[v24.x] Revert "stream: noop pause/resume on destroyed streams" by sxa · Pull Request #63834 · nodejs/node

sxa · 2026-06-10T12:49:06Z

This reverts commit 29b1966 from #62557

Should fix #63487 based on a git bisect run

nodejs-github-bot · 2026-06-10T12:49:11Z

Review requested:

@nodejs/streams

nodejs-github-bot · 2026-06-10T12:52:16Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74035/

sxa · 2026-06-10T12:56:07Z

Revert on top of v24.x-staging confirmed to have resolved the problem on my local system therefore I am taking this out of draft status.

sxa · 2026-06-10T13:00:26Z

FYI @nodejs/tsc @nodejs/releasers

mcollina

lgtm confirmed

MikeMcC399 · 2026-06-10T14:18:43Z

Successfully tested against [email protected]👍🏻

Cypress already produced a fix for this issue in [email protected] so I'm testing against the previous unfixed version [email protected].

The Cypress analysis of why it was failing on Windows (always) and Linux (when no unzip installed) is in cypress-io/cypress#33891 (comment). In both cases, extract-zip was being invoked and it failed on Node.js 24.16.0 and Node.js >=26.1.0 with the symptom that unzipping either hung or silently exited, depending on how the installation of the Cypress binary was invoked.

Verification

On Windows 11 25H2, in Git Bash with Node.js v24.16.1-pre, built from #63834, installed

cd $(mktemp -d)
npm install [email protected] --ignore-scripts # fixed versions >=15.16.0
npx cypress install --force
npx cypress verify

Logs

$ cd $(mktemp -d)
npm install [email protected] --ignore-scripts # fixed versions >=15.16.0
npx cypress install --force
npx cypress verify
npm warn cli npm v11.7.0 does not support Node.js v24.16.1-pre. This version of npm supports the following node versions: `^20.17.0 || >=22.9.0`. You can find the latest version at https://nodejs.org/.

added 175 packages in 6s

53 packages are looking for funding
  run `npm fund` for details
npm warn cli npm v11.7.0 does not support Node.js v24.16.1-pre. This version of npm supports the following node versions: `^20.17.0 || >=22.9.0`. You can find the latest version at https://nodejs.org/.

Cypress 15.15.0 is installed in C:\Users\mikem\AppData\Local\Cypress\Cache\15.15.0

Installing Cypress (version: 15.15.0)

√  Downloaded Cypress
√  Unzipped Cypress
√  Finished Installation C:\Users\mikem\AppData\Local\Cypress\Cache\15.15.0

You can now open Cypress by running one of the following, depending on your package manager:

- npx cypress open
- yarn cypress open
- pnpm cypress open

https://on.cypress.io/opening-the-app

npm warn cli npm v11.7.0 does not support Node.js v24.16.1-pre. This version of npm supports the following node versions: `^20.17.0 || >=22.9.0`. You can find the latest version at https://nodejs.org/.

√  Verified Cypress! C:\Users\mikem\AppData\Local\Cypress\Cache\15.15.0\Cypress

nodejs-github-bot · 2026-06-11T08:37:28Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74050/

nodejs-github-bot · 2026-06-11T10:08:54Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74051/

github-actions · 2026-06-18T13:27:01Z

Failed to start CI

   ⚠  Commits were pushed since the last approving review:
   ⚠  - Revert "stream: noop pause/resume on destroyed streams"
   ✘  Refusing to run CI on potentially unsafe PR

https://github.com/nodejs/node/actions/runs/27762715319

github-actions · 2026-06-18T15:54:31Z

Failed to start CI

   ⚠  Commits were pushed since the last approving review:
   ⚠  - Revert "stream: noop pause/resume on destroyed streams"
   ✘  Refusing to run CI on potentially unsafe PR

https://github.com/nodejs/node/actions/runs/27771938741

sxa · 2026-06-18T18:22:57Z

Landed in 84718082627f

MattiasBuelens · 2026-06-18T19:23:30Z

@sxa 8471808 doesn't seem to be on v24.x-staging? Or am I missing something?

This reverts commit 29b1966. Signed-off-by: Stewart X Addison <[email protected]> PR-URL: #63834 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Stefan Stojanovic <[email protected]>

sxa · 2026-06-18T19:57:05Z

There was an issue with the signing on the commit not occurring properly so it got rejected as it was pushed up which I've been trying to resolve. Pushed again as 3f54c8b

Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) #62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) #63834 PR-URL: #64062

Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) nodejs#63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) nodejs#63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) nodejs#62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) nodejs#64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) nodejs#63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) nodejs#63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) nodejs#63834 PR-URL: nodejs#64062

Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) #62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) #63834 PR-URL: #64062

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://github.com/nodejs/node) | stage | minor | `24.16.0-trixie` → `24.18.0-trixie` | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.18.0`](https://github.com/nodejs/node/releases/tag/v24.18.0): 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxa [Compare Source](nodejs/node@v24.17.0...v24.18.0) ##### Notable Changes - \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) - \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#64004](nodejs/node#64004) - \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) - \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#62527](nodejs/node#62527) - \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) - \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) - \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155) - \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079) - \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#63834](nodejs/node#63834) ##### Commits - \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) - \[[`9ff36e40f0`](nodejs/node@9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#62755](nodejs/node#62755) - \[[`7c22ee23aa`](nodejs/node@7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#63588](nodejs/node#63588) - \[[`2551abdb4a`](nodejs/node@2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#62761](nodejs/node#62761) - \[[`e8a55ce9b1`](nodejs/node@e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#62763](nodejs/node#62763) - \[[`ae61cd68f3`](nodejs/node@ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#63363](nodejs/node#63363) - \[[`3d05a1d396`](nodejs/node@3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#63363](nodejs/node#63363) - \[[`f9d10a3f6b`](nodejs/node@f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#63363](nodejs/node#63363) - \[[`e431d93e9e`](nodejs/node@e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#63363](nodejs/node#63363) - \[[`56e2505e48`](nodejs/node@56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) - \[[`3bac77f2a8`](nodejs/node@3bac77f2a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) - \[[`1bff901b09`](nodejs/node@1bff901b09)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) - \[[`4433fca3df`](nodejs/node@4433fca3df)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#63111](nodejs/node#63111) - \[[`b5cf01217a`](nodejs/node@b5cf01217a)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#63111](nodejs/node#63111) - \[[`ce84aef37d`](nodejs/node@ce84aef37d)] - **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan) [#62883](nodejs/node#62883) - \[[`26781689b0`](nodejs/node@26781689b0)] - **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) [#62905](nodejs/node#62905) - \[[`aeea8f4970`](nodejs/node@aeea8f4970)] - **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) [#62706](nodejs/node#62706) - \[[`407cf91656`](nodejs/node@407cf91656)] - **crypto**: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) [#62626](nodejs/node#62626) - \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#62527](nodejs/node#62527) - \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) - \[[`b46d52b283`](nodejs/node@b46d52b283)] - **crypto**: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) [#62499](nodejs/node#62499) - \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) - \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) - \[[`61826df455`](nodejs/node@61826df455)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#63531](nodejs/node#63531) - \[[`16d2fd3c07`](nodejs/node@16d2fd3c07)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280) - \[[`3b8330deda`](nodejs/node@3b8330deda)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576) - \[[`141de35399`](nodejs/node@141de35399)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#63201](nodejs/node#63201) - \[[`b76bfcd4fa`](nodejs/node@b76bfcd4fa)] - **deps**: upgrade npm to 11.16.0 (npm team) [#63602](nodejs/node#63602) - \[[`4ec142314c`](nodejs/node@4ec142314c)] - **deps**: SQLite: cherry-pick [`b869ed6`](nodejs/node@b869ed6) (Junsu Han) [#63525](nodejs/node#63525) - \[[`19e8ce1c36`](nodejs/node@19e8ce1c36)] - **deps**: upgrade npm to 11.15.0 (npm team) [#63463](nodejs/node#63463) - \[[`8a264260e2`](nodejs/node@8a264260e2)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#63217](nodejs/node#63217) - \[[`50c8ff3f94`](nodejs/node@50c8ff3f94)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#62811](nodejs/node#62811) - \[[`6e56f01c4b`](nodejs/node@6e56f01c4b)] - **deps**: V8: cherry-pick [`435a2cd`](nodejs/node@435a2cdf664c) (Matthias Liedtke) [#63136](nodejs/node#63136) - \[[`3ba813b242`](nodejs/node@3ba813b242)] - **deps**: cherry-pick [libuv/libuv@`a43e543`](libuv/libuv@a43e543) (Ali Hassan) [#63222](nodejs/node#63222) - \[[`2390e3a5ac`](nodejs/node@2390e3a5ac)] - **doc**: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) [#63650](nodejs/node#63650) - \[[`52a1c18374`](nodejs/node@52a1c18374)] - **doc**: update `git node land` instructions for security releases (Antoine du Hamel) [#63586](nodejs/node#63586) - \[[`3e6b4da037`](nodejs/node@3e6b4da037)] - **doc**: drop --experimental from --permission (Rafael Gonzaga) [#63583](nodejs/node#63583) - \[[`84d05163b9`](nodejs/node@84d05163b9)] - **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga) [#63479](nodejs/node#63479) - \[[`7da2a4450e`](nodejs/node@7da2a4450e)] - **doc**: fix URL postMessage example in worker\_threads (Kit Dallege) [#62203](nodejs/node#62203) - \[[`3d79bd8b29`](nodejs/node@3d79bd8b29)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#63515](nodejs/node#63515) - \[[`4f4174aace`](nodejs/node@4f4174aace)] - **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) [#63511](nodejs/node#63511) - \[[`388323ca4b`](nodejs/node@388323ca4b)] - **doc**: fix double space in modules.md (Daijiro Wachi) [#63512](nodejs/node#63512) - \[[`5258ccc058`](nodejs/node@5258ccc058)] - **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi) [#63453](nodejs/node#63453) - \[[`43e83e6507`](nodejs/node@43e83e6507)] - **doc**: fix typo in deprecations (Daijiro Wachi) [#63434](nodejs/node#63434) - \[[`f05a61d54c`](nodejs/node@f05a61d54c)] - **doc**: remove unsupported template type from v8.md (René) [#63410](nodejs/node#63410) - \[[`c39d5fc820`](nodejs/node@c39d5fc820)] - **doc**: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) [#62696](nodejs/node#62696) - \[[`398261f911`](nodejs/node@398261f911)] - **doc**: remove the bi-monthly contributor spotlight section (Claudio Wunder) [#62734](nodejs/node#62734) - \[[`fd9e14c405`](nodejs/node@fd9e14c405)] - **doc**: update http2's `push` and `trailers` events with `rawHeaders` param (YuSheng Chen) [#63259](nodejs/node#63259) - \[[`b943ce6933`](nodejs/node@b943ce6933)] - **doc**: remove inactive members from Triagers list (Antoine du Hamel) [#63329](nodejs/node#63329) - \[[`4b9cdfc022`](nodejs/node@4b9cdfc022)] - **doc**: reference correct function in Module docs (Robin Malfait) [#63247](nodejs/node#63247) - \[[`bed84b6df2`](nodejs/node@bed84b6df2)] - **doc**: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) [#63211](nodejs/node#63211) - \[[`32ea70569b`](nodejs/node@32ea70569b)] - **doc**: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) [#63187](nodejs/node#63187) - \[[`4627bcfd82`](nodejs/node@4627bcfd82)] - **doc**: run license-builder (github-actions\[bot]) [#63232](nodejs/node#63232) - \[[`28eba71845`](nodejs/node@28eba71845)] - **doc**: add large pull requests contributing guide (Matteo Collina) [#62829](nodejs/node#62829) - \[[`2648efd438`](nodejs/node@2648efd438)] - **doc**: remove unnecessary `If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/488

…窗口隐藏回归 (#200) * fix(desktop): 覆盖 yauzl>=3.3.1，修复 Node 24.16~24.17 下 electron 解压死锁 Node.js 24.16.0~24.17.x 存在 streams 回归（nodejs/node#63487）， electron postinstall 的解压链 extract-zip@2 → yauzl@2 → fd-slicer@1 在大文件条目上背压死锁、静默退出 0，electron.exe 装不出来， pnpm dev:desktop 报 ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL / "Electron failed to install correctly"；pnpm 构建缓存还会把残缺产物反复回放给后续安装，导致每个新 worktree 都复现。修复：pnpm-workspace.yaml 覆盖 yauzl 到 ^3.3.1（解析为 3.4.0，重写了流处理、不再依赖 fd-slicer），并按错误驱动测试规则新增守卫测试 apps/desktop/test/electron-binary.test.js（校验 override 存在 + electron 二进制完整，缺失时给出修复指引）。参考：electron/forge#4277；Node 上游修复在 24.18.0（nodejs/node#63834），建议本机 Node 升级到 >=24.18.0（有 override 后 Molio 已不受影响）。 * fix(ci): 补上 lockfile 缺失的 @types/[email protected] snapshot yauzl override 重新生成 lockfile 时 importer/packages 段把 @types/react-dom 升到 19.2.4，但 snapshots 段遗留旧的 19.2.3 条目，导致 CI pnpm install --frozen-lockfile 报 ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY，win/mac build-and-test 均失败。本地 frozen-lockfile 重装 + build + typecheck 验证通过。 * fix(desktop): electron 完整性测试适配 macOS 启动器 stub 布局 macOS 上 path.txt 指向的 Contents/MacOS/Electron 是 ~30KB 启动器 stub，真正的引擎在 Electron Framework.framework 里，原 >1MB 断言在 macOS CI 误报 truncated extraction。改为 darwin 下检查 framework 主二进制。 * fix(desktop): 恢复 dev 模式窗口显示 — 修复 #183 后窗口永久隐藏 #183 (33e400f) 为修 ARMS SDK splash→app 双重注入移除了 createWindow() 的共享 ready-to-show handler，生产模式改由 loadApp() 显示窗口，但 dev 模式因此失去了唯一的 show() 调用路径：窗口以 show:false 创建后永远不显示。pnpm dev:desktop 表现为所有进程正常（daemon/vite/renderer 全部就绪）却看不到窗口——DevTools 也停靠在隐藏窗口里。 dev 模式完全跳过 ARMS 初始化，无注入顾虑，在 dev 分支恢复 ready-to-show → show()；生产 loadApp()/错误页显示路径不动。新增 dev-window-show.test.js 回归测试（对修复前源码失败、修复后通过； desktop 全套 208/208 绿）。 Co-Authored-By: Claude <[email protected]> --------- Co-authored-by: yaol <[email protected]> Co-authored-by: Claude <[email protected]>

* stream: copyedit `webstreams/adapter.js` - Simplify `ZLIB_FAILURES` creation. - Cache `cause.code` in `handleKnownInternalErrors` in case of a getter. - Replace `SafePromiseAll` with `SafePromiseAllReturnVoid` to reduce the number of allocated promises. Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63034 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: James M Snell <[email protected]> * build: track PDL files as inputs in inspector GN build The `node_protocol_generated_sources` action was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja to skip regeneration when PDL domain files changed. PR-URL: https://github.com/nodejs/node/pull/62888 Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Kohei Ueno <[email protected]> * tools: use LTS Node.js in notify-on-push workflow Without pinning Node.js, the runner defaults to Node 20 and npx falls back to [email protected] instead of 6.0.0 (requires Node 22+). Version 5 does not recognise the ffi subsystem, causing false invalid-commit alerts. Signed-off-by: Nenad Spasenic <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63084 Fixes: https://github.com/nodejs/node/issues/63070 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> * deps: update amaro to 1.1.9 PR-URL: https://github.com/nodejs/node/pull/63090 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * test_runner: fix failing suite hooks when marked with `todo` Signed-off-by: Moshe Atlow <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63097 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> * doc: fix the TypeScript Execute (tsx) project link Signed-off-by: David Thornton <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63093 Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: René <[email protected]> * quic: start re-enabling quic with openssl 3.5 Start working on re-enabling QUIC support with the availability of OpenSSL 3.5. This will be a multi-step process. Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59249 Reviewed-By: Matteo Collina <[email protected]> * deps: update ngtcp2 to 1.14.0 Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59249 Reviewed-By: Matteo Collina <[email protected]> * deps: update nghttp3 to 1.11.0 Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59249 Reviewed-By: Matteo Collina <[email protected]> * quic: update the guard to check openssl version Since we need to be able to use the openssl adapter provided by the ngtcp2 library, and because that adapter does not include any compile guards to ensure that OpenSSL 3.5 is being used and that the APIs are actually available, we need to add a compile time check for the openssl version in order to conditionally include the adapter to avoid build errors when using a shared openssl library that is not OpenSSL 3.5. Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59249 Reviewed-By: Matteo Collina <[email protected]> * quic: fixup windows coverage compile error PR-URL: https://github.com/nodejs/node/pull/59381 Fixes: https://github.com/nodejs/node/issues/59369 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Richard Lau <[email protected]> * quic: fixup NO_ERROR macro conflict on windows PR-URL: https://github.com/nodejs/node/pull/59381 Fixes: https://github.com/nodejs/node/issues/59369 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Richard Lau <[email protected]> * quic: few additional small comment edits in cid.h Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]> * quic: update more of the quic to the new compile guard Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]> * quic: multiple fixups and updates Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]> * quic: reduce boilerplate and other minor cleanups While I get that macros aren't the most loved thing in the world, they do help reduce boilerplate, and there's a lot of boilerplate in the QUIC code. This commit cleans up some of that boilerplate, particularly around the use of v8 APIs. PR-URL: https://github.com/nodejs/node/pull/59342 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]> * src: cleanup quic TransportParams class PR-URL: https://github.com/nodejs/node/pull/59884 Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Tim Perry <[email protected]> * src: fix small compile warning in quic/streams.cc Fixes: https://github.com/nodejs/node/issues/60110 PR-URL: https://github.com/nodejs/node/pull/60118 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> * deps: update nghttp3 to 1.13.1 PR-URL: https://github.com/nodejs/node/pull/60046 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * deps: update nghttp3 to 1.14.0 PR-URL: https://github.com/nodejs/node/pull/61187 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * quic: copy options.certs buffer instead of detaching The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: https://github.com/nodejs/node/pull/61403 Refs: https://github.com/nodejs/node/pull/61372 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> * quic: fix a handful of bugs and missing functionality Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode/Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62387 Reviewed-By: Stephen Belanger <[email protected]> * quic: update http3 impl details Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode/Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62387 Reviewed-By: Stephen Belanger <[email protected]> * quic: fixup linting/formatting issues Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode/Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62387 Reviewed-By: Stephen Belanger <[email protected]> * quic: use arena allocation for packets Previously Packets were ReqWrap objects with a shared free-list. This commit changes to a per-Endpoint arena with no v8 involvement. This is the design I originally had in mind but I initially went with the simpler freelist approach to get something working. There's too much overhead in the reqrap/freelist approach and individual packets do not really need to be observable via async hooks. This design should eliminate the risk of memory fragmentation and eliminate a significant bottleneck in the hot path. Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62589 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> * quic: move quic behind compile time flag Move node:quic behind a compile-time flag, disabled by default. Use --experimental-quic at configure time to enable. - Add --experimental-quic flag to configure.py - Add node_use_quic variable and HAVE_QUIC define - Make QUIC sources conditional in node.gyp - Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi - Update C++ guards to check HAVE_QUIC - Update process.features.quic to check node_use_quic PR-URL: https://github.com/nodejs/node/pull/61444 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> * quic: implement rapidhash for hashing improvements Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62620 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Tim Perry <[email protected]> * src: add permission support to config file PR-URL: https://github.com/nodejs/node/pull/60746 Backport-PR-URL: https://github.com/nodejs/node/pull/62760 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Xuguang Mei <[email protected]> * test: improve config-file permission test coverage Refs: https://github.com/nodejs/node/pull/60746#pullrequestreview-3470430664 PR-URL: https://github.com/nodejs/node/pull/60929 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * src: expose help texts into node-config-schema.json PR-URL: https://github.com/nodejs/node/pull/58680 Reviewed-By: Marco Ippolito <[email protected]> * test_runner: update node-config-schema PR-URL: https://github.com/nodejs/node/pull/58680 Reviewed-By: Marco Ippolito <[email protected]> * doc: fix node-config-schema PR-URL: https://github.com/nodejs/node/pull/61596 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Pietro Marchini <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * meta: bump actions/download-artifact from 8.0.0 to 8.0.1 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62549 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * quic: apply multiple TLS context improvements and SNI support Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62620 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Tim Perry <[email protected]> * quic: support multiple ALPN negotiation Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62620 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Tim Perry <[email protected]> * quic: fixup token verification to handle zero expiration Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/62620 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Tim Perry <[email protected]> * util: colorize text with hex colors PR-URL: https://github.com/nodejs/node/pull/61556 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Jordan Harband <[email protected]> Reviewed-By: René <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Claudio Wunder <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * quic: add QuicEndpoint.listening & QuicStream.destroy() and tests Starting to explore and cover the existing implementation, this covers the basic endpoint & stream lifecycle and the exposed properties. Added endpoint.listening to match net.Server and round out endpoint properties, and stream.destroy() which is already called by quicSession.destroy() and documented, but didn't actually exist. Signed-off-by: Tim Perry <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62648 Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: James M Snell <[email protected]> * tools: add a check for clean git tree after tests Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62661 Refs: https://github.com/nodejs/node/issues/62646 Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Filip Skokan <[email protected]> * src: clean up experimental flag variables - `fetch` is no longer disable by a CLI flag - `node:sqlite` requires SQLite, obviously Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62759 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Geoffrey Booth <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Xuguang Mei <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> * fs: add followSymlinks option to glob PR-URL: https://github.com/nodejs/node/pull/62695 Reviewed-By: Moshe Atlow <[email protected]> * doc: fix duplicate word "to to" in util.styleText PR-URL: https://github.com/nodejs/node/pull/62917 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Daeyeon Jeong <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> * test: update WPT for streams to f8f26a372f PR-URL: https://github.com/nodejs/node/pull/62864 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Daeyeon Jeong <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * test: update WPT for url to 258f285de0 PR-URL: https://github.com/nodejs/node/pull/63087 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Matteo Collina <[email protected]> * repl: keep reference count for `process.on('newListener')` When investigating a memory leak in one of our applications, we discovered that this listener holds on to a `REPLServer` instance and all heap objects transitively kept alive by it by capturing as part of its closure. It's cleaner to declare the listener outside of the `REPLServer` class and to actually clean it up properly when it is no longer required or meaningful, which is easily achieved through keeping a reference count. PR-URL: https://github.com/nodejs/node/pull/61895 Backport-PR-URL: https://github.com/nodejs/node/pull/63194 Reviewed-By: Antoine du Hamel <[email protected]> * crypto: remove Argon2 KDF derivation from its job setup Signed-off-by: Filip Skokan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62863 Backport-PR-URL: https://github.com/nodejs/node/pull/63173 Fixes: https://github.com/nodejs/node/issues/62861 Reviewed-By: Antoine du Hamel <[email protected]> * crypto: reject unintended raw key format string input Signed-off-by: Filip Skokan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62974 Backport-PR-URL: https://github.com/nodejs/node/pull/63173 Reviewed-By: Antoine du Hamel <[email protected]> * doc: fix typos and inconsistencies in crypto.md and webcrypto.md Signed-off-by: Filip Skokan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62828 Backport-PR-URL: https://github.com/nodejs/node/pull/63173 Reviewed-By: Antoine du Hamel <[email protected]> * crypto: deduplicate and canonicalize CryptoKey usages Fixes: https://github.com/nodejs/node/issues/62899 Signed-off-by: Filip Skokan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62902 Backport-PR-URL: https://github.com/nodejs/node/pull/63173 Fixes: https://github.com/nodejs/node/issues/62899 Reviewed-By: Antoine du Hamel <[email protected]> * inspector: initial support storage inspection PR-URL: https://github.com/nodejs/node/pull/61139 Backport-PR-URL: https://github.com/nodejs/node/pull/63176 Reviewed-By: Antoine du Hamel <[email protected]> * inspector: auto collect webstorage data PR-URL: https://github.com/nodejs/node/pull/62145 Backport-PR-URL: https://github.com/nodejs/node/pull/63176 Reviewed-By: Antoine du Hamel <[email protected]> * inspector: return errors when CDP protocol event emission fails PR-URL: https://github.com/nodejs/node/pull/62162 Backport-PR-URL: https://github.com/nodejs/node/pull/63176 Reviewed-By: Antoine du Hamel <[email protected]> * inspector: coerce key and value to string in webstorage events Signed-off-by: Ali Hassan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62616 Backport-PR-URL: https://github.com/nodejs/node/pull/63176 Refs: https://github.com/nodejs/node/pull/62145 Refs: https://github.com/nodejs/node/pull/62162 Reviewed-By: Antoine du Hamel <[email protected]> * test: generate `localstorage.db` in a temp dir Co-Authored-By: Antoine du Hamel <[email protected]> Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62660 Backport-PR-URL: https://github.com/nodejs/node/pull/63176 Reviewed-By: Antoine du Hamel <[email protected]> * deps: V8: cherry-pick 657d8de27427 Original commit message: [maglev] Fix throwing node inside eager inlining This commit refactors the exception handling logic to correctly identify and associate nodes with their respective `catch` blocks, even when multiple levels of inlining are involved. Previously, the check `!IsInsideTryBlock() && !is_eager_inline()` was insufficient to determine if catch block inside `CatchDetails` was already created. Specifically, consider the case where: 1. Function `bar` is non-eagerly inlined into `foo`. 2. `foo` contains a `catch` block. 3. `bar` calls `in_bar`, which is eagerly inlined. 4. A node within `in_bar` can `throw`. In this scenario, `is_eager_inline` would be true when compiling `in_bar`, leading to an incorrect assumption that the catch block didn't exist yet. This change addresses the issue by propagating a boolean value via `CatchDetails`. This boolean accurately indicates whether a `catch` block is present in the call chain, allowing for correct exception handling regardless of inlining depth or eagerness. Fixed: 417768368 Change-Id: Ic52f72f302b4dc644bdcad939addf98111bc525b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6563500 Commit-Queue: Victor Gomes <[email protected]> Reviewed-by: Darius Mercadier <[email protected]> Cr-Commit-Position: refs/heads/main@{#100380} Refs: https://github.com/v8/v8/commit/657d8de274276c940d07203ee43d3cf4c732cebd PR-URL: https://github.com/nodejs/node/pull/62784 Reviewed-By: Xuguang Mei <[email protected]> * test_runner: support test order randomization PR-URL: https://github.com/nodejs/node/pull/61747 Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> * test_runner: publish to TracingChannel for OTel instrumentation Signed-off-by: Moshe Atlow <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62502 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * test_runner: add `testId` to test events Signed-off-by: Moshe Atlow <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62772 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> * deps: update corepack to 0.35.0 PR-URL: https://github.com/nodejs/node/pull/63375 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> * 2026-05-21, Version 24.16.0 'Krypton' (LTS) Notable changes: crypto: * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553 debugger: * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713 fs: * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775 * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) https://github.com/nodejs/node/pull/62277 http: * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082 * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541 stream: * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098 test_runner: * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747 * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820 * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751 util: * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556 PR-URL: https://github.com/nodejs/node/pull/63263 * Working on v24.16.1 PR-URL: https://github.com/nodejs/node/pull/63263 * deps: update undici to 7.28.0 PR-URL: https://github.com/nodejs/node/pull/63703 Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * deps: fix aix implicit declaration in OpenSSL This seems like a bug in AIX header files because the examples show including the headers but upon inspecting these files there are no declarations for sendmmsg and others: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine For now we can claim to not have these functions. Alternatively we can declare these ourselves if we are AIX 7.2 or newer. The actual functions look to be available in libc. GCC also has the same implicit function declaration but it happily moves forward. Clang started making this an explict error in clang 16: https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16 PR-URL: https://github.com/nodejs/node/pull/62656 Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> * deps: upgrade openssl sources to openssl-3.5.7 PR-URL: https://github.com/nodejs/node/pull/63820 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Filip Skokan <[email protected]> * deps: update archs files for openssl-3.5.7 PR-URL: https://github.com/nodejs/node/pull/63820 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Filip Skokan <[email protected]> * deps: update nghttp2 to 1.69.0 PR-URL: https://github.com/nodejs/node/pull/62891 Backport-PR-URL: https://github.com/nodejs/node/pull/63164 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> * deps: fix integration issues with the latest nghttp2 This is a set of src & tests fixes for nghttp2 due to changes in v1.67.0+ which require a selection of changes to how we handle low-level protocol errors when using the latest versions of nghttp2, changing both some src error handling and updating some tests to match. Signed-off-by: Tim Perry <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62891 Backport-PR-URL: https://github.com/nodejs/node/pull/63164 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Refs: https://hackerone.com/reports/3658225 CVE-ID: CVE-2026-48937 * deps: update llhttp to 9.4.2 PR-URL: https://github.com/nodejs-private/node-private/pull/890 Reviewed-By: Tobias Nießen <[email protected]> * lib,test: redact proxy credentials in tunnel errors Refs: https://hackerone.com/reports/3720313 Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs-private/node-private/pull/867 Reviewed-By: Joyee Cheung <[email protected]> CVE-ID: CVE-2026-48615 * permission: handle process.chdir on writereport Signed-off-by: RafaelGSS <[email protected]> PR-URL: https://github.com/nodejs-private/node-private/pull/870 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48617 Refs: https://hackerone.com/reports/3625987 * tls: normalize hostname for server identity checks Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs-private/node-private/pull/869 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48618 Refs: https://hackerone.com/reports/3688064 * http2: cap originSet size to prevent unbounded memory growth A malicious HTTP/2 server can send repeated ORIGIN frames with unique origins, causing unbounded growth of the client-side originSet for the lifetime of the session. Cap the set at 128 entries; once full, new origins from ORIGIN frames are silently dropped. Refs: https://hackerone.com/reports/3676863 PR-URL: https://github.com/nodejs-private/node-private/pull/855 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48619 * tls: fix case-sensitive SNI context matching The regex constructed by server.addContext() lacked the case-insensitive flag, causing uppercase or mixed-case SNI hostnames from ClientHello to miss their intended context and fall back to the default context. This violates RFC 6066 Section 3, which states that DNS hostnames are case-insensitive. In mTLS configurations with per-tenant contexts, this allowed bypassing client certificate authorization by simply uppercasing the SNI hostname. Add the 'i' flag to the RegExp in addContext() so that SNI matching is case-insensitive. PR-URL: https://github.com/nodejs-private/node-private/pull/857 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48928 Refs: https://hackerone.com/reports/3656869 * dns,net: reject hostnames with embedded NUL bytes Ref: https://hackerone.com/reports/3656716 PR-URL: https://github.com/nodejs-private/node-private/pull/868 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48930 Refs: https://hackerone.com/reports/3656716 * permission: disable FileHandle utimes with permission model PR-URL: https://github.com/nodejs-private/node-private/pull/873 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48935 Refs: https://hackerone.com/reports/3625987 * http: fix response queue poisoning in http.Agent Attach a data guard listener on idle keepAlive sockets in the freeSockets pool. If unsolicited data arrives while the socket is idle, destroy it immediately to prevent response queue poisoning. Refs: https://hackerone.com/reports/3582376 PR-URL: https://github.com/nodejs-private/node-private/pull/846 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48931 Refs: https://hackerone.com/reports/3582376 * crypto: guard WebCrypto cipher output length Reject WebCrypto cipher operations whose computed output length would exceed INT_MAX before passing the length to OpenSSL. This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot cipher paths and turns oversized inputs into a clean operation failure. Refs: https://hackerone.com/reports/3760016 Signed-off-by: Filip Skokan <[email protected]> PR-URL: https://github.com/nodejs-private/node-private/pull/878 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48933 * tls: bind reusable sessions to authenticated host Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895 PR-URL: https://github.com/nodejs-private/node-private/pull/854 Reviewed-By: Antoine du Hamel <[email protected]> CVE-ID: CVE-2026-48934 Refs: https://hackerone.com/reports/3649802 * test: add session reuse host verification regressions Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895 PR-URL: https://github.com/nodejs-private/node-private/pull/854 Reviewed-By: Antoine du Hamel <[email protected]> Refs: https://hackerone.com/reports/3649802 * 2026-06-18, Version 24.17.0 'Krypton' (LTS) This is a security release. Notable changes: * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low PR-URL: https://github.com/nodejs-private/node-private/pull/899 * Working on v24.17.1 PR-URL: https://github.com/nodejs-private/node-private/pull/899 * doc: remove list of versions in `BUILDING.md` Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63113 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: René <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> * doc: document the latest-vX.x schema Signed-off-by: Marco Ippolito <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63033 Reviewed-By: Pietro Marchini <[email protected]> Reviewed-By: James M Snell <[email protected]> * doc: add Hmac.digest() documentation-only deprecation (DEP0206) Signed-off-by: anshikakalpana <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63121 Refs: https://github.com/nodejs/node/issues/62838 Reviewed-By: René <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: James M Snell <[email protected]> * sqlite: keep source database alive during backup Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62673 Reviewed-By: Daniel Lemire <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Edy Silva <[email protected]> Reviewed-By: James M Snell <[email protected]> * module: fix sync hook short-circuit in require() in imported CJS - For imported CJS, if it's not customized by asynchronous hooks, make sure it won't use the quirky re-invented require in all cases. - When the imported CJS module is customized by synchronous hooks, in the synthetic module evalutation step, avoid calling the respective default step again. - Make the branching of loadCJSModuleWithModuleLoad() and loadCJSModuleWithSpecialRequire() more explicit, and fold the tentative fs read in the 'commonjs' translator into the share createCJSModuleWrap() helper instead of checking it twice in the same path. Signed-off-by: Joyee Cheung <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62920 Fixes: https://github.com/nodejs/node/issues/63060 Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> * test: use ERM to destroy sqlite database handles after tests Signed-off-by: Renegade334 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63076 Refs: https://github.com/nodejs/node/issues/63052 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Edy Silva <[email protected]> * doc,sqlite: document entryPoint argument for loadExtension Signed-off-by: geeksilva97 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63152 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: René <[email protected]> * doc: update release steps when post-release fails Signed-off-by: RafaelGSS <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63131 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * tls: add unsupported renegotiation error Map BoringSSL's native renegotiation failure to ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is called. This avoids exposing an implementation-specific OpenSSL error when the TLS backend does not support caller-initiated renegotiation. Signed-off-by: Filip Skokan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63161 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> * quic: remove unused binding variable in session.cc Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63177 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> * doc: clarify SEA platform support excludes darwin-x64 The Platform support section of the single-executable-applications doc listed `macOS` without qualifying which architecture is supported. SEA on x64 macOS is not supported and is skipped in CI; only arm64 macOS is exercised. Refs: https://github.com/nodejs/node/issues/62893 Signed-off-by: mokashang <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63181 Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * doc: remove unnecessary `<!-- eslint-` magic comments Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63200 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Jacob Smith <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> * meta: ignore AI assistants files Ignore CLAUDE.md and AGENTS.md in .gitignore, and exclude them from markdown and ESLint linting. Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62612 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Daijiro Wachi <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> * lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array Follow WHATWG streams spec update: https://github.com/whatwg/streams/pull/1367 ReadableStreamBYOBRequest.view is always constructed as a Uint8Array. This changes the documented return type from ArrayBufferView to Uint8Array per the updated spec. Fixes: https://github.com/nodejs/node/issues/62952 Signed-off-by: Jah-yee <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63017 Reviewed-By: Mattias Buelens <[email protected]> Reviewed-By: Jason Zhang <[email protected]> * doc: add large pull requests contributing guide - Exclude routine dependency/WPT/bot PRs from the policy - Replace design document requirement with detailed PR description - Clarify dependency commit ordering for squash landing - Remove splitting strategies that contradict self-contained PRs - Add links from CONTRIBUTING.md, pull-requests.md, collaborator-guide.md Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62829 Fixes: https://github.com/nodejs/node/issues/62752 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> Reviewed-By: Ruy Adorno <[email protected]> * tools: use different branch for tool updates on staging branches Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63110 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> * debugger: add --help to `node inspect` and improve docs - Add `--help` / `-h` to `node inspect` covering both interactive and non-interactive probe modes. The help text is printed when `--help`/`-h` appears before any positional argument to avoid hijacking `--help` passed to a child script. - Improve the documentation of probe mode and add examples, explain same-location probe coalescing, TDZ caveat for let/const bindings, basename matching and exit code behavior. Also move it to a section parallel to interactive mode. Remove recommendation of evaluating structured expressions as that is prone to missing info in JSON mode. Drive-by: When probe mode exits due to invalid arguments, exit with `kInvalidCommandLineArgument` (9) instead of `kGenericUserError` (1). Signed-off-by: Joyee Cheung <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63201 Reviewed-By: Jan Martin <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Aviv Keller <[email protected]> * deps: cherry-pick libuv/libuv@a43e543 Original commit message: unix: fix pedantic compiler warnings (#5052) Fixes: https://github.com/libuv/libuv/issues/5051 Fixes: https://github.com/nodejs/node/issues/63196 Refs: https://github.com/libuv/libuv/pull/5052 Refs: https://github.com/libuv/libuv/commit/a43e543dbffba93f014fe8360a5edbe8d6ce8500 PR-URL: https://github.com/nodejs/node/pull/63222 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: René <[email protected]> * src,sqlite: remove dead code Signed-off-by: geeksilva97 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63204 Reviewed-By: René <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Jake Yuesong Li <[email protected]> * deps: V8: cherry-pick 435a2cdf664c Original commit message: [wasm] Update WebAssembly.Exception JS API WebIDL specifies the existence of a `WebAssembly.Exception.prototype.stack` getter. WebIDL also expects the constructor to have 2 parameters (plus an optional one). https://webassembly.github.io/spec/js-api/#exceptions Bug: 336347912, 42204334 Change-Id: I128e976a84f942dcf9b93a157534b15fad0f9215 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7697976 Commit-Queue: Matthias Liedtke <[email protected]> Auto-Submit: Matthias Liedtke <[email protected]> Commit-Queue: Clemens Backes <[email protected]> Reviewed-by: Clemens Backes <[email protected]> Cr-Commit-Position: refs/heads/main@{#106215} Refs: https://github.com/v8/v8/commit/435a2cdf664ce02e0c6ea9401fbae600663e47cb PR-URL: https://github.com/nodejs/node/pull/63136 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Mattias Buelens <[email protected]> Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * crypto: improve system certificate enumeration logic on macOS 1) Fixed macOS default for missing kSecTrustSettingsResult When kSecTrustSettingsResult is absent from a trust settings dictionary, Apple specifies kSecTrustSettingsResultTrustRoot as the default value. Previously, the trust result evaluation (deny check, self-issued check, TrustAsRoot check) was inside the block that only executed when kSecTrustSettingsResult was explicitly present. When the key was absent, the function fell through to return UNSPECIFIED, incorrectly rejecting self-signed certificates that should have been trusted via the default. Move the trust result evaluation outside the conditional block so the default value of kSecTrustSettingsResultTrustRoot flows through the same code path as explicit values. This aligns with Chromium's trust_store_mac.cc implementation. 2) Fix CFRelease leak in IsTrustDictionaryTrustedForPolicy: the CFDictionaryRef returned by SecPolicyCopyProperties(policy_ref) was not released when the policy OID matched kSecPolicyAppleSSL. 3) Deduplicate certificates: SecItemCopyMatching can return the same certificate from multiple keychains. 4) Filter expired certificates. Signed-off-by: deepak1556 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62576 Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> * doc: run license-builder PR-URL: https://github.com/nodejs/node/pull/63232 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> * lib: fixes validator message PR-URL: https://github.com/nodejs/node/pull/62823 Reviewed-By: Luigi Pinca <[email protected]> * lib: fix typo idenity => identity PR-URL: https://github.com/nodejs/node/pull/63112 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Aviv Keller <[email protected]> * node-api: support SharedArrayBuffer in napi_create_typedarray Signed-off-by: umuoy1 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62710 Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Vladimir Morozov <[email protected]> * meta: move one or more collaborators to emeritus PR-URL: https://github.com/nodejs/node/pull/63235 Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> * doc: recommend explicitly Tier 1 or 2 for production applications Signed-off-by: Mike McCready <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63187 Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * doc: replace Visual Studio 2022 Evergreen version reference with 17.14 Signed-off-by: Mike McCready <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63211 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Stefan Stojanovic <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> * test: move FFI tests to `NATIVE_SUITES` Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63165 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * doc: reference correct function in Module docs Signed-off-by: Robin Malfait <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63247 Reviewed-By: René <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * tools: fix test426 updater The previous version produces a commit that does pass the linter because of a too-long commit title. Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63271 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * repl: fix dedup comparing normalized line against raw history Signed-off-by: Daijiro Wachi <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62886 Reviewed-By: Luigi Pinca <[email protected]> * test_runner: fix diagnostics channel context tracking Signed-off-by: Moshe Atlow <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63283 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> * http2: validate non-link headers in writeEarlyHints Validate header names and values for non-link hints passed to writeEarlyHints() in the HTTP/2 compat layer using assertValidHeader() and checkIsHttpToken(), consistent with the HTTP/1.1 validation added in https://github.com/nodejs/node/pull/61897. Previously, hints were forwarded into the headers object without any validation, allowing invalid characters in header names/values to surface as opaque errors deeper in the HTTP/2 stack. Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62017 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: James M Snell <[email protected]> * deps: update simdjson to 4.6.4 PR-URL: https://github.com/nodejs/node/pull/62811 Reviewed-By: Antoine du Hamel <[email protected]> * http: add writeInformation to send arbitrary 1xx status codes Signed-off-by: Tim Perry <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63155 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]> * deps: update sqlite to 3.53.1 PR-URL: https://github.com/nodejs/node/pull/63217 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Edy Silva <[email protected]> Reviewed-By: Jithil P Ponnan <[email protected]> * test: avoid initial-break wait in restart-message Signed-off-by: inoway46 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62060 Refs: https://github.com/nodejs/node/issues/61762 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Kohei Ueno <[email protected]> * test: avoid flaky restart sync in debugger exceptions test Signed-off-by: inoway46 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62055 Refs: https://github.com/nodejs/node/issues/61762 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> * stream: remove unnecessary check Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63030 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Gürgün Dayıoğlu <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> * fs: make `Date` properties on `Stats` enumerable Signed-off-by: LiviaMedeiros <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63328 Reviewed-By: René <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * doc: remove inactive members from Triagers list Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63329 Fixes: https://github.com/nodejs/admin/issues/1058 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> * test: relax min assertion in test-performance-eventloopdelay Signed-off-by: marcopiraccini <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63100 Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> * test_runner: avoid hanging on incomplete v8 frames Signed-off-by: Ali Hassan <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62704 Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * test: fix flaky test-watch-mode-inspect timeout This test randomly times out (~120s) on CI due to a race condition between child-process restart (triggered by touching the watched file) and the second inspector-session connection. The old code used an interval-based restart (write every 500ms) and a 'gettingDebuggedPid' flag to pause writes during a session. This still left a race window where getDebuggedPid() would attempt to connect the inspector via HTTP GET /json/list + WebSocket upgrade either before the new child was ready (empty target list) or after the old session was being destroyed, causing the promise to hang. Fix: Replace the interval with a single write that triggers exactly one restart, then wait for the restarted child's 'safe to debug now' stdout line before connecting the second inspector session. This eliminates the race by ensuring the new child process and its inspector session are fully ready before any connection attempt. Removes the now-unused gettingDebuggedPid flag and the pending setTimeout delay that was needed as a backstop for the interval. Fixes: https://github.com/nodejs/node/issues/44898 Signed-off-by: Matteo Collina <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63361 Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> * test: reduce flakiness of `different-registry-per-thread` There was an assumption that the `WeakRef` would be kept alive but it seems to not always be true on Windows. This commit makes sure it's kept alive. Signed-off-by: Antoine du Hamel <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63244 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]> Reviewed-By: Stefan Stojanovic <[email protected]> * test: relax test-memory-usage arrayBuffers check Signed-off-by: inoway46 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63244 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Vinícius Lourenço Claro Cardoso <[email protected]> Reviewed-By: Stefan Stojanovic <[email protected]> * tools: update gyp-next to 0.22.2 PR-URL: https://github.com/nodejs/node/pull/63374 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> * tools: bump the eslint group in /tools/eslint with 4 updates Bumps the eslint group in /tools/eslint with 4 updates: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [@babel/eslint-parser](https://github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser), [@babel/plugin-syntax-import-source](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-syntax-import-source) and [eslint](https://github.com/eslint/eslint). Updates `@babel/core` from 8.0.0-rc.3 to 8.0.0-rc.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/packages/babel-core) Updates `@babel/eslint-parser` from 8.0.0-rc.3 to 8.0.0-rc.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/eslint/babel-eslint-parser) Updates `@babel/plugin-syntax-import-source` from 8.0.0-rc.3 to 8.0.0-rc.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.0-rc.4/packages/babel-plugin-syntax-import-source) Updates `eslint` from 10.2.0 to 10.2.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 8.0.0-rc.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint - dependency-name: "@babel/eslint-parser" dependency-version: 8.0.0-rc.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint - dependency-name: "@babel/plugin-syntax-import-source" dependency-version: 8.0.0-rc.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint - dependency-name: eslint dependency-version: 10.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint ... PR-URL: https://github.com/nodejs/node/pull/63075 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * crypto: align verifyOneShot accepted types Signed-off-by: anshikakalpana <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63280 Fixes: https://github.com/nodejs/node/issues/62903 Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * test: deflake watch mode worker test Trigger watch restarts by appending whitespace instead of rewriting watched modules. This avoids transient empty or partial ESM dependency contents while the restarted worker is loading. Use a separate temporary directory for each subtest so concurrent subtests do not share worker and dependency file names. Signed-off-by: Kamat, Trivikram <[email protected]> Assisted-by: openai:gpt-5.5 PR-URL: https://github.com/nodejs/node/pull/63384 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * test: avoid repeated writes in watch helper Use performFileOperation() for test runner watch updates so the run() API path schedules a single delayed write instead of rewriting the file until the second run completes. Repeated writes can trigger another watch restart while the previous rerun is still active. The runner then terminates the in-flight child process with SIGTERM, which can make the captured output include both a failed file-level subtest and the next successful run. Also count only root summary duration lines when detecting completed runs. Signed-off-by: Kamat, Trivikram <[email protected]> Assisted-by: openai:gpt-5.5 PR-URL: https://github.com/nodejs/node/pull/63386 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * doc: update http2's `push` and `trailers` events with `rawHeaders` param Signed-off-by: Yu-Sheng Chen <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63259 Reviewed-By: Tim Perry <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * doc: remove the bi-monthly contributor spotlight section PR-URL: https://github.com/nodejs/node/pull/62734 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Matteo Collina <[email protected]> * doc: fix article usage before vowel-sound acronyms Several prose references to HTTP, HTTPS, SSL, HPE_HEADER_OVERFLOW and ECMAScript used the article "a" where the acronym starts with a vowel sound and should take "an". The rule is based on pronunciation, not spelling: HTTP is read "aitch-tee-tee-pee", SSL is read "ess-es-el", ECMAScript is read "ek-mah-script", and HPE is read "aitch-pee-ee" — all starting with a vowel sound. Affected files: * doc/api/crypto.md — "disable a SSL 3.0/TLS 1.0 vulnerability" * doc/api/http.md — five occurrences ("a HTTP '400 Bad Request'", "a HTTP '431 Request Header Fields Too Large'", "a HTTP/1.1 102 Processing message", two copies of "use a HTTP parser") plus two references to "a HPE_HEADER_OVERFLOW" * doc/api/http2.md — two code-sample comments reading "// Detects if it is a HTTPS request or HTTP/2" * doc/api/module.md — "compiles a CommonJS, a ECMAScript Module, or a TypeScript module" (only the middle article changes; the adjacent "a CommonJS" and "a TypeScript" are both correct) * doc/api/tls.md — two references to "part of a SSL/TLS handshake" in tlsSocket.getFinished() and tlsSocket.getPeerFinished() No behavior changes, documentation only. Signed-off-by: João Victor Oliveira <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62696 Reviewed-By: Aviv Keller <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Akhil Marsonya <[email protected]> Reviewed-By: Jacob Smith <[email protected]> * test: deflake connection refused proxy tests Use 127.0.0.1:10, matching existing refused-connection tests, instead of binding and releasing an ephemeral port that can be reused before the child process connects. Clear NO_PROXY and no_proxy so local proxy bypass settings do not skip the proxy connection attempt. Signed-off-by: Kamat, Trivikram <[email protected]> Assisted-by: openai:gpt-5.5 PR-URL: https://github.com/nodejs/node/pull/63395 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-15.md#jstest-failure Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * test: disable Maglev in near-heap-limit worker test The test expects the worker to run out of memory during startup while creating the message port. With Maglev enabled, the tiny worker heap can be exhausted earlier while generating deoptimization data, which changes the failure mode. Disable Maglev so the induced OOM reaches the path covered by the test. Signed-off-by: Kamat, Trivikram <[email protected]> Assisted-by: openai:gpt-5.5 PR-URL: https://github.com/nodejs/node/pull/63398 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-18.md#jstest-failure Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Richard Lau <[email protected]> * meta: move one or more collaborators to emeritus PR-URL: https://github.com/nodejs/node/pull/63402 Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Debadree Chatterjee <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> * doc: remove unsupported template type from v8.md Signed-off-by: Renegade334 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63410 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> * Revert "stream: noop pause/resume on destroyed streams" This reverts commit 29b196694c78fa5f2fd7a9cd5083278deb69241d. Signed-off-by: Stewart X Addison <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63834 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Stefan Stojanovic <[email protected]> * test_runner: preserve run duration when using test-rerun Signed-off-by: Moshe Atlow <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63429 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Aviv Keller <[email protected]> * test_runner: show replayed-from-attempt hint in spec reporter Signed-off-by: Moshe Atlow <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63429 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Aviv Keller <[email protected]> * src: expose `node::RegisterContext` to make a node managed context Signed-off-by: Chengzhong Wu <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62322 Reviewed-By: Joyee Cheung <[email protected]> * test: wait for ok before initial break after restart Signed-off-by: inoway46 <[email protected]> PR-URL: https://github.com/nodejs/node/pull/62807 Refs: https://github.com/nodejs/node/issues/61762 Reviewed-By: Luigi Pinca <[email protected]> * doc: fix typo in deprecations Signed-off-by: Daijiro Wachi <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63434 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Chemi Atlow <[email protected]> * meta: add additional gitignore entries Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63267 Reviewed-By: Matteo Collina <[email protected]> * quic: fixup linting issue after other changes Signed-off-by: James M Snell <[email protected]> PR-URL: https://github.com/nodejs/node/pull/63267 Reviewed-By: Matteo Collina <[email protected]> * quic: implement rate limiting for version nego and immediate close Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/63267 Reviewed-By: Matteo Collina <[email protected]> * quic: add reusePort option to QuicEndpoint Signed-off-by: James M Snell <[email protected]> Assisted-by: Opencode:Opus 4.6 PR-URL: https://github.com/nodejs/node/pull/63267 Reviewed-By: Matteo Collina <[email protected]> * stream: fix Writable.toWeb() hang on synchronous drain A race condition in the Writable.toWeb() adapter caused the stream to hang if the underlying Node.js Writable emit…

) Every Playwright job spent a flat 90s on `npx playwright install ffmpeg`, and none of them ended up with a usable ffmpeg. The 2.3MB download finishes in under a second; extraction then hangs until `timeout -k 10 90` reaps it (exit 124, masked by `continue-on-error`). That is a Node 24.16.0 readable-stream change (nodejs/node#62557) colliding with yauzl/fd-slicer never firing `close` after EOF, which hangs extract-zip. It leaves a truncated `ffmpeg-linux` — 5,055,201 bytes against the zip's declared 5,101,056, segfaulting on exec — and no INSTALLATION_COMPLETE marker, so Playwright treated ffmpeg as uninstalled. `video: 'on-first-retry'` has therefore never worked in CI, and every first retry of a flaky test died in browserContext.newPage: exactly the failure the step existed to prevent. Upstream fixed it in Playwright 1.60.0 (microsoft/playwright#40747) and Node reverted it in 24.18.0 (nodejs/node#63834). Node 24.16.0 is pinned in 17 places including the Dockerfiles, so bump Playwright instead — it is a dev dependency, and `^1.56.1` already permitted 1.62.1; only the lockfile pinned it. Staying at or above 1.62.1 also avoids the tsconfig-resolution regressions in 1.62.0. Caching alone could not have fixed this: a cold cache still hangs, and what would have been cached is the corrupt binary. So the ffmpeg download is now restored from cache keyed on the resolved playwright-core version, the install is skipped outright on a hit, and the cache is only saved once the binary is verified to actually execute — a partial extraction can never be promoted into a cache that every later job restores. Per job: 90s to ~0s on a hit, ~2s on a miss.

…ny-avila#15065) Every Playwright job spent a flat 90s on `npx playwright install ffmpeg`, and none of them ended up with a usable ffmpeg. The 2.3MB download finishes in under a second; extraction then hangs until `timeout -k 10 90` reaps it (exit 124, masked by `continue-on-error`). That is a Node 24.16.0 readable-stream change (nodejs/node#62557) colliding with yauzl/fd-slicer never firing `close` after EOF, which hangs extract-zip. It leaves a truncated `ffmpeg-linux` — 5,055,201 bytes against the zip's declared 5,101,056, segfaulting on exec — and no INSTALLATION_COMPLETE marker, so Playwright treated ffmpeg as uninstalled. `video: 'on-first-retry'` has therefore never worked in CI, and every first retry of a flaky test died in browserContext.newPage: exactly the failure the step existed to prevent. Upstream fixed it in Playwright 1.60.0 (microsoft/playwright#40747) and Node reverted it in 24.18.0 (nodejs/node#63834). Node 24.16.0 is pinned in 17 places including the Dockerfiles, so bump Playwright instead — it is a dev dependency, and `^1.56.1` already permitted 1.62.1; only the lockfile pinned it. Staying at or above 1.62.1 also avoids the tsconfig-resolution regressions in 1.62.0. Caching alone could not have fixed this: a cold cache still hangs, and what would have been cached is the corrupt binary. So the ffmpeg download is now restored from cache keyed on the resolved playwright-core version, the install is skipped outright on a hit, and the cache is only saved once the binary is verified to actually execute — a partial extraction can never be promoted into a cache that every later job restores. Per job: 90s to ~0s on a hit, ~2s on a miss.

nodejs-github-bot added needs-ci PRs that need a full CI run. stream Issues and PRs related to Node.js streams. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Jun 10, 2026

sxa marked this pull request as ready for review June 10, 2026 12:56

richardlau approved these changes Jun 10, 2026

View reviewed changes

lpinca approved these changes Jun 10, 2026

View reviewed changes

panva approved these changes Jun 10, 2026

View reviewed changes

marco-ippolito approved these changes Jun 10, 2026

View reviewed changes

mcollina approved these changes Jun 10, 2026

View reviewed changes

aduh95 changed the title ~~Revert "stream: noop pause/resume on destroyed streams"~~ [v24.x] Revert "stream: noop pause/resume on destroyed streams" Jun 10, 2026

RafaelGSS approved these changes Jun 10, 2026

View reviewed changes

MikeMcC399 mentioned this pull request Jun 10, 2026

Node 24.16.0: extract-zip hangs extracting #63487

Closed

drbarq mentioned this pull request Jun 13, 2026

[BUG] Claude Desktop silently hangs installing any local .mcpb with a deflated entry larger than ~16 KB anthropics/claude-code#67865

Closed

3 tasks

StefanStojanovic approved these changes Jun 16, 2026

View reviewed changes

MikeMcC399 mentioned this pull request Jun 16, 2026

Plans for npm 12 nodejs/Release#1161

Closed

silverwind mentioned this pull request Jun 17, 2026

fix(deps): update @playwright/test to 1.60.0 go-gitea/gitea#38144

Merged

aduh95 force-pushed the v24.x-staging branch from 2917464 to f05a61d Compare June 18, 2026 04:27

sxa force-pushed the revert_for_63487.1 branch from a1f17ea to 5b397b5 Compare June 18, 2026 12:19

richardlau added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 18, 2026

github-actions Bot added request-ci-failed Starting CI with the request-ci label failed and requires manual intervention. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Jun 18, 2026

sxa added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 18, 2026

richardlau approved these changes Jun 18, 2026

View reviewed changes

sxa closed this Jun 18, 2026

github-actions Bot mentioned this pull request Jun 19, 2026

2026-06-19, Version 24.18.0 'Krypton' (LTS) #64001

Closed

sxa mentioned this pull request Jun 22, 2026

2026-06-23, Version 24.18.0 'Krypton' (LTS) #64062

Merged

coderabbitai Bot mentioned this pull request Jul 6, 2026

node:stream: restore the destroyed-stream guard in Readable.prototype.pause oven-sh/bun#33467

Merged

This was referenced Jul 17, 2026

Plugin archive installation stalls during extraction daintreehq/daintree#11227

Closed

fix(plugins): abort stalled plugin archive extraction (#11227) daintreehq/daintree#11230

Merged

tmp574 mentioned this pull request Jul 18, 2026

Gradle project generation hangs indefinitely on VS Code 1.128.0 (Node.js 24.17.0) due to extract-zip/Node.js core stream regression microsoft/vscode-spring-initializr#282

Closed

maradwan26 mentioned this pull request Jul 24, 2026

chore(deps): update node.js to v24.18.0 carbon-design-system/carbon#22348

Merged

1 task

xianxh mentioned this pull request Aug 5, 2026

fix(desktop): 修复 dev:desktop 启动失败 — Node 24 electron 安装死锁 + #183 dev 窗口隐藏回归 zhuzhaoyun/Molio#200

Merged

4 tasks

danny-avila mentioned this pull request Aug 21, 2026

🎞️ ci: Fix Playwright ffmpeg Install Hang and Cache the Download danny-avila/LibreChat#15065

Merged

icecreamx10 mentioned this pull request Aug 27, 2026

fix: guard showcase installs from incompatible Node versions lynx-community/lynxtron-examples#77

Merged

Uh oh!

Uh oh!

Conversation

sxa commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jun 10, 2026

Uh oh!

nodejs-github-bot commented Jun 10, 2026

Uh oh!

sxa commented Jun 10, 2026

Uh oh!

sxa commented Jun 10, 2026

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

MikeMcC399 commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Verification

Logs

Uh oh!

nodejs-github-bot commented Jun 11, 2026

Uh oh!

nodejs-github-bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

sxa commented Jun 18, 2026

Uh oh!

MattiasBuelens commented Jun 18, 2026

Uh oh!

sxa commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

sxa commented Jun 10, 2026 •

edited

Loading

MikeMcC399 commented Jun 10, 2026 •

edited

Loading