't match
at request construction.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64108
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
 2026-07-01 10:44:52 +00:00
Antoine du Hamel 09fee77382 doc: fix broken links and duplicate stability label 
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64130
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-06-27 14:10:05 +00:00
Stewart X Addison 9f23e70866 2026-06-23, Version 24.18.0 'Krypton' (LTS) 
Notable changes:

buffer:
  * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) https://github.com/nodejs/node/pull/63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/63527
  * (SEMVER-MINOR)  align key argument names in docs and error messages (Filip Skokan) https://github.com/nodejs/node/pull/62527
  * (SEMVER-MINOR)  accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) https://github.com/nodejs/node/pull/62527
  * (SEMVER-MINOR)  add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) https://github.com/nodejs/node/pull/62183
http:
  * http: avoid stream listeners on idle agent sockets (Matteo Collina) https://github.com/nodejs/node/pull/64004
  * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) https://github.com/nodejs/node/pull/63155
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) https://github.com/nodejs/node/pull/63079
stream:
  * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) https://github.com/nodejs/node/pull/63834

PR-URL: https://github.com/nodejs/node/pull/64062
 2026-06-23 22:59:09 +00:00
Jahanzaib iqbal 4d3198c664 doc: fix keepAliveTimeout default in http.createServer options 
PR #62782 updated the keepAliveTimeout default from 5s to 65s and
correctly updated server.keepAliveTimeout (line 2006), but the
http.createServer() options table at line 3775 was not updated.

Fix the remaining reference to reflect the current default of 65000ms.

Signed-off-by: Jahanzaib iqbal <jahanzaib@gsoftconsulting.com>
PR-URL: https://github.com/nodejs/node/pull/63974
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-06-22 09:48:46 +00:00
Guy Bedford 1efdce3353 net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive 
Signed-off-by: Guy Bedford <guybedford@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63825
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-06-13 23:12:25 +00:00
Antoine du Hamel 6d02b36f30 2026-06-01, Version 26.3.0 (Current) 
Notable changes:

buffer:
  * (SEMVER-MINOR) increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) https://github.com/nodejs/node/pull/63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/63527
doc:
  * downgrade macOS x64 support to Tier 2 (Antoine du Hamel) https://github.com/nodejs/node/pull/63055
http:
  * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) https://github.com/nodejs/node/pull/61597
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) https://github.com/nodejs/node/pull/63079
lib,permission:
  * (SEMVER-MINOR) add `permission.drop` (Rafael Gonzaga) https://github.com/nodejs/node/pull/62672

PR-URL: https://github.com/nodejs/node/pull/63664
 2026-06-01 15:01:03 +02:00
RajeshKumar11 51c89fa3a8 http: add httpValidation option to configure header value validation 
Add a new httpValidation option to http.createServer() and
http.request() / http.ClientRequest that controls how strictly
HTTP header values are validated:

- 'strict'   - reject any non-ASCII or control characters (default)
- 'relaxed'  - allow the non-ASCII characters permitted by the
               Fetch specification (kLenientHeaderValueRelaxed)
- 'insecure' - disable all validation (like insecureHTTPParser)

The option is threaded through _storeHeader -> processHeader ->
storeHeader -> validateHeaderValue, and also through
writeInformation -> processInformationHeader -> validateHeaderValue.

Cannot be used together with insecureHTTPParser.

Fixes: https://github.com/nodejs/node/issues/61582
Signed-off-by: RajeshKumar11 <kakumanurajeshkumar@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61597
Refs: https://github.com/nodejs/node/issues/61582
Refs: https://fetch.spec.whatwg.org/#header-value
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-05-30 08:10:58 +00:00
Node.js GitHub Bot 0d6541aca0 2026-05-21, Version 24.16.0 'Krypton' (LTS) 
Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63263
 2026-05-21 15:17:18 +02:00
Antoine du Hamel d9558968d9 2026-05-20, Version 26.2.0 (Current) 
Notable changes:

doc:
  * mark `stream.compose` stable (Matteo Collina) https://github.com/nodejs/node/pull/62562
fs:
  * (SEMVER-MINOR) add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) https://github.com/nodejs/node/pull/60789
http:
  * (SEMVER-MINOR) add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) https://github.com/nodejs/node/pull/63155

PR-URL: https://github.com/nodejs/node/pull/63440
 2026-05-20 15:00:12 +02:00
joao-oliveira-softtor 0c7034f5ae doc: fix article usage before vowel-sound acronyms 
Several prose references to HTTP, HTTPS, SSL, HPE_HEADER_OVERFLOW
and ECMAScript used the article "a" where the acronym starts with
a vowel sound and should take "an". The rule is based on
pronunciation, not spelling: HTTP is read "aitch-tee-tee-pee",
SSL is read "ess-es-el", ECMAScript is read "ek-mah-script",
and HPE is read "aitch-pee-ee" — all starting with a vowel sound.

Affected files:

* doc/api/crypto.md — "disable a SSL 3.0/TLS 1.0 vulnerability"
* doc/api/http.md — five occurrences ("a HTTP '400 Bad Request'",
  "a HTTP '431 Request Header Fields Too Large'", "a HTTP/1.1 102
  Processing message", two copies of "use a HTTP parser") plus
  two references to "a HPE_HEADER_OVERFLOW"
* doc/api/http2.md — two code-sample comments reading
  "// Detects if it is a HTTPS request or HTTP/2"
* doc/api/module.md — "compiles a CommonJS, a ECMAScript Module,
  or a TypeScript module" (only the middle article changes; the
  adjacent "a CommonJS" and "a TypeScript" are both correct)
* doc/api/tls.md — two references to "part of a SSL/TLS handshake"
  in tlsSocket.getFinished() and tlsSocket.getPeerFinished()

No behavior changes, documentation only.

Signed-off-by: João Victor Oliveira <joao.oliveira@softtor.com.br>
PR-URL: https://github.com/nodejs/node/pull/62696
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
 2026-05-19 23:19:36 +00:00
Tim Perry 03f27fef16 http: add writeInformation to send arbitrary 1xx status codes 
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63155
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
 2026-05-15 16:16:41 +00:00
Antoine du Hamel 49aef0d3f5 doc: remove unnecessary <!-- eslint- magic comments 
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63200
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
 2026-05-10 15:06:35 +00:00
Antoine du Hamel a725fe1389 2026-05-07, Version 26.1.0 (Current) 
Notable changes:

buffer:
  * (SEMVER-MINOR) add `end` parameter (Robert Nagy) https://github.com/nodejs/node/pull/62390
crypto:
  * (SEMVER-MINOR) accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) https://github.com/nodejs/node/pull/62527
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
lib,src,test,doc:
  * (SEMVER-MINOR) add `node:ffi` module (Colin Ihrig) https://github.com/nodejs/node/pull/62072
process:
  * (SEMVER-MINOR) throw on `execve(2)` failure instead of aborting (Bryan English) https://github.com/nodejs/node/pull/62878
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) https://github.com/nodejs/node/pull/61610
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63137
 2026-05-07 12:01:50 +02:00
RafaelGSS 9e633f94ce 2026-05-05, Version 26.0.0 (Current) 
assert:
  * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) https://github.com/nodejs/node/pull/58849
build:
  * (SEMVER-MAJOR) bump GCC requirement to 13.2 (Michaël Zasso) https://github.com/nodejs/node/pull/62555
  * (SEMVER-MAJOR) enable Temporal by default (Richard Lau) https://github.com/nodejs/node/pull/61806
  * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) https://github.com/nodejs/node/pull/62296
  * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) https://github.com/nodejs/node/pull/61177
  * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) https://github.com/nodejs/node/pull/60863
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) https://github.com/nodejs/node/pull/60111
build,test:
  * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) https://github.com/nodejs/node/pull/61898
build,win:
  * (SEMVER-MAJOR) fix Temporal build (StefanStojanovic) https://github.com/nodejs/node/pull/61806
crypto:
  * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) https://github.com/nodejs/node/pull/62499
  * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) https://github.com/nodejs/node/pull/62453
  * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) https://github.com/nodejs/node/pull/62348
  * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) https://github.com/nodejs/node/pull/62178
  * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) https://github.com/nodejs/node/pull/61084
  * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) https://github.com/nodejs/node/pull/60830
deps:
  * (SEMVER-MAJOR) V8: cherry-pick 0f024d4e66e0 (ishabi) https://github.com/nodejs/node/pull/62408
  * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/62384
  * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) https://github.com/nodejs/node/pull/59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) https://github.com/nodejs/node/pull/54077
  * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) https://github.com/nodejs/node/pull/60111
  * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) https://github.com/nodejs/node/pull/60111
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) https://github.com/nodejs/node/pull/59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) https://github.com/nodejs/node/pull/54077
  * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) https://github.com/nodejs/node/pull/60111
diagnostics_channel:
  * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) https://github.com/nodejs/node/pull/61766
doc:
  * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) https://github.com/nodejs/node/pull/62176
  * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) https://github.com/nodejs/node/pull/61973
  * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) https://github.com/nodejs/node/pull/61005
http:
  * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) https://github.com/nodejs/node/pull/60635
  * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) https://github.com/nodejs/node/pull/60016
lib:
  * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) https://github.com/nodejs/node/pull/61333
lib,src:
  * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) https://github.com/nodejs/node/pull/62293
module:
  * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) https://github.com/nodejs/node/pull/62401
  * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) https://github.com/nodejs/node/pull/61803
src:
  * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) https://github.com/nodejs/node/pull/60496
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) https://github.com/nodejs/node/pull/60111
stream:
  * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) https://github.com/nodejs/node/pull/62173
  * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) https://github.com/nodejs/node/pull/60657
  * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) https://github.com/nodejs/node/pull/60441
  * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) https://github.com/nodejs/node/pull/59873
test:
  * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) https://github.com/nodejs/node/pull/60488
tools:
  * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
util:
  * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) https://github.com/nodejs/node/pull/61029
  * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) https://github.com/nodejs/node/pull/60339

PR-URL: https://github.com/nodejs/node/pull/62526
 2026-05-05 11:17:12 -03:00
Tim PerryandPrashant Bansal 9f75269840 http: increase keepAliveTimeout default to 65 seconds 
Co-authored-by: Prashant Bansal <prashantbansal529@gmail.com>
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62782
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2026-04-26 15:14:41 +00:00
Matteo Collina 21436f0405 http: make req.headers have a null prototype 
Makes IncomingMessage.prototype.headers and trailers have a null
prototype, matching the existing behavior of headersDistinct and
trailersDistinct.

Fixes prototype pollution concerns where headers like __proto__
could be interpreted as prototype manipulation.

Refs: https://github.com/nodejs/node/issues/61771

PR-URL: https://github.com/nodejs/node/pull/62900
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-04-25 09:28:53 +00:00
Tim Perry 24280308dc http: fix leaked error listener on sync HTTP req create + destroy 
Previously, this resulted in an error listener being added but not
cleaned up when the socket was freed back to the agent pool.

This also updates the docs to clarify when req.destroy() kills the
underlying socket - only if it's called during request processing (more
specifically: after onSocketNT, at which point we may have started
reading & writing).

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62872
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
 2026-04-24 10:21:54 +00:00
Akshat bf1aebcc37 http: add req.signal to IncomingMessage 
PR-URL: https://github.com/nodejs/node/pull/62541
Fixes: https://github.com/nodejs/node/issues/62481
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-04-04 09:24:22 +00:00
Kit DallegeandClaude Opus 4.6 02104c08bb doc: fix overstated Date header requirement in response.sendDate 
The docs stated "HTTP requires the Date header in responses" which
oversimplifies the actual requirement. Per RFC 9110 Section 6.6.1,
the Date header is required only in most responses (2xx/3xx/4xx from
servers with a clock), not all. Reference the specific RFC section.

Fixes: https://github.com/nodejs/node/issues/42619

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PR-URL: https://github.com/nodejs/node/pull/62206
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-03-24 10:49:30 +00:00
Antoine du Hamel 001d5d4b77 2026-02-24, Version 24.14.0 'Krypton' (LTS) 
Notable changes:

async_hooks:
  * (SEMVER-MINOR) add `trackPromises` option to `createHook()` (Joyee Cheung) https://github.com/nodejs/node/pull/61415
build,deps:
  * replace cjs-module-lexer with merve (Yagiz Nizipli) https://github.com/nodejs/node/pull/61456
deps:
  * (SEMVER-MINOR) add LIEF as a dependency (Joyee Cheung) https://github.com/nodejs/node/pull/61167
events:
  * (SEMVER-MINOR) repurpose `events.listenerCount()` to accept `EventTarget`s (René) https://github.com/nodejs/node/pull/60214
fs:
  * (SEMVER-MINOR) add `ignore` option to `fs.watch` (Matteo Collina) https://github.com/nodejs/node/pull/61433
http:
  * (SEMVER-MINOR) add `http.setGlobalProxyFromEnv()` (Joyee Cheung) https://github.com/nodejs/node/pull/60953
module:
  * (SEMVER-MINOR) allow subpath imports that start with `#/` (Jan Martin) https://github.com/nodejs/node/pull/60864
process:
  * (SEMVER-MINOR) preserve `AsyncLocalStorage` in `queueMicrotask` only when needed (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/60913
sea:
  * (SEMVER-MINOR) split sea binary manipulation code (Joyee Cheung) https://github.com/nodejs/node/pull/61167
sqlite:
  * (SEMVER-MINOR) enable defensive mode by default (Bart Louwers) https://github.com/nodejs/node/pull/61266
  * (SEMVER-MINOR) add sqlite prepare options args (Guilherme Araújo) https://github.com/nodejs/node/pull/61311
src:
  * (SEMVER-MINOR) add initial support for ESM in embedder API (Joyee Cheung) https://github.com/nodejs/node/pull/61548
stream:
  * (SEMVER-MINOR) add `bytes()` method to `node:stream/consumers` (wantaek) https://github.com/nodejs/node/pull/60426
  * (SEMVER-MINOR) do not pass `readable.compose()` output via `Readable.from()` (René) https://github.com/nodejs/node/pull/60907
test:
  * (SEMVER-MINOR) use fixture directories for sea tests (Joyee Cheung) https://github.com/nodejs/node/pull/61167
test_runner:
  * (SEMVER-MINOR) add `env` option to `run` function (Ethan Arrowood) https://github.com/nodejs/node/pull/61367
  * (SEMVER-MINOR) support expecting a test-case to fail (Jacob Smith) https://github.com/nodejs/node/pull/60669
util:
  * (SEMVER-MINOR) add `convertProcessSignalToExitCode` utility (Erick Wendel) https://github.com/nodejs/node/pull/60963

PR-URL: https://github.com/nodejs/node/pull/61924
 2026-02-24 10:20:06 -05:00
Node.js GitHub Bot 973e119d22 2026-01-19, Version 25.4.0 (Current) 
Notable changes:

cli:
  * add --require-module/--no-require-module (Joyee Cheung) https://github.com/nodejs/node/pull/60959
  * mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60956
crypto:
  * update root certificates to NSS 3.117 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/60741
doc:
  * add @avivkeller to collaborators (Aviv Keller) https://github.com/nodejs/node/pull/61115
  * add gurgunday to collaborators (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/61094
  * mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60954
events:
  * (SEMVER-MINOR) repurpose `events.listenerCount()` to accept EventTargets (René) https://github.com/nodejs/node/pull/60214
http:
  * (SEMVER-MINOR) add http.setGlobalProxyFromEnv() (Joyee Cheung) https://github.com/nodejs/node/pull/60953
meta:
  * add Renegade334 to collaborators (Renegade334) https://github.com/nodejs/node/pull/60714
module:
  * mark require(esm) as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60959
  * mark module compile cache as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60971
  * (SEMVER-MINOR) allow subpath imports that start with `#/` (Jan Martin) https://github.com/nodejs/node/pull/60864
process:
  * (SEMVER-MINOR) preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/60913
stream:
  * (SEMVER-MINOR) do not pass `readable.compose()` output via `Readable.from()` (René) https://github.com/nodejs/node/pull/60907
util:
  * (SEMVER-MINOR) add convertProcessSignalToExitCode utility (Erick Wendel) https://github.com/nodejs/node/pull/60963
v8:
  * mark v8.queryObjects() as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60957

PR-URL: https://github.com/nodejs/node/pull/61400
 2026-01-19 14:00:39 -03:00
Node.js GitHub Bot 47d8b88868 2025-12-10, Version 24.12.0 'Krypton' (LTS) 
Notable changes:

http:
  * (SEMVER-MINOR) add optimizeEmptyRequests server option (Rafael Gonzaga) https://github.com/nodejs/node/pull/59778
lib:
  * (SEMVER-MINOR) add options to util.deprecate (Rafael Gonzaga) https://github.com/nodejs/node/pull/59982
module:
  * (SEMVER-MINOR) mark type stripping as stable (Marco Ippolito) https://github.com/nodejs/node/pull/60600
node-api:
  * (SEMVER-MINOR) add napi_create_object_with_properties (Miguel Marcondes Filho) https://github.com/nodejs/node/pull/59953
sqlite:
  * (SEMVER-MINOR) allow setting defensive flag (Bart Louwers) https://github.com/nodejs/node/pull/60217
src:
  * (SEMVER-MINOR) add watch config namespace (Marco Ippolito) https://github.com/nodejs/node/pull/60178
  * (SEMVER-MINOR) add an option to make compile cache portable (Aditi) https://github.com/nodejs/node/pull/58797
src,permission:
  * (SEMVER-MINOR) add --allow-inspector ability (Rafael Gonzaga) https://github.com/nodejs/node/pull/59711
v8:
  * (SEMVER-MINOR) add cpu profile (theanarkh) https://github.com/nodejs/node/pull/59807

PR-URL: https://github.com/nodejs/node/pull/61001
 2025-12-10 17:40:34 +01:00
Joyee Cheung c0108bfc55 http: add http.setGlobalProxyFromEnv() 
This adds an API to dynamically enable built-in proxy support
for all of fetch() and http.request()/https.request(), so
that users do not have to be aware of them all and configure them
one by one.

PR-URL: https://github.com/nodejs/node/pull/60953
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2025-12-10 16:12:28 +00:00
Antoine du Hamel b98ada27e7 doc: fix linter issues 
PR-URL: https://github.com/nodejs/node/pull/60636
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
 2025-11-08 17:09:29 +00:00
JaeHo Jang 1727a8f1b2 doc: improve agent.createConnection docs for http and https agents 
PR-URL: https://github.com/nodejs/node/pull/58205
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2025-11-08 14:34:58 +00:00
Koushil Mankali ca91969808 doc: add missing variable in code snippet 
`node:http`' `request.reusedSocket` documentation sample code was
referencing an undeclared `agent` identifier.

PR-URL: https://github.com/nodejs/node/pull/55478
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2025-11-08 15:24:11 +01:00
Michael Solomon f4145f0451 doc: fix typo in http.md 
PR-URL: https://github.com/nodejs/node/pull/59354
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
 2025-11-04 22:37:12 +00:00
Tim Perry 4346c0f7a7 http: fix handling of HTTP upgrades with bodies 
Previously, we ignored all indicators of the body (content-length or
transfer-encoding headers) and treated any information following
the headers as part of the upgraded stream. We now fully process the
requests bodies separately instead, allowing us to automatically handle
correct parsing of the body like any other HTTP request.

This is a breaking change if you are currently accepting HTTP Upgrade
requests with request bodies successfully, or if you use
socket-specific fields & methods on the upgraded stream argument.

In the former case, before now you will have received the request body
and then the upgraded data on the same stream without any distinction
or HTTP parsing applied. Now, you will need to separately read the
request body from the request (the 1st argument) and the upgraded
data from the upgrade stream (the 2nd argument). If you're not
interested in request bodies, you can continue to just read from the
upgrade stream directly.

In the latter case, if you want to access the raw socket, you should do
so via request.socket, instead of expecting the 2nd argument to be a
socket.

PR-URL: https://github.com/nodejs/node/pull/60016
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2025-11-03 17:19:33 +00:00
Antoine du Hamel f1d8634179 2025-10-28, Version 25.1.0 (Current) 
Notable changes:

http:
  * (SEMVER-MINOR) add optimizeEmptyRequests server option (Rafael Gonzaga) https://github.com/nodejs/node/pull/59778
sqlite:
  * (SEMVER-MINOR) allow setting defensive flag (Bart Louwers) https://github.com/nodejs/node/pull/60217
src:
  * (SEMVER-MINOR) add watch config namespace (Marco Ippolito) https://github.com/nodejs/node/pull/60178

PR-URL: https://github.com/nodejs/node/pull/60436
 2025-10-28 20:03:00 +01:00
Antoine du Hamel b9dedf416b 2025-10-20, Version 22.21.0 'Jod' (LTS) 
Notable changes:

cli:
  * (SEMVER-MINOR) add `--use-env-proxy` (Joyee Cheung) https://github.com/nodejs/node/pull/59151
http:
  * (SEMVER-MINOR) support http proxy for fetch under `NODE_USE_ENV_PROXY` (Joyee Cheung) https://github.com/nodejs/node/pull/57165
  * (SEMVER-MINOR) add `shouldUpgradeCallback` to let servers control HTTP upgrades (Tim Perry) https://github.com/nodejs/node/pull/59824
http,https:
  * (SEMVER-MINOR) add built-in proxy support in `http`/`https.request` and `Agent` (Joyee Cheung) https://github.com/nodejs/node/pull/58980
src:
  * (SEMVER-MINOR) add percentage support to `--max-old-space-size` (Asaf Federman) https://github.com/nodejs/node/pull/59082

PR-URL: https://github.com/nodejs/node/pull/60230
 2025-10-21 01:45:50 +02:00
Rafael Gonzaga 0c35aaf55f http: add optimizeEmptyRequests server option 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Co-Authored-By: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/59778
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2025-10-14 12:17:53 +00:00
Node.js GitHub Bot ce72fccc9d 2025-09-25, Version 24.9.0 (Current) 
Notable changes:

http:
  * (SEMVER-MINOR) add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) https://github.com/nodejs/node/pull/59824
sqlite:
  * (SEMVER-MINOR) cleanup ERM support and export Session class (James M Snell) https://github.com/nodejs/node/pull/58378
  * (SEMVER-MINOR) add tagged template (0hm☘️) https://github.com/nodejs/node/pull/58748
worker:
  * (SEMVER-MINOR) add heap profile API (theanarkh) https://github.com/nodejs/node/pull/59846

PR-URL: https://github.com/nodejs/node/pull/59997
 2025-09-25 21:40:51 +02:00
Node.js GitHub Bot f5e2ecc41b 2025-09-24, Version 22.20.0 'Jod' (LTS) 
Notable changes:

crypto:
  * update root certificates to NSS 3.114 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/59571
deps:
  * fix OpenSSL security level at 1 (Richard Lau) https://github.com/nodejs/node/pull/59859
  * upgrade openssl sources to openssl-3.5.2 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/59371
doc:
  * stabilize --disable-sigusr1 (Rafael Gonzaga) https://github.com/nodejs/node/pull/59707
  * mark `path.matchesGlob` as stable (Aviv Keller) https://github.com/nodejs/node/pull/59572
http:
  * (SEMVER-MINOR) add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) https://github.com/nodejs/node/pull/59315
http2:
  * (SEMVER-MINOR) add support for raw header arrays in h2Stream.respond() (Tim Perry) https://github.com/nodejs/node/pull/59455
inspector:
  * add http2 tracking support (Darshan Sen) https://github.com/nodejs/node/pull/59611
sea:
  * (SEMVER-MINOR) implement execArgvExtension (Joyee Cheung) https://github.com/nodejs/node/pull/59560
  * (SEMVER-MINOR) support execArgv in sea config (Joyee Cheung) https://github.com/nodejs/node/pull/59314
stream:
  * (SEMVER-MINOR) add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) https://github.com/nodejs/node/pull/59464
test_runner:
  * (SEMVER-MINOR) support object property mocking (Idan Goshen) https://github.com/nodejs/node/pull/58438
worker:
  * (SEMVER-MINOR) add cpu profile APIs for worker (theanarkh) https://github.com/nodejs/node/pull/59428

PR-URL: https://github.com/nodejs/node/pull/59973
 2025-09-24 13:04:16 +00:00