[24.x] deps: update nghttp2 to 1.69.0 - #63164

PR-URL: #62891
Backport-PR-URL: #63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: #62891
Backport-PR-URL: #63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

PR-URL: nodejs#62891
Backport-PR-URL: nodejs#63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: nodejs#62891
Backport-PR-URL: nodejs#63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Refs: https://hackerone.com/reports/3658225
CVE-ID: CVE-2026-48937

* stream: copyedit `webstreams/adapter.js`

- Simplify `ZLIB_FAILURES` creation.
- Cache `cause.code` in `handleKnownInternalErrors` in case of a getter.
- Replace `SafePromiseAll` with `SafePromiseAllReturnVoid` to reduce the
  number of allocated promises.

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63034
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* build: track PDL files as inputs in inspector GN build

The `node_protocol_generated_sources` action
was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja
to skip regeneration when PDL domain files changed.

PR-URL: https://github.com/nodejs/node/pull/62888
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Kohei Ueno <[email protected]>

* tools: use LTS Node.js in notify-on-push workflow

Without pinning Node.js, the runner defaults to Node 20 and npx falls
back to [email protected] instead of 6.0.0 (requires
Node 22+). Version 5 does not recognise the ffi subsystem, causing
false invalid-commit alerts.

Signed-off-by: Nenad Spasenic <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63084
Fixes: https://github.com/nodejs/node/issues/63070
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

* deps: update amaro to 1.1.9

PR-URL: https://github.com/nodejs/node/pull/63090
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* test_runner: fix failing suite hooks when marked with `todo`

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63097
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

* doc: fix the TypeScript Execute (tsx) project link

Signed-off-by: David Thornton <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63093
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: René <[email protected]>

* quic: start re-enabling quic with openssl 3.5

Start working on re-enabling QUIC support with the availability
of OpenSSL 3.5. This will be a multi-step process.

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* deps: update ngtcp2 to 1.14.0

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* deps: update nghttp3 to 1.11.0

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* quic: update the guard to check openssl version

Since we need to be able to use the openssl adapter provided
by the ngtcp2 library, and because that adapter does not include
any compile guards to ensure that OpenSSL 3.5 is being used and
that the APIs are actually available, we need to add a compile
time check for the openssl version in order to conditionally
include the adapter to avoid build errors when using a shared
openssl library that is not OpenSSL 3.5.

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* quic: fixup windows coverage compile error

PR-URL: https://github.com/nodejs/node/pull/59381
Fixes: https://github.com/nodejs/node/issues/59369
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

* quic: fixup NO_ERROR macro conflict on windows

PR-URL: https://github.com/nodejs/node/pull/59381
Fixes: https://github.com/nodejs/node/issues/59369
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

* quic: few additional small comment edits in cid.h

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* quic: update more of the quic to the new compile guard

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* quic: multiple fixups and updates

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* quic: reduce boilerplate and other minor cleanups

While I get that macros aren't the most loved thing in
the world, they do help reduce boilerplate, and there's
a lot of boilerplate in the QUIC code. This commit cleans
up some of that boilerplate, particularly around the
use of v8 APIs.

PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* src: cleanup quic TransportParams class

PR-URL: https://github.com/nodejs/node/pull/59884
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* src: fix small compile warning in quic/streams.cc

Fixes: https://github.com/nodejs/node/issues/60110
PR-URL: https://github.com/nodejs/node/pull/60118
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

* deps: update nghttp3 to 1.13.1

PR-URL: https://github.com/nodejs/node/pull/60046
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* deps: update nghttp3 to 1.14.0

PR-URL: https://github.com/nodejs/node/pull/61187
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* quic: copy options.certs buffer instead of detaching

The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: https://github.com/nodejs/node/pull/61403
Refs: https://github.com/nodejs/node/pull/61372
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

* quic: fix a handful of bugs and missing functionality

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <[email protected]>

* quic: update http3 impl details

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <[email protected]>

* quic: fixup linting/formatting issues

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <[email protected]>

* quic: use arena allocation for packets

Previously Packets were ReqWrap objects with a shared
free-list. This commit changes to a per-Endpoint arena
with no v8 involvement. This is the design I originally
had in mind but I initially went with the simpler
freelist approach to get something working. There's
too much overhead in the reqrap/freelist approach and
individual packets do not really need to be observable
via async hooks.

This design should eliminate the risk of memory fragmentation
and eliminate a significant bottleneck in the hot path.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62589
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

* quic: move quic behind compile time flag

Move node:quic behind a compile-time flag, disabled by default.
Use --experimental-quic at configure time to enable.

- Add --experimental-quic flag to configure.py
- Add node_use_quic variable and HAVE_QUIC define
- Make QUIC sources conditional in node.gyp
- Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi
- Update C++ guards to check HAVE_QUIC
- Update process.features.quic to check node_use_quic

PR-URL: https://github.com/nodejs/node/pull/61444
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

* quic: implement rapidhash for hashing improvements

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* src: add permission support to config file

PR-URL: https://github.com/nodejs/node/pull/60746
Backport-PR-URL: https://github.com/nodejs/node/pull/62760
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>

* test: improve config-file permission test coverage

Refs: https://github.com/nodejs/node/pull/60746#pullrequestreview-3470430664
PR-URL: https://github.com/nodejs/node/pull/60929
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* src: expose help texts into node-config-schema.json

PR-URL: https://github.com/nodejs/node/pull/58680
Reviewed-By: Marco Ippolito <[email protected]>

* test_runner: update node-config-schema

PR-URL: https://github.com/nodejs/node/pull/58680
Reviewed-By: Marco Ippolito <[email protected]>

* doc: fix node-config-schema

PR-URL: https://github.com/nodejs/node/pull/61596
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* meta: bump actions/download-artifact from 8.0.0 to 8.0.1

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62549
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* quic: apply multiple TLS context improvements and SNI support

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* quic: support multiple ALPN negotiation

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* quic: fixup token verification to handle zero expiration

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* util: colorize text with hex colors

PR-URL: https://github.com/nodejs/node/pull/61556
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Claudio Wunder <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* quic: add QuicEndpoint.listening & QuicStream.destroy() and tests

Starting to explore and cover the existing implementation, this covers
the basic endpoint & stream lifecycle and the exposed properties.
Added endpoint.listening to match net.Server and round out endpoint
properties, and stream.destroy() which is already called by
quicSession.destroy() and documented, but didn't actually exist.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62648
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* tools: add a check for clean git tree after tests

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62661
Refs: https://github.com/nodejs/node/issues/62646
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

* src: clean up experimental flag variables

- `fetch` is no longer disable by a CLI flag
- `node:sqlite` requires SQLite, obviously

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62759
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Geoffrey Booth <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

* fs: add followSymlinks option to glob

PR-URL: https://github.com/nodejs/node/pull/62695
Reviewed-By: Moshe Atlow <[email protected]>

* doc: fix duplicate word "to to" in util.styleText

PR-URL: https://github.com/nodejs/node/pull/62917
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

* test: update WPT for streams to f8f26a372f

PR-URL: https://github.com/nodejs/node/pull/62864
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* test: update WPT for url to 258f285de0

PR-URL: https://github.com/nodejs/node/pull/63087
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

* repl: keep reference count for `process.on('newListener')`

When investigating a memory leak in one of our applications,
we discovered that this listener holds on to a `REPLServer`
instance and all heap objects transitively kept alive by it
by capturing as part of its closure.

It's cleaner to declare the listener outside of the `REPLServer`
class and to actually clean it up properly when it is no longer
required or meaningful, which is easily achieved through
keeping a reference count.

PR-URL: https://github.com/nodejs/node/pull/61895
Backport-PR-URL: https://github.com/nodejs/node/pull/63194
Reviewed-By: Antoine du Hamel <[email protected]>

* crypto: remove Argon2 KDF derivation from its job setup

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62863
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Fixes: https://github.com/nodejs/node/issues/62861
Reviewed-By: Antoine du Hamel <[email protected]>

* crypto: reject unintended raw key format string input

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62974
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Reviewed-By: Antoine du Hamel <[email protected]>

* doc: fix typos and inconsistencies in crypto.md and webcrypto.md

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62828
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Reviewed-By: Antoine du Hamel <[email protected]>

* crypto: deduplicate and canonicalize CryptoKey usages

Fixes: https://github.com/nodejs/node/issues/62899

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62902
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Fixes: https://github.com/nodejs/node/issues/62899
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: initial support storage inspection

PR-URL: https://github.com/nodejs/node/pull/61139
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: auto collect webstorage data

PR-URL: https://github.com/nodejs/node/pull/62145
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: return errors when CDP protocol event emission fails

PR-URL: https://github.com/nodejs/node/pull/62162
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: coerce key and value to string in webstorage events

Signed-off-by: Ali Hassan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62616
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Refs: https://github.com/nodejs/node/pull/62145
Refs: https://github.com/nodejs/node/pull/62162
Reviewed-By: Antoine du Hamel <[email protected]>

* test: generate `localstorage.db` in a temp dir

Co-Authored-By: Antoine du Hamel <[email protected]>
Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62660
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* deps: V8: cherry-pick 657d8de27427

Original commit message:

    [maglev] Fix throwing node inside eager inlining

    This commit refactors the exception handling logic to correctly identify
    and associate nodes with their respective `catch` blocks, even
    when multiple levels of inlining are involved.

    Previously, the check `!IsInsideTryBlock() && !is_eager_inline()` was
    insufficient to determine if catch block inside `CatchDetails` was
    already created.

    Specifically, consider the case where:
    1. Function `bar` is non-eagerly inlined into `foo`.
    2. `foo` contains a `catch` block.
    3. `bar` calls `in_bar`, which is eagerly inlined.
    4. A node within `in_bar` can `throw`.

    In this scenario, `is_eager_inline` would be true when compiling
    `in_bar`, leading to an incorrect assumption that the catch block didn't exist yet.

    This change addresses the issue by propagating a boolean value via
    `CatchDetails`. This boolean accurately indicates whether a `catch`
    block is present in the call chain, allowing for correct exception
    handling regardless of inlining depth or eagerness.

    Fixed: 417768368
    Change-Id: Ic52f72f302b4dc644bdcad939addf98111bc525b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6563500
    Commit-Queue: Victor Gomes <[email protected]>
    Reviewed-by: Darius Mercadier <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#100380}

Refs: https://github.com/v8/v8/commit/657d8de274276c940d07203ee43d3cf4c732cebd
PR-URL: https://github.com/nodejs/node/pull/62784
Reviewed-By: Xuguang Mei <[email protected]>

* test_runner: support test order randomization

PR-URL: https://github.com/nodejs/node/pull/61747
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>

* test_runner: publish to TracingChannel for OTel instrumentation

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62502
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* test_runner: add `testId` to test events

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62772
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>

* deps: update corepack to 0.35.0

PR-URL: https://github.com/nodejs/node/pull/63375
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

* 2026-05-21, Version 24.16.0 'Krypton' (LTS)

Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63263

* Working on v24.16.1

PR-URL: https://github.com/nodejs/node/pull/63263

* deps: update undici to 7.28.0

PR-URL: https://github.com/nodejs/node/pull/63703
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* deps: fix aix implicit declaration in OpenSSL

This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: https://github.com/nodejs/node/pull/62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

* deps: upgrade openssl sources to openssl-3.5.7

PR-URL: https://github.com/nodejs/node/pull/63820
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

* deps: update archs files for openssl-3.5.7

PR-URL: https://github.com/nodejs/node/pull/63820
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

* deps: update nghttp2 to 1.69.0

PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

* deps: fix integration issues with the latest nghttp2

This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Refs: https://hackerone.com/reports/3658225
CVE-ID: CVE-2026-48937

* deps: update llhttp to 9.4.2

PR-URL: https://github.com/nodejs-private/node-private/pull/890
Reviewed-By: Tobias Nießen <[email protected]>

* lib,test: redact proxy credentials in tunnel errors

Refs: https://hackerone.com/reports/3720313
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/867
Reviewed-By: Joyee Cheung <[email protected]>
CVE-ID: CVE-2026-48615

* permission: handle process.chdir on writereport

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/870
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987

* tls: normalize hostname for server identity checks

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/869
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48618
Refs: https://hackerone.com/reports/3688064

* http2: cap originSet size to prevent unbounded memory growth

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48619

* tls: fix case-sensitive SNI context matching

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: https://github.com/nodejs-private/node-private/pull/857
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869

* dns,net: reject hostnames with embedded NUL bytes

Ref: https://hackerone.com/reports/3656716
PR-URL: https://github.com/nodejs-private/node-private/pull/868
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48930
Refs: https://hackerone.com/reports/3656716

* permission: disable FileHandle utimes with permission model

PR-URL: https://github.com/nodejs-private/node-private/pull/873
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48935
Refs: https://hackerone.com/reports/3625987

* http: fix response queue poisoning in http.Agent

Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.

Refs: https://hackerone.com/reports/3582376
PR-URL: https://github.com/nodejs-private/node-private/pull/846
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48931
Refs: https://hackerone.com/reports/3582376

* crypto: guard WebCrypto cipher output length

Reject WebCrypto cipher operations whose computed output length would
exceed INT_MAX before passing the length to OpenSSL.

This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot
cipher paths and turns oversized inputs into a clean operation failure.

Refs: https://hackerone.com/reports/3760016
Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/878
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48933

* tls: bind reusable sessions to authenticated host

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48934
Refs: https://hackerone.com/reports/3649802

* test: add session reuse host verification regressions

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <[email protected]>
Refs: https://hackerone.com/reports/3649802

* 2026-06-18, Version 24.17.0 'Krypton' (LTS)

This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

PR-URL: https://github.com/nodejs-private/node-private/pull/899

* Working on v24.17.1

PR-URL: https://github.com/nodejs-private/node-private/pull/899

* doc: remove list of versions in `BUILDING.md`

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63113
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>

* doc: document the latest-vX.x schema

Signed-off-by: Marco Ippolito <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63033
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* doc: add Hmac.digest() documentation-only deprecation (DEP0206)

Signed-off-by: anshikakalpana <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63121
Refs: https://github.com/nodejs/node/issues/62838
Reviewed-By: René <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* sqlite: keep source database alive during backup

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62673
Reviewed-By: Daniel Lemire <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Edy Silva <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* module: fix sync hook short-circuit in require() in imported CJS

- For imported CJS, if it's not customized by asynchronous hooks,
  make sure it won't use the quirky re-invented require in all
  cases.
- When the imported CJS module is customized by synchronous hooks,
  in the synthetic module evalutation step, avoid calling the
  respective default step again.
- Make the branching of loadCJSModuleWithModuleLoad() and
  loadCJSModuleWithSpecialRequire() more explicit, and fold
  the tentative fs read in the 'commonjs' translator into the
  share createCJSModuleWrap() helper instead of checking it
  twice in the same path.

Signed-off-by: Joyee Cheung <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62920
Fixes: https://github.com/nodejs/node/issues/63060
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

* test: use ERM to destroy sqlite database handles after tests

Signed-off-by: Renegade334 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63076
Refs: https://github.com/nodejs/node/issues/63052
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Edy Silva <[email protected]>

* doc,sqlite: document entryPoint argument for loadExtension

Signed-off-by: geeksilva97 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63152
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: René <[email protected]>

* doc: update release steps when post-release fails

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63131
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* tls: add unsupported renegotiation error

Map BoringSSL's native renegotiation failure to
ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is
called. This avoids exposing an implementation-specific OpenSSL error
when the TLS backend does not support caller-initiated renegotiation.

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63161
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>

* quic: remove unused binding variable in session.cc

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63177
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

* doc: clarify SEA platform support excludes darwin-x64

The Platform support section of the single-executable-applications doc
listed `macOS` without qualifying which architecture is supported.
SEA on x64 macOS is not supported and is skipped in CI; only arm64
macOS is exercised.

Refs: https://github.com/nodejs/node/issues/62893
Signed-off-by: mokashang <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63181
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* doc: remove unnecessary `<!-- eslint-` magic comments

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63200
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

* meta: ignore AI assistants files

Ignore CLAUDE.md and AGENTS.md in .gitignore, and exclude
them from markdown and ESLint linting.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62612
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Daijiro Wachi <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

* lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array

Follow WHATWG streams spec update: https://github.com/whatwg/streams/pull/1367

ReadableStreamBYOBRequest.view is always constructed as a Uint8Array.

This changes the documented return type from ArrayBufferView to
Uint8Array per the updated spec.

Fixes: https://github.com/nodejs/node/issues/62952

Signed-off-by: Jah-yee <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63017
Reviewed-By: Mattias Buelens <[email protected]>
Reviewed-By: Jason Zhang <[email protected]>

* doc: add large pull requests contributing guide

- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62829
Fixes: https://github.com/nodejs/node/issues/62752
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Ruy Adorno <[email protected]>

* tools: use different branch for tool updates on staging branches

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63110
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>

* debugger: add --help to `node inspect` and improve docs

- Add `--help` / `-h` to `node inspect` covering both interactive and
  non-interactive probe modes. The help text is printed when
  `--help`/`-h` appears before any positional argument to avoid
  hijacking `--help` passed to a child script.
- Improve the documentation of probe mode and add examples, explain
  same-location probe coalescing, TDZ caveat for let/const bindings,
  basename matching and exit code behavior. Also move it to a
  section parallel to interactive mode. Remove recommendation of
  evaluating structured expressions as that is prone to missing
  info in JSON mode.

Drive-by: When probe mode exits due to invalid arguments, exit with
`kInvalidCommandLineArgument` (9) instead of `kGenericUserError` (1).

Signed-off-by: Joyee Cheung <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63201
Reviewed-By: Jan Martin <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

* deps: cherry-pick libuv/libuv@a43e543

Original commit message:

    unix: fix pedantic compiler warnings (#5052)

    Fixes: https://github.com/libuv/libuv/issues/5051

Fixes: https://github.com/nodejs/node/issues/63196
Refs: https://github.com/libuv/libuv/pull/5052
Refs: https://github.com/libuv/libuv/commit/a43e543dbffba93f014fe8360a5edbe8d6ce8500
PR-URL: https://github.com/nodejs/node/pull/63222
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: René <[email protected]>

* src,sqlite: remove dead code

Signed-off-by: geeksilva97 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63204
Reviewed-By: René <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Jake Yuesong Li <[email protected]>

* deps: V8: cherry-pick 435a2cdf664c

Original commit message:

    [wasm] Update WebAssembly.Exception JS API

    WebIDL specifies the existence of a
    `WebAssembly.Exception.prototype.stack` getter.
    WebIDL also expects the constructor to have 2 parameters (plus an
    optional one).

    https://webassembly.github.io/spec/js-api/#exceptions

    Bug: 336347912, 42204334
    Change-Id: I128e976a84f942dcf9b93a157534b15fad0f9215
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7697976
    Commit-Queue: Matthias Liedtke <[email protected]>
    Auto-Submit: Matthias Liedtke <[email protected]>
    Commit-Queue: Clemens Backes <[email protected]>
    Reviewed-by: Clemens Backes <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#106215}

Refs: https://github.com/v8/v8/commit/435a2cdf664ce02e0c6ea9401fbae600663e47cb
PR-URL: https://github.com/nodejs/node/pull/63136
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* crypto: improve system certificate enumeration logic on macOS

1) Fixed macOS default for missing kSecTrustSettingsResult

When kSecTrustSettingsResult is absent from a trust settings dictionary,
Apple specifies kSecTrustSettingsResultTrustRoot as the default value.

Previously, the trust result evaluation (deny check, self-issued check,
TrustAsRoot check) was inside the block that only executed when
kSecTrustSettingsResult was explicitly present. When the key was absent,
the function fell through to return UNSPECIFIED, incorrectly rejecting
self-signed certificates that should have been trusted via the default.

Move the trust result evaluation outside the conditional block so the
default value of kSecTrustSettingsResultTrustRoot flows through the
same code path as explicit values. This aligns with Chromium's
trust_store_mac.cc implementation.

2) Fix CFRelease leak in IsTrustDictionaryTrustedForPolicy: the
CFDictionaryRef returned by SecPolicyCopyProperties(policy_ref)
was not released when the policy OID matched kSecPolicyAppleSSL.

3) Deduplicate certificates: SecItemCopyMatching can return the same
certificate from multiple keychains.

4) Filter expired certificates.

Signed-off-by: deepak1556 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62576
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

* doc: run license-builder

PR-URL: https://github.com/nodejs/node/pull/63232
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Gireesh Punathil <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>

* lib: fixes validator message

PR-URL: https://github.com/nodejs/node/pull/62823
Reviewed-By: Luigi Pinca <[email protected]>

* lib: fix typo idenity => identity


PR-URL: https://github.com/nodejs/node/pull/63112
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

* node-api: support SharedArrayBuffer in napi_create_typedarray

Signed-off-by: umuoy1 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62710
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Vladimir Morozov <[email protected]>

* meta: move one or more collaborators to emeritus

PR-URL: https://github.com/nodejs/node/pull/63235
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

* doc: recommend explicitly Tier 1 or 2 for production applications

Signed-off-by: Mike McCready <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63187
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* doc: replace Visual Studio 2022 Evergreen version reference with 17.14

Signed-off-by: Mike McCready <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63211
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

* test: move FFI tests to `NATIVE_SUITES`

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63165
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* doc: reference correct function in Module docs

Signed-off-by: Robin Malfait <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63247
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* tools: fix test426 updater

The previous version produces a commit that does pass the linter
because of a too-long commit title.

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63271
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* repl: fix dedup comparing normalized line against raw history

Signed-off-by: Daijiro Wachi <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62886
Reviewed-By: Luigi Pinca <[email protected]>

* test_runner: fix diagnostics channel context tracking

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63283
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

* http2: validate non-link headers in writeEarlyHints

Validate header names and values for non-link hints passed to
writeEarlyHints() in the HTTP/2 compat layer using assertValidHeader()
and checkIsHttpToken(), consistent with the HTTP/1.1 validation added
in https://github.com/nodejs/node/pull/61897.

Previously, hints were forwarded into the headers object without any
validation, allowing invalid characters in header names/values to
surface as opaque errors deeper in the HTTP/2 stack.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62017
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* deps: update simdjson to 4.6.4

PR-URL: https://github.com/nodejs/node/pull/62811
Reviewed-By: Antoine du Hamel <[email protected]>

* http: add writeInformation to send arbitrary 1xx status codes

Signed-off-by: Tim Perry <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63155
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* deps: update sqlite to 3.53.1

PR-URL: https://github.com/nodejs/node/pull/63217
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Edy Silva <[email protected]>
Reviewed-By: Jithil P Ponnan <[email protected]>

* test: avoid initial-break wait in restart-message

Signed-off-by: inoway46 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62060
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Kohei Ueno <[email protected]>

* test: avoid flaky restart sync in debugger exceptions test

Signed-off-by: inoway46 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62055
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

* stream: remove unnecessary check

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63030
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>

* fs: make `Date` properties on `Stats` enumerable

Signed-off-by: LiviaMedeiros <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63328
Reviewed-By: René <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* doc: remove inactive members from Triagers list

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63329
Fixes: https://github.com/nodejs/admin/issues/1058
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>

* test: relax min assertion in test-performance-eventloopdelay

Signed-off-by: marcopiraccini <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63100
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

* test_runner: avoid hanging on incomplete v8 frames

Signed-off-by: Ali Hassan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62704
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* test: fix flaky test-watch-mode-inspect timeout

This test randomly times out (~120s) on CI due to a race condition
between child-process restart (triggered by touching the watched file)
and the second inspector-session connection.

The old code used an interval-based restart (write every 500ms) and
a 'gettingDebuggedPid' flag to pause writes during a session. This
still left a race window where getDebuggedPid() would attempt to
connect the inspector via HTTP GET /json/list + WebSocket upgrade
either before the new child was ready (empty target list) or after
the old session was being destroyed, causing the promise to hang.

Fix: Replace the interval with a single write that triggers exactly
one restart, then wait for the restarted child's 'safe to debug now'
stdout line before connecting the second inspector session. This
eliminates the race by ensuring the new child process and its
inspector session are fully ready before any connection attempt.

Removes the now-unused gettingDebuggedPid flag and the pending
setTimeout delay that was needed as a backstop for the interval.

Fixes: https://github.com/nodejs/node/issues/44898
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63361
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>

* test: reduce flakiness of `different-registry-per-thread`

There was an assumption that the `WeakRef` would be kept alive but
it seems to not always be true on Windows. This commit makes sure
it's kept alive.

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63244
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>

* test: relax test-memory-usage arrayBuffers check

Signed-off-by: inoway46 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63244
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>

* tools: update gyp-next to 0.22.2

PR-URL: https://github.com/nodejs/node/pull/63374
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

* tools: bump the eslint group in /tools/eslint with 4 updates

Bumps the eslint group in /tools/eslint with 4 updates:
[@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core),
[@babel/eslint-parser](https://github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser),
[@babel/plugin-syntax-import-source](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-syntax-import-source)
and [eslint](https://github.com/eslint/eslint).

Updates `@babel/core` from 8.0.0-rc.3 to 8.0.0-rc.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/packages/babel-core)

Updates `@babel/eslint-parser` from 8.0.0-rc.3 to 8.0.0-rc.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/eslint/babel-eslint-parser)

Updates `@babel/plugin-syntax-import-source` from 8.0.0-rc.3 to
8.0.0-rc.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/packages/babel-plugin-syntax-import-source)

Updates `eslint` from 10.2.0 to 10.2.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 8.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: "@babel/eslint-parser"
  dependency-version: 8.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: "@babel/plugin-syntax-import-source"
  dependency-version: 8.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
- dependency-name: eslint
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: eslint
...

PR-URL: https://github.com/nodejs/node/pull/63075
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* crypto: align verifyOneShot accepted types

Signed-off-by: anshikakalpana <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63280
Fixes: https://github.com/nodejs/node/issues/62903
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* test: deflake watch mode worker test

Trigger watch restarts by appending whitespace instead of rewriting
watched modules. This avoids transient empty or partial ESM dependency
contents while the restarted worker is loading.

Use a separate temporary directory for each subtest so concurrent
subtests do not share worker and dependency file names.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63384
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* test: avoid repeated writes in watch helper

Use performFileOperation() for test runner watch updates so the
run() API path schedules a single delayed write instead of rewriting
the file until the second run completes.

Repeated writes can trigger another watch restart while the previous
rerun is still active. The runner then terminates the in-flight child
process with SIGTERM, which can make the captured output include both
a failed file-level subtest and the next successful run.

Also count only root summary duration lines when detecting completed
runs.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63386
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* doc: update http2's `push` and `trailers` events with `rawHeaders` param

Signed-off-by: Yu-Sheng Chen <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63259
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* doc: remove the bi-monthly contributor spotlight section

PR-URL: https://github.com/nodejs/node/pull/62734
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

* doc: fix article usage before vowel-sound acronyms

Several prose references to HTTP, HTTPS, SSL, HPE_HEADER_OVERFLOW
and ECMAScript used the article "a" where the acronym starts with
a vowel sound and should take "an". The rule is based on
pronunciation, not spelling: HTTP is read "aitch-tee-tee-pee",
SSL is read "ess-es-el", ECMAScript is read "ek-mah-script",
and HPE is read "aitch-pee-ee" — all starting with a vowel sound.

Affected files:

* doc/api/crypto.md — "disable a SSL 3.0/TLS 1.0 vulnerability"
* doc/api/http.md — five occurrences ("a HTTP '400 Bad Request'",
  "a HTTP '431 Request Header Fields Too Large'", "a HTTP/1.1 102
  Processing message", two copies of "use a HTTP parser") plus
  two references to "a HPE_HEADER_OVERFLOW"
* doc/api/http2.md — two code-sample comments reading
  "// Detects if it is a HTTPS request or HTTP/2"
* doc/api/module.md — "compiles a CommonJS, a ECMAScript Module,
  or a TypeScript module" (only the middle article changes; the
  adjacent "a CommonJS" and "a TypeScript" are both correct)
* doc/api/tls.md — two references to "part of a SSL/TLS handshake"
  in tlsSocket.getFinished() and tlsSocket.getPeerFinished()

No behavior changes, documentation only.

Signed-off-by: João Victor Oliveira <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62696
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Akhil Marsonya <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>

* test: deflake connection refused proxy tests

Use 127.0.0.1:10, matching existing refused-connection tests, instead
of binding and releasing an ephemeral port that can be reused before
the child process connects.

Clear NO_PROXY and no_proxy so local proxy bypass settings do not skip
the proxy connection attempt.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63395
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-15.md#jstest-failure
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* test: disable Maglev in near-heap-limit worker test

The test expects the worker to run out of memory during startup while
creating the message port. With Maglev enabled, the tiny worker heap
can be exhausted earlier while generating deoptimization data, which
changes the failure mode.

Disable Maglev so the induced OOM reaches the path covered by the test.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: https://github.com/nodejs/node/pull/63398
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-18.md#jstest-failure
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

* meta: move one or more collaborators to emeritus

PR-URL: https://github.com/nodejs/node/pull/63402
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Debadree Chatterjee <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* doc: remove unsupported template type from v8.md

Signed-off-by: Renegade334 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63410
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* Revert "stream: noop pause/resume on destroyed streams"

This reverts commit 29b196694c78fa5f2fd7a9cd5083278deb69241d.

Signed-off-by: Stewart X Addison <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63834
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>

* test_runner: preserve run duration when using test-rerun

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63429
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

* test_runner: show replayed-from-attempt hint in spec reporter

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63429
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

* src: expose `node::RegisterContext` to make a node managed context

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62322
Reviewed-By: Joyee Cheung <[email protected]>

* test: wait for ok before initial break after restart

Signed-off-by: inoway46 <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62807
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <[email protected]>

* doc: fix typo in deprecations

Signed-off-by: Daijiro Wachi <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63434
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* meta: add additional gitignore entries

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <[email protected]>

* quic: fixup linting issue after other changes

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <[email protected]>

* quic: implement rate limiting for version nego and immediate close

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <[email protected]>

* quic: add reusePort option to QuicEndpoint

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/63267
Reviewed-By: Matteo Collina <[email protected]>

* stream: fix Writable.toWeb() hang on synchronous drain

A race condition in the Writable.toWeb() adapter caused the stream
to hang if the underlying Node.js Writable emit…