Signed-off-by: Renegade334 <[email protected]>
PR-URL: #63062
Refs: #33075
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: Mike McCready <[email protected]>
PR-URL: #63381
Refs: #63225
Refs: #63367
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>

PR-URL: #63417
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Signed-off-by: StefanStojanovic <[email protected]>
PR-URL: #63114
Refs: #61964
Reviewed-By: Michaël Zasso <[email protected]>

Signed-off-by: Joyee Cheung <[email protected]>
PR-URL: #63307
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Stewart X Addison <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Nad Alaba <[email protected]>
PR-URL: #63117
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: #63429
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: #63429
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #62322
Reviewed-By: Joyee Cheung <[email protected]>

Signed-off-by: inoway46 <[email protected]>
PR-URL: #62807
Refs: #61762
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Daijiro Wachi <[email protected]>
PR-URL: #63434
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: #63435
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>

RHEL 8 machines now use clang 20.1.

Signed-off-by: Richard Lau <[email protected]>
PR-URL: #63441
Refs: nodejs/build#4265
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Stewart X Addison <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Use a uv_check_t on BindingData to process outbound
pending packet send, and use TrySend for actually sending
packets when possible. Results in an 8% improvement in
req/s and ~24% improvement in p95 latency.

Also sets us up better for future improvements in
libuv if the changes proposed in libuv/libuv#5116
are accepted.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Improves overall performance and sets us up for eventual
support for GRO/GSO batching in libuv in the future.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Set up for when libuv eventually supports ECN marking.
Pass the ECN marking stuff into ngtcp2.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Every stream, session, and endpoint creates aliased
structs for stats and state. These were creating
v8::ArrayBuffer allocations and views for each instance,
which is expensive. This adds a new arena mechanism
for AliasedStructs that allocates in pages and allows
Streams and Sessions to share the same underlying
ArrayBuffer for their stats and state. Since these
are never exposed to users, this is safe and results
in a significant reduction in allocation counts.

Each arena maintains a freelist of pages, where each
page is a max of 16KB bytes. Pages are lazily allocated
and freed as needed. Each slot in the arena corresponds
to a single struct instance, and the slot index is
used to calculate the byte offset within the page for
that struct's view.

The perf improvement is modest but measurable. The
key benefit is in reduced memory fragmentation and GC
overhead.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

* Adds invalid this protections in the stats classes
* Collects internal private fields into a single private symbol
  to reduce the number of private field accesses
* Adds and corrects isQuic* class checks
* Preserve stream id and direction after destroy
* Improve stats close snapshotting
* Fixes a handful of other bugs and doc issues

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Reviewed-By: Matteo Collina <[email protected]>

Ensure overlapping next() calls on a single share() consumer resolve
in the same order they were requested.

Fixes: #63477

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: #63478
Fixes: #63477
Reviewed-By: James M Snell <[email protected]>

Refs: #63489

Signed-off-by: Kamat, Trivikram <[email protected]>
Co-authored-by: Antoine du Hamel <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: #63541
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63586
Refs: nodejs/node-core-utils#1043
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #63588
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>

Signed-off-by: Tim Perry <[email protected]>
PR-URL: #63198
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #63591
Reviewed-By: Jake Yuesong Li <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Forward Node.js tail stream data through a pipe-style data listener
instead of manually draining readable events. This keeps compose closer
to the stream pipe hot path while preserving backpressure with pause
and resume.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.5
PR-URL: #63593
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Jake Yuesong Li <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

The 8 KiB default has been unchanged since 2015. With the threshold
check `size < (Buffer.poolSize >>> 1)`, this means allocations of 4 KiB
or larger bypass the pool entirely — including 4 KiB itself, a common
page and HTTP-frame size.

Raising the default to 64 KiB extends pool coverage to ~32 KiB
allocations, capturing common sizes used by HTTP parsers, stream
chunks, and small file reads.

Throughput improvements on workers-k=8 fs.readFileSync benchmarks
(Linux/glibc) at the affected sizes, with no regressions elsewhere:

  file size  |  8 KiB pool  |  64 KiB pool  |  delta
  -----------+--------------+---------------+-------
   4 KiB     |  326k ops/s  |  360k ops/s   |  +10%
   8 KiB     |  202k ops/s  |  254k ops/s   |  +26%
  16 KiB     |  148k ops/s  |  181k ops/s   |  +23%
  64 KiB     |   86k ops/s  |   87k ops/s   |   ~
   1 MiB     |   12k ops/s  |   13k ops/s   |   ~

Cost: +56 KiB RSS per realm at startup.
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #63597
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: LiviaMedeiros <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <[email protected]>
PR-URL: #63491
Fixes: #63473
Reviewed-By: René <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

Signed-off-by: Guilherme Araújo <[email protected]>
PR-URL: #62999
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

PR-URL: #63602
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Add a new httpValidation option to http.createServer() and
http.request() / http.ClientRequest that controls how strictly
HTTP header values are validated:

- 'strict'   - reject any non-ASCII or control characters (default)
- 'relaxed'  - allow the non-ASCII characters permitted by the
               Fetch specification (kLenientHeaderValueRelaxed)
- 'insecure' - disable all validation (like insecureHTTPParser)

The option is threaded through _storeHeader -> processHeader ->
storeHeader -> validateHeaderValue, and also through
writeInformation -> processInformationHeader -> validateHeaderValue.

Cannot be used together with insecureHTTPParser.

Fixes: #61582
Signed-off-by: RajeshKumar11 <[email protected]>
PR-URL: #61597
Refs: #61582
Refs: https://fetch.spec.whatwg.org/#header-value
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63609
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63611
Reviewed-By: Mattias Buelens <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63612
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #63621
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63517
Refs: https://hackerone.com/reports/3752489
Reviewed-By: James M Snell <[email protected]>

Signed-off-by: Joyee Cheung <[email protected]>
PR-URL: #63650
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63625
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63055
Backport-PR-URL: #63153
Refs: https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment/
Refs: nodejs/build#4317
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Stewart X Addison <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chengzhong Wu <[email protected]>

Notable changes:

buffer:
  * (SEMVER-MINOR) increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) #63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
doc:
  * downgrade macOS x64 support to Tier 2 (Antoine du Hamel) #63055
http:
  * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) #61597
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079
lib,permission:
  * (SEMVER-MINOR) add `permission.drop` (Rafael Gonzaga) #62672

PR-URL: #63664