Update all non-major dependencies #14
No reviewers
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
andras/photos!14
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/all"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
0.4.5→0.4.71.60.0→1.64.125.9.1→25.9.910.4.1→10.14.022.13.0→22.23.43.8.3→3.9.101.100.0→1.107.1^0.34.5→^0.35.017.12.0→17.16.08.60.0→8.72.18.0.14→8.3.54.1.7→4.1.12Release Notes
plausible/analytics (@plausible-analytics/tracker)
v0.4.7Compare Source
v0.4.6Compare Source
microsoft/playwright (@playwright/test)
v1.64.1Compare Source
Bug Fixes
v1.64.0Compare Source
🧰 WebMCP
New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:
Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as
webmcp_<tool>. Pass--no-webmcpto opt out.playwright-cliexposes them as well:🎬 Better videos
Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:
fpsoption in testOptions.video,recordVideoandscreencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
styleoption takes CSS declarations for thepointmarker, the targethighlightand the actiontitle. It replaces thefontSizeoption, which is now deprecated.quality.
playwright-cli.🎯 Test runner
New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain
npx playwright testrun just your favourite one:New
--shufflecommand line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.New
lockoption in test.describe.configure() adds test locks to all tests in a file or a group:New
typeoption oftoHaveScreenshotin testConfig.expect stores all unnamed screenshots as WebP:🪆 Locator.within()
New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":
Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:
New APIs
New page.getByRef() locates an element by its aria ref, such as
e2, reported by page.ariaSnapshot() in the'ai'mode.New option
includeShadowin page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.New option
signCountsets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the currentsignCount, and it is saved and restored together with the credentials in the storage state.New fullConfig.filteredProjects lists the projects that were selected to run after applying the
--projectfilter. It is available in global setup and reporters.New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:
Breaking changes ⚠️
screenproperty is now forwarded from the device descriptors. If you use...devices['Desktop Chrome']and alike,window.screenand media queries now see the emulated screen size. You can opt-out by explicitly settingscreentoundefined:JSX in your test files now follows your
tsconfig.json. Playwright compiles JSX in test files according to thejsx,jsxFactory,jsxFragmentFactoryandjsxImportSourcetsconfig options, and defaults to the automatic runtime fromreact/jsx-runtime.--update-snapshots=missingnow passes the test run. Tests that only create missing snapshots now pass in the'missing'mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called'default'and behaves as before: missing snapshots are written and the test fails.Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with
visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().Browser Versions
This version was also tested against the following stable channels:
v1.63.0Compare Source
🔒 Test locks
Tests that access a shared resource — an external service, a global account setting — can now declare a named
lock.Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:
A test can hold multiple locks, and test.describe() accepts a
lockfor the whole group.Learn more about test locks.
🪟 Locate across frames
page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:
The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.
👁️ Visible-only locators
New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the
:visibleCSS pseudo-class:🧾 Step params and subtitles
Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts
subtitleandparamsoptions for your own steps:Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example,
Clickwith subtitlegetByRole('button').Both are rendered next to the step title in the trace viewer and the HTML report.
🖼️ Aria and screen snapshots in traces
The
snapshotsoption of tracing.start() and the testOptions.trace fixture option now accept anobject selecting what to capture on every action:
With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.
New APIs
Browser and Context
httpCredentialsnow also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.opfsincludes the origin private file system in the storage state, so it can be persisted and restored into later contexts.Locators
mode,depthandboxesoptions.json():Test runner
--add-reportercommand line option appends a reporter on top of the ones configured inplaywright.config, instead of replacing them like--reporterdoes.omitTagsoption for thelist,line,dot,githubandjunitreporters suppresses the tags that are automatically appended to test titles.Command line
npx playwright install --no-removekeeps the browsers of other Playwright installations instead of removing them.npx playwright codegen --http-credentialsrecords against pages behind HTTP authentication.Miscellaneous
perfettoreporter writes a Trace Event Format file for the Perfetto UI orchrome://tracing, rendering the test run as a timeline with a lane per worker.Announcements
@playwright/experimental-ct-react,@playwright/experimental-ct-react17and@playwright/experimental-ct-vuepackages will no longer be updated. Follow the migration guide to move to the stories model introduced in 1.62. Story ids passed to fixtures.mount() can now be typed through the generatedStoriesregistry.Browser Versions
This version was also tested against the following stable channels:
v1.62.1Compare Source
Bug Fixes
v1.62.0Compare Source
🧱 New component testing model
Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
Pass a story type as a template argument to type-check its props, and use
update(props)/unmount()on the returned locator to re-render or tear down within a test.🛑 Cancel operations with AbortSignal
Most operations and web-first assertions now accept a
signaloption that takes anAbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:Providing a signal does not disable the default timeout; pass
timeout: 0to disable it.🖼️ WebP screenshots
expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a
.webpname:page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept
webpas atype, where quality100(the default) is lossless and lower values use lossy compression.🧩 Custom test filtering with Reporter.preprocess()
New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:
🔁 Isolated retries
New testConfig.retryStrategy controls when failed tests are retried.
The default
'immediate'retries as soon as a worker is free;'isolated'runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:New APIs
Browser and Context
credentialsincludes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.Actions
scrolloption ("auto"|"none") on actions to opt out of Playwright's automatic scroll-into-view.Network
Evaluation
Command line & MCP
playwright-cli, runnable vianpx playwright mcpandnpx playwright cli.Reporters
mergeFilesreporter option:Announcements
Browser Versions
This version was also tested against the following stable channels:
v1.61.1Compare Source
Bug Fixes
v1.61.0Compare Source
🔑 WebAuthn passkeys
New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer
navigator.credentials.create()/navigator.credentials.get()ceremonies in the page — no real hardware key required, works in all browsers:You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.
🗃️ Web Storage
New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:
New APIs
Network
Browser and Screencast
artifactsDirin browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.cursorin screencast.showActions() controls the cursor decoration rendered for pointer actions.onFramecallback in screencast.start() now receives atimestampof when the frame was presented by the browser.Test runner
trace: new'on-all-retries','retain-on-first-failure'and'retain-on-failure-and-retries'values. See the video modes table for which runs are recorded and kept in each mode.expect.soft.poll(...).process.argvfrom the runner process, handy for reading custom arguments passed after the--separator.AggregateErroras a separate entry.-Gcommand line shorthand for--grep-invert.🛠️ Other improvements
Browser Versions
This version was also tested against the following stable channels:
eslint/eslint (eslint)
v10.14.0Compare Source
Features
d23a7f9feat: fix property descriptor handling infunc-name-matching(#21400) (xbinaryx)Bug Fixes
4a12580fix: require minimatch10.2.6to avoid vulnerable brace-expansion (#21460) (lumir)827a8f3fix:no-restricted-globalscrash on global objects as property values (#21449) (xbinaryx)161558afix: handle LS, PS and empty hashbang comments (#21419) (lumir)6194939fix:no-invalid-thiscrash onaccessorfields without initializer (#21442) (xbinaryx)9155e14fix: Update @humanfs/node dependency version (#21434) (Nicholas C. Zakas)cb2b9d4fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)5ee3915fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)Documentation
0f94f47docs: removezh-hansfrom docs language switcher (#21437) (lumir)dab466edocs: Update README (GitHub Actions Bot)97431f8docs: replace--rulesdirwith a virtual plugin in custom rules docs (#21452) (Pixel)7697550docs: Update README (GitHub Actions Bot)0c699d5docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)0880666docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)e06fe87docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)Chores
0e2ab70ci: disableeslint-plugin-unicornecosystem test (#21462) (Francesco Trotta)6e3f988chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])a031c40chore: update ecosystem plugins (#21445) (ESLint Bot)67d2ca2chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)276021dchore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])449724echore: update ecosystem plugins (#21420) (ESLint Bot)8ffeb8cchore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])v10.13.0Compare Source
Features
48d5cc4feat: report references inside IIFEs inno-use-before-define(#21238) (Irfan fandi)a39d9fbfeat: addglobalThistono-obj-calls(#21382) (synthex-byte)66ac583feat: checkyield*expressions inno-unsafe-optional-chaining(#21399) (xbinaryx)Bug Fixes
87bd2cefix: avoid redeclaredletwhenno-varandone-varfix together (#21389) (Daniel Pinto)Documentation
4783a68docs: Update README (GitHub Actions Bot)43f0ac9docs: clarify parameter description ingetText(#21287) (lumir)Chores
b59d889chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])95e51a0ci: re-enable@typescript-eslint/typescript-eslintin ecosystem tests (#21410) (Francesco Trotta)317fcb3chore: update ecosystem plugins (#21409) (ESLint Bot)b92decfperf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)47b7063chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])e5aea41chore: update ecosystem plugins (#21390) (ESLint Bot)v10.12.0Compare Source
Features
4618052feat: handle astral letters innew-cap(#21357) (sary)4ec5168feat: allowSourceCode#getText()to accept tokens and comments (#21340) (electrohyun)Bug Fixes
bc51eeefix:prefer-arrow-callbackfalse positive in conditional test (#21373) (Daniel Pinto)bbff86cfix: skip lines with multiple comments inmax-lines-per-function(#21332) (xbinaryx)efc4d6bfix: astral letters inconsistent-return,no-eval,no-invalid-this(#21360) (lumir)93de066fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)02e34fffix: add missing space afterelseincurlyautofix (#21355) (Pixel)b14b8bcfix: correctid-lengthmessage for long private names (#21348) (Pixel)69aac01fix: supportTSFunctionTypeingetFunctionHeadLoc(#21335) (xbinaryx)686630efix:no-loss-of-precisionfalse positive with0.e5(#21337) (sethamus)Documentation
67eb586docs: Update README (GitHub Actions Bot)5370d7edocs: clarifyone-varseparateRequiresmatches anyrequire()call (#21192) (sethamus)8816c1ddocs: Update README (GitHub Actions Bot)3d2e7cedocs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)Chores
152067fchore: update ecosystem plugins (#21362) (ESLint Bot)b56d58echore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])bfaea12perf: cache normalized config globals per languageOptions (#21364) (James Ross)322209eci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)d166567chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])29585cechore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])39d79bachore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])182a6e9chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])f995127chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)b95fb6cchore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])3782dd4chore: update ecosystem plugins (#21342) (ESLint Bot)v10.11.0Compare Source
Features
d136fa4feat: object-shorthand handle quoted properties forignoreConstructors(#21271) (Pavel)397b3b8feat: report unsafe labeledcontinueinno-unsafe-finallyrule (#21316) (electrohyun)d3dd47ffeat: only exemptnew-capbuilt-ins that reference the global (#21290) (sethamus)Bug Fixes
22b09f5fix: ignore__proto__properties inprefer-object-spread(#21311) (xbinaryx)b684bb1fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)26d11bcfix: don't report__proto__properties inobject-shorthand(#21310) (xbinaryx)Documentation
9ecfdc5docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)6c789ffdocs: Update README (GitHub Actions Bot)5997825docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)Chores
520dd77perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)92086c8test: updateEMFILEerror generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)9ac7eb6chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])24310e3chore: update ecosystem plugins (#21324) (ESLint Bot)45ad79eci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])ac74e37chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)c832660chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)f9f88fcchore: update ecosystem plugins (#21308) (ESLint Bot)fc81076ci: add more types integration tests (#20395) (Nitin Kumar)v10.10.0Compare Source
Features
264b434feat: adddandvflags tono-unexpected-multiline(#21305) (Gihyeon Jeong / 정기현)c6cc6c5feat: checkObject.prototypeproperty names innew-cap(#21269) (crimsonjay0)5661fa6feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)Bug Fixes
bb47dc6fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)427ac0afix: use format strings in debug calls (#21247) (Francesco Trotta)9d81532fix: support__proto__in/* exported */comments (#21261) (sethamus)87e0a08fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)8e2cb14fix:new-capfalse positive forUTCcalls withproperties: false(#21275) (Pixel)9f4a364fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)Documentation
2417caddocs: Update README (GitHub Actions Bot)9cecb8adocs: document\ccontrol letter escapes in no-control-regex (#21286) (한국)8724829docs: update compat table links (#21263) (fnx)5634542docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)Chores
b3d876bchore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)1696682ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))2c7f5d6chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])3c753f1chore: update eslint (#21289) (renovate[bot])1c73469chore: update ecosystem plugins (#21280) (ESLint Bot)08a02betest: add error locations tono-extra-boolean-cast(#21266) (lumir)77bb1dbchore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])007e81aci: skip EMFILE test on Node.js 26 (#21265) (lumir)0430280chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)v10.9.1Compare Source
Bug Fixes
1e641c9fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)Documentation
ad74a8ddocs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)Chores
3c3ae53chore: update ecosystem plugins (#21249) (ESLint Bot)v10.9.0Compare Source
Features
08de88efeat: handle underflow in no-loss-of-precision (#21218) (Rithish S)55db479feat: add checkConditionalExpressions tono-unmodified-loop-condition(#21175) (sethamus)Bug Fixes
2ba3025fix: prevent unsafeno-varautofix with hoisted functions (#21213) (sethamus)8e69622fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)684b579fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)Documentation
9ef407adocs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))87f66f4docs: Update README (GitHub Actions Bot)585ef37docs: update architecture documentation (#21112) (Francesco Trotta)f3993b0docs: Update README (GitHub Actions Bot)ffc87d6docs: fix broken links in Further Reading sections (#21203) (Minsu)1a761e1docs: update moved JSX specification links (#21198) (Imran Mustafa)4d00ca4docs: update ESLint peer dependency to^10.0.0in shareable configs (#21202) (lumir)510d1a2docs: Update README (GitHub Actions Bot)Chores
899dbf1chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])9aa3873chore: update ecosystem plugins (#21235) (ESLint Bot)dc1e7a8chore: update ecosystem plugins (#21208) (ESLint Bot)f878d21ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])4891e50ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])v10.8.1Compare Source
Bug Fixes
18eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173) (dongkyu lee)151ba3ffix: false positives ingetter-returnandaccessor-pairs(#21163) (Grit)6898df9fix: ignore meta-property names inid-denylist(#21166) (Pixel)4d7db66fix: ignore meta-property names inid-match(#21167) (Pixel)677214efix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)Documentation
7d0cbf8docs: Update README (GitHub Actions Bot)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183) (Lee Daeun)678c90bdocs: Update README (GitHub Actions Bot)8a10424docs: Update README (GitHub Actions Bot)69bb948docs: Update README (GitHub Actions Bot)Chores
0a14800chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191) (Lazizbek Ergashev)5611035test: add error locations info tono-void(#21185) (Lee Daeun)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])f131c03chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)1f6eddechore: update ecosystem plugins (#21182) (ESLint Bot)d3266fbchore: unpinwebpackdependency (#21172) (Francesco Trotta)65a6519chore: add allowScripts field to package.json (#21092) (GiHoon Noh)22e5256ci: addtriage:nolabel to Dependabot PRs (#21141) (lumir)55c9038ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])7280e78chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])eddbad6test: fix failing ecosystem test foreslint-plugin-unicorn(#21156) (Francesco Trotta)60a178dchore: update ecosystem plugins (#21150) (ESLint Bot)f9f61dctest: add error locations tono-unreachable(#21151) (JIYEON)d086293test: add error locations tono-undef(#21147) (JIYEON)cc01b67test: add error locations tono-useless-catch(#21144) (devoil)688e75echore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)7c1e175test: add error locations torequire-await(#21145) (Grit)588a26dtest: add error locations tono-extra-label(#21139) (dongkyu lee)059aa89test: add error locations tono-useless-concat(#21140) (dongkyu lee)5a452a8test: add error locations tono-const-assign(#21138) (dongkyu lee)v10.8.0Compare Source
Features
2fee9bbfeat: exportConfigObjectfromeslint/config(#21082) (sethamus)Bug Fixes
6b8d2f7fix: escape reserved characters in rule id inhtmlformatter (#21129) (Francesco Trotta)9091071fix: preventno-unreachable-loopcrash when all loop types are ignored (#21116) (Pixel)e23fafefix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)20b5ad0fix: quadratic-time regex inprefer-template(#21096) (Milos Djermanovic)8b6f6c0fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)b2c608cfix: NewExpression with parenthesized callee inpreserve-caught-error(#21083) (Francesco Trotta)Documentation
6ddf858docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)784dfbedocs: Clarifyno-eq-nulldescription (#21120) (Park Harin)7ec733adocs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))92bb13fdocs: replace quake link (#21108) (Jung Hyeon Jun)68eb4a5docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)d28f697docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)eccc68ddocs: correct --suppressions-location option description (#21093) (Ga eun Lee)c5963f7docs: Update README (GitHub Actions Bot)Chores
4fbf46dtest: pinwebpackversion to 5.108.4 (#21137) (Francesco Trotta)2d063e2chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)eccbe7btest: add error locations tono-class-assign(#21123) (devoil)e7d1e43ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])e9d66d0ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])ee225b6test: Add error location details tono-eq-nullrule (#21117) (Park Harin)044a627chore: update minimatch to ^10.2.5 (#21107) (김채영)fb09aa8chore: update ecosystem plugins (#21115) (ESLint Bot)5abd878test: add error locations tono-proto(#21114) (Gihyeon Jeong / 정기현)9715887test: Add error location details tono-div-regex(#21110) (Park Harin)a746ec6test: add error locations tono-new-wrappers(#21109) (Gihyeon Jeong / 정기현)8dde645test: add error locations tono-ex-assign(#21102) (devoil)13ab0ectest: add error locations tono-label-var(#21098) (Gihyeon Jeong / 정기현)a99906ftest: Add error location details tono-delete-varrule (#21105) (Park Harin)c47e8dcchore: add missing backticks tolanguages/js/index.js(#21104) (beeen)0174428chore: add missing backticks totranslate-cli-options.js(#21097) (dongkyu lee)3d36589chore: add missing backticks toserialization.js(#21091) (이규환)dcc9312test: add error locations toeqeqeq(#21090) (Ga eun Lee)2710b18ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))5d2f866chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])d584e31chore: fix failing ecosystem test foreslint-plugin-unicorn(#21084) (Francesco Trotta)bf3eda0chore: update ecosystem plugins (#21079) (ESLint Bot)v10.7.0Compare Source
Features
cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)f8b873afeat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)557fde8feat: support computedNumber.parseIntmember access inradixrule (#21041) (Pixel)0b4a73bfeat: add suggestions to no-compare-neg-zero (#21034) (den$)96cdd42feat: report invalid signed numeric radix values inradixrule (#21030) (Pixel)Bug Fixes
3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069) (Pixel)0d7d70cfix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)75ec753fix: handle static template literals ineqeqeqrule (#21058) (Pixel)b717a22fix: preventeqeqeqnull option from reporting non-equality operators (#21057) (Pixel)e35b05ffix: avoidno-invalid-regexpfalse positive for shadowed RegExp (#21051) (Pixel)a3172b6fix: avoidno-control-regexfalse positive for shadowed RegExp (#21050) (Pixel)d1f637efix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)8859baffix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)a9e5961fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)8a240a7fix: avoid false positives inradixrule for spread arguments (#21044) (Pixel)Documentation
c30d808docs: Update README (GitHub Actions Bot)5139800docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)04174cbdocs: Update README (GitHub Actions Bot)026e130docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)9d42fefdocs: Update README (GitHub Actions Bot)b230159docs: Update README (GitHub Actions Bot)0129972docs: correct**/.jsglob to**/*.jsin config files guide (#21036) (EduardF1)Chores
9489379chore: update dependency @eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])81a4774chore: updates for v9.39.5 release (Jenkins)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071) (Francesco Trotta)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067) (lumir)833ec10chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])7ea106dchore: update ecosystem plugins (#21059) (ESLint Bot)8fb550echore: add prettier update commit to.git-blame-ignore-revs(#21056) (lumir)e4e1166chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])0493f53chore: update prettier to v3.9.0 (#21054) (Pixel)1056a99chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])4d4155dci: run ecosystem tests on pull requests (#21027) (sethamus)993539fchore: update dependency @eslint/json to ^2.0.1 (#21042) (renovate[bot])53f8b69test: add error locations tono-constant-binary-expression(#21039) (lumir)5ab71d5refactor: clean up radix rule internals (#21015) (Pixel)a80a9a4chore: update ecosystem plugins (#21035) (ESLint Bot)7c9a029ci: add Node.js 26 to CI (#20847) (lumir)v10.6.0Compare Source
Features
b1f9106feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)f291007feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)Bug Fixes
6b05784fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)bb9eb2afix: account for shadowedBooleaninno-extra-boolean-cast(#21013) (den$)8fd8741fix: don't report shadowed undefined inradixrule (#21011) (Pixel)5784980fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)9cd1e6dfix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)d4eb2dcfix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)2360464fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)63d52d2fix: restore max-classes-per-file report range (#21002) (Pixel)7feaff0fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)399a2ecfix: don't report inner non-callbacks inmax-nested-callbacks(#20995) (Milos Djermanovic)Documentation
a83683ddocs: Update README (GitHub Actions Bot)f5449f9docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)bea49f7docs: Update README (GitHub Actions Bot)e5f70f9docs: update code-path diagrams (#20984) (Tanuj Kanti)8890c2ddocs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)3eb3d9bdocs: Update README (GitHub Actions Bot)c5bb59cdocs: Update README (GitHub Actions Bot)eb3c97cdocs: fix grammar in prefer-const rule description (#20983) (lumir)Chores
6a42034ci: run ecosystem tests on main branch (#20891) (sethamus)3dbacdbci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])c3abfcachore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)a832320ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)27166e7chore: update ecosystem plugins (#21005) (ESLint Bot)865d76eci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])27a88c9chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)970cea6chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)b482120chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])6993fb3chore: update ecosystem plugins (#20985) (ESLint Bot)v10.5.0Compare Source
Features
5ca8c52feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)b565783feat: report no-with violations at the with keyword (#20971) (Pixel998)2ce032ffeat: report max-lines-per-function violations at function head (#20966) (Pixel998)732cb3efeat: report max-nested-callbacks violations at function head (#20967) (Pixel998)f9c138afeat: report max-depth violations on keywords (#20943) (Pixel998)bdb496cfeat: correct max-depth handling for else-if chains (#20944) (Pixel998)c296873feat: update error loc inmax-statementsto function header (#20907) (Taejin Kim)Documentation
8ae1b5bdocs: Update README (GitHub Actions Bot)ca7eb90docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)f99b47adocs: Update README (GitHub Actions Bot)acf03d4docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)Chores
b18bf58chore: update ecosystem plugins (#20959) (ESLint Bot)c2d1444refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)243b8c5chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)217b2a9test: add unit tests for ParserService (#20949) (Taejin Kim)72003e7test: add location information to error messages inmax-statements(#20945) (lumir)7797c26refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)67c46fachore: update ecosystem plugins (#20938) (ESLint Bot)95d8c7achore: update dependency @eslint/json to v2 (#20934) (renovate[bot])cf9e496chore: update @arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)fb6d396test: run type tests with TypeScript 7 (#20868) (sethamus)nodejs/node (node)
v22.23.4: 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel)0ed4268(Evgenii Kliuchnikov)Commits
68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #6686867d294739f] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#10021ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #6641952b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #6633360f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #6639605470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #6639647333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #6474598258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774e9e295bcc1] - deps: cherry-picke807d4efrom SQLite (Junsu Han) #63525512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #6676519c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#98350ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973a18ec92752] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#10024342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #641454b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855v22.23.3: 2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbolCompare Source
Notable Changes
fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #655422a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #657903909ff2c4a] - node-api: supportSharedArrayBufferinnapi_create_typedarray(Yilong Li) #6271066de6349ad] - node-api: addnapi_create_external_sharedarraybuffer(Ben Noordhuis) #62623Commits
44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #6474671feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #656532a3548e51c] - deps: update undici to 6.28.1 (mcollina) #6579059d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #655423376e27de2] - deps: V8: cherry-picka6eaf75(Camillo Bruni) #65402b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #648844e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #645887d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #6433001855a19d3] - deps: c-ares: cherry-pick8ba37af(René) #6411023fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #633755286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #628106d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324d9cb8468a3] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #63515c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #6419337f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #628357c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #641663909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #6271066de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #6562940eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #6554275098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #6306508b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #6262702cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #629936f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753bc5753d438] - tools: removeenvinfofrom our workflows (Antoine du Hamel) #64259d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #6407038ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #629615fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #65108v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolitoCompare Source
This is a security release.
Notable Changes
Commits
4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#9353fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #6471422efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375251123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9260566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#9270d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @RafaelGSSCompare Source
This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).
Commits
41d2ee13be] - build: switch coverage-windows towindows-2022(Richard Lau) #63940eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #63711a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #628910f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #6289138c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #5878660890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #572695024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #638207f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #626565763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#8680a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8550c37bff2ff] - http2: fix DEP0194 message (KaKa) #58669ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #582939b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#86728dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#8732f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#8701662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854718d5d0e2c] - test: skiptest-fs-utimes-y2K38on armv7 (Richard Lau) #63836041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #62238fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85439d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8572197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolitoCompare Source
Commits
4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #617884a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #621640226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #6225673cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #6215022ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #619281a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #618793ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #61834b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827ffda97afd4] - deps: update googletest to2461743(Node.js GitHub Bot) #6248479aa32cf4f] - deps: update googletest to73a63ea(Node.js GitHub Bot) #61927b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #626293a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #62463ec11f3c1d5] - deps: V8: backport85b3900(Thibaud Michaud) #6278308609712ed] - deps: V8: backport1b27e46(Thibaud Michaud) #62783dcc60d5ab2] - deps: V8: backport9997fc0(Thibaud Michaud) #627831d1f4451fb] - deps: V8: cherry-pickb96e40d(Clemens Backes) #627832268567237] - deps: V8: cherry-pick7cb6188(Thibaud Michaud) #6278392804cdbea] - deps: V8: cherry-picke7ccf0a(Thibaud Michaud) #62783eae2c27a40] - deps: V8: cherry-pick8e214ec(Thibaud Michaud) #62783a1799a49bb] - deps: V8: backport63b8849(Thibaud Michaud) #62783a2df2d8731] - deps: V8: backport3239427(Thibaud Michaud) #62783e3d65c7dca] - deps: V8: backport89dc6ea(Thibaud Michaud) #627835e7db133de] - deps: V8: backport910cb91(Jakob Kummerow) #62783d0c24a28af] - deps: V8: cherry-pickb8f91e5(Thibaud Michaud) #62783d358687824] - deps: V8: cherry-pickcf03d55(Thibaud Michaud) #6278367c8b2c349] - deps: V8: cherry-pick692f3d5(Sébastien Doeraene) #6278371e5a59ffd] - deps: V8: cherry-pickc734674(Manos Koukoutos) #62783f0dbe81c7b] - deps: V8: cherry-pickb2f3aea(Thibaud Michaud) #62783d333f480c3] - deps: V8: cherry-pick5f1342c(Matthias Liedtke) #62783db722725bb] - deps: use npm undici@six tag inupdate-undici.sh(Matteo Collina) #630129b57979d9c] - doc: add Rafael to last security release steward (Rafael Gonzaga) #62423d8075585bf] - doc: add path to vulnerabilities.json mention (Rafael Gonzaga) #623556ec9a70204] - doc: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) #622081fc86fcb6e] - doc: add note (and caveat) formock.moduleabout customization hooks (Jacob Smith) #62075491be80bd9] - doc: add efekrskl as triager (Efe) #6187618558293a3] - doc: fix module.stripTypeScriptTypes indentation (René) #619928e20976522] - doc: explicitly mention Slack handle (Rafael Gonzaga) #6198670b8e6b4fb] - doc: rename invalidfunctionparameter (René) #619424045c76f6c] - doc: clarify status of feature request issues (Antoine du Hamel) #61505c54652f2aa] - doc: remove incorrect mention ofmoduleintypescript.md(Rob Palmer) #618399fad6cedf5] - doc: clarify async caveats forevents.once()(René) #615722f1e5733fe] - doc: update Juan's security steward info (Juan José) #61754a64bdb5068] - doc: fix overstated Date header requirement in response.sendDate (Kit Dallege) #6220602797de923] - doc: fix small environment_variables typo (chris) #62279f22ebdc809] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #620259f4508062a] - doc: fix methods being documented as properties inprocess.md(Antoine du Hamel) #617653ea39ff135] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #61735c22445079b] - doc: fix spacing in process message event (Aviv Keller) #6175632831b5223] - doc: fix broken links of net.md (YuSheng Chen) #61673005508d509] - doc: remove obsolete Boxstarter automated install (Mike McCready) #6178537c2fd6f7d] - esm: fix path normalization infinalizeResolution(Antoine du Hamel) #620801769d74613] - esm: populate separate cache for require(esm) in imported CJS (Joyee Cheung) #59679ee02966ffc] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #617102fdb5ce6cc] - http2: fix FileHandle leak in respondWithFile (sangwook) #61707aa2c1eca04] - lib: fix source map url parse in dynamic imports (Chengzhong Wu) #61990785b00cbeb] - meta: pass release version to release worker (flakey5) #62777447fb9a0b5] - meta: persist sccache daemon until end of build workflows (René) #616395065a0acb3] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #615299a2e21305d] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #61479b9240bc063] - module: fix sync resolve hooks for require with node: prefixes (Joyee Cheung) #610882e91b28aaf] - module: handle null source from async loader hooks in sync hooks (Joyee Cheung) #5992939147c154e] - module: use sync cjs when importing cts (Marco Ippolito) #6007212a2462b2c] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874cf39566277] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948578a9a9230] - src: clamp WriteUtf8 capacity to INT_MAX in EncodeInto (semimikoh) #6262157c3035fec] - stream: fix decoded fromList chunk boundary check (Thomas Watson) #6188457fb008bb8] - test: update tls junk data error expectations (Filip Skokan) #62629363f9a9d18] - test: skiptest-urlon--shared-adabuilds (Antoine du Hamel) #62019daaead342b] - test: simplify encodeInto large buffer regression test (semimikoh) #62621ecfa766b41] - tools: fix auto-start-ci (Antoine du Hamel) #6190017c0a610af] - tools: fix parsing of commit trailers inlint-release-proposalGHA (Antoine du Hamel) #6207789ad7dc63b] - tools: enforce removal oflts-watch-*labels on release proposals (Antoine du Hamel) #616725f9bb8ef0c] - tools: revert tools GHA workflow to ubuntu-latest (Richard Lau) #62024977ef80ac1] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #62574ad8f518a81] - zlib: fix use-after-free when reset() is called during write (Matteo Collina) #62325v22.22.2: 2026-03-24, Version 22.22.2 'Jod' (LTS), @RafaelGSS prepared by @aduh95Compare Source
This is a security release.
Notable Changes
SNICallbackinvocation intry/catch(Matteo Collina) - HighheadersDistinct/trailersDistinct(Matteo Collina) - HighNGHTTP2_ERR_FLOW_CONTROLerror code (RafaelGSS) - Mediumrealpath.native(RafaelGSS) - Lowlib/fs/promises(RafaelGSS) - LowCommits
6f14ee5101] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#80952a52ef619] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#82230a3ab11e2] - (CVE-2026-21717) deps: V8: cherry-pickaac14dd(Joyee Cheung) nodejs-private/node-private#809e3f4d6a42e] - (CVE-2026-21717) deps: V8: backport1361b2a(Joyee Cheung) nodejs-private/node-private#8097dc00fa5f4] - (CVE-2026-21717) deps: V8: backport185f0fe(Joyee Cheung) nodejs-private/node-private#809076acd052d] - (CVE-2026-21717) deps: V8: backport0a8b1cd(snek) nodejs-private/node-private#809963c60a951] - deps: V8: overridedepot_toolsversion (Richard Lau) #62344a688117d5d] - deps: upgrade npm to 10.9.7 (npm team) #62330859c8c761b] - deps: update undici to v6.24.1 (Matteo Collina) #62285d5ed384a2f] - deps: upgrade npm to 10.9.6 (npm team) #62215a2fe9fd81a] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#82173deff77c1] - lib: backport_tls_commonand_tls_wraprefactors (Dario Piotrowicz) #5764306fc3436f6] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795db48d9c675] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#7942a6105a63b] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#83291b970886f] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819v22.22.1: 2026-03-05, Version 22.22.1 'Jod' (LTS)Compare Source
Notable Changes
7b93a65f27] - build: test on Python 3.14 (Christian Clauss) #599836063d888fe] - cli: mark--heapsnapshot-near-heap-limitas stable (Joyee Cheung) #60956d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #614194f42f8c428] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741b6ebf2cd53] - doc: add avivkeller to collaborators (Aviv Keller) #6111535854f424d] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #610945c6a076e5d] - meta: add Renegade334 to collaborators (Renegade334) #60714Commits
5f773488c2] - assert: use a set instead of an array for faster lookup (Ruben Bridgewater) #61076feecbb0eab] - assert,util: fix deep comparison for sets and maps with mixed types (Ruben Bridgewater) #61388096095b127] - benchmark: add SQLite benchmarks (Guilherme Araújo) #61401b5fe481415] - benchmark: use boolean options in benchmark tests (SeokhunEom) #60129fa9faacacb] - benchmark: allow boolean option values (SeokhunEom) #60129ba8714ac21] - benchmark: fix incorrect base64 input in byteLength benchmark (semimikoh) #6084153596de876] - benchmark: use typescript for import cjs benchmark (Joyee Cheung) #60663e8930e9d7c] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #606031155e412b1] - benchmark: add per-suite setup option (Joyee Cheung) #60574e01903d304] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162623a405747] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #602057f5e7b9f7f] - benchmark: add microbench on isInsideNodeModules (Chengzhong Wu) #60991db132b85a8] - bootstrap: initialize http proxy after user module loader setup (Joyee Cheung) #5893866aab9f987] - buffer: let Buffer.of use heap (Сковорода Никита Андреевич) #60503c3cf00c671] - buffer: speed up concat via TypedArray#set (Gürgün Dayıoğlu) #60399f6fad231e9] - build: skip sscache action on non-main branches (Joyee Cheung) #617902145f91f6b] - build: update android-patches/trap-handler.h.patch (Mo Luo) #603695b49759dd8] - build: update devcontainer.json to use paired nix env (Joyee Cheung) #6141424724cde40] - build: fix misplaced comma in ldflags (hqzing) #61294c57a19934e] - build: fix crate vendor file checksums on windows (Chengzhong Wu) #613298659d7cd07] - build: fix inconsistent quoting inMakefile(Antoine du Hamel) #6051144f339b315] - build: remove temporal updater (Chengzhong Wu) #61151d60a6cebd5] - build: update test-wpt-report to use NODE instead of OUT_NODE (Filip Skokan) #6102434ccf187f5] - build: skip build-ci on actions with a separate test step (Chengzhong Wu) #610737b19e101a2] - build: run embedtest with node_g when BUILDTYPE=Debug (Chengzhong Wu) #608509408c4459f] - build: upgrade Python linter ruff, add rules ASYNC,PERF (Christian Clauss) #599842166ec7f0f] - build: use call command when calling python configure (Jacob Nichols) #6009873ef70145d] - build: remove V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE defs (Joyee Cheung) #602967b93a65f27] - build: test on Python 3.14 (Christian Clauss) #59983508ce6ec6c] - build, src: fix include paths for vtune files (Rahul) #59999c89d3cd570] - build,tools: fix addon build deadlock on errors (Vladimir Morozov) #6132140904a0591] - build,win: update WinGet configurations to Python 3.14 (Mike McCready) #614316d6742e7db] - child_process: treat ipc length header as unsigned uint32 (Ryuhei Shima) #613446063d888fe] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #609563d324a0f88] - cluster: fix port reuse between cluster (Ryuhei Shima) #6014140a58709b4] - console: optimize single-string logging (Gürgün Dayıoğlu) #60422d950b151a2] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #614194f42f8c428] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741a87499ae25] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #606628c65cc11e2] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #5995691dc00a2c1] - debugger: fix event listener leak in the run command (Joyee Cheung) #604640781bd3764] - deps: V8: backport6a0a25a(Vivian Wang) #616880cf1f9c3e9] - deps: update googletest to8508785(Node.js GitHub Bot) #61417521b4b1f07] - deps: update sqlite to 3.51.2 (Node.js GitHub Bot) #6133958b9d219a3] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523cbc1e4306d] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #61135db59c35ed8] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #61271c18518ee3c] - deps: update nbytes to 0.1.2 (Node.js GitHub Bot) #61270376df62d63] - deps: update timezone to 2025c (Node.js GitHub Bot) #61138993e905302] - deps: update simdjson to 4.2.4 (Node.js GitHub Bot) #61056b72fd2a5d3] - deps: update googletest to065127f(Node.js GitHub Bot) #61055d765147405] - deps: update sqlite to 3.51.1 (Node.js GitHub Bot) #6089937abe2a7d2] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #6089897241fcb86] - deps: update sqlite to 3.51.0 (Node.js GitHub Bot) #606143669c7b4f4] - deps: update simdjson to 4.2.2 (Node.js GitHub Bot) #607409a056ec89c] - deps: update googletest to1b96fa1(Node.js GitHub Bot) #60739b5803b3ea0] - deps: update minimatch to 10.1.1 (Node.js GitHub Bot) #605435bf99f3d46] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #60646801f187357] - deps: update simdjson to 4.2.1 (Node.js GitHub Bot) #6064403c16e5a4c] - deps: update simdjson to 4.1.0 (Node.js GitHub Bot) #605422ebfc2ca56] - deps: update amaro to 1.1.5 (Node.js GitHub Bot) #60541d24ba4fed6] - deps: update simdjson to 4.0.7 (Node.js GitHub Bot) #598839480a139bf] - deps: update googletest to279f847(Node.js GitHub Bot) #60219635e67379e] - deps: update archs files for openssl-3.5.5 (Node.js GitHub Bot) #61547c7b774047d] - deps: upgrade openssl sources to openssl-3.5.5 (Node.js GitHub Bot) #615475b324d7d7f] - deps: update corepack to 0.34.6 (Node.js GitHub Bot) #61510eef8ba0667] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842490f7c7fb1] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #6064366903ea3b3] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550a2f0b69282] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314c8044a48a6] - deps: V8: backport2e4c5cf(Michaël Zasso) #60654642f518198] - doc: supported toolchain with Visual Studio 2022 only (Mike McCready) #61451625f674487] - doc: move Security-Team from TSC to SECURITY (Rafael Gonzaga) #61495029e32f8ba] - doc: addedrequestOCSPoption totls.connect(ikeyan) #6106468e33dfa89] - doc: restore @ChALkeR to collaborators (Сковорода Никита Андреевич) #61553e016770d62] - doc: update IBM/Red Hat volunteers with dedicated project time (Beth Griggs) #61588ec63954657] - doc: mention constructor comparison in assert.deepStrictEqual (Hamza Kargin) #60253c8e1563a98] - doc: add CVE delay mention (Rafael Gonzaga) #614654b00cf2b54] - doc: include OpenJSF handle for security stewards (Rafael Gonzaga) #614544b73bf5bc8] - doc: clarify process.argv[1] behavior for -e/--eval (Jeevankumar S) #61366d3151df4b3] - doc: remove Windows Dev Home instructions from BUILDING (Mike McCready) #614342323462e35] - doc: clarify TypedArray properties on Buffer (Roman Reiss) #613556c5478c8b2] - doc: note resume build should not be done on node-test-commit (Stewart X Addison) #61373ba4a043103] - doc: refine WebAssembly error documentation (sangwook) #61382cd315ea589] - doc: add deprecation history for url.parse (Eng Zer Jun) #6138942db0c392d] - doc: add marco and rafael in last sec release (Marco Ippolito) #613834c3b680fc7] - doc: packages: example of private import switch to internal (coderaiser) #61343684d15e421] - doc: add esm and cjs examples to node:v8 (Alfredo González) #61328c3f9c7a7d9] - doc: added 'secure' event to tls.TLSSocket (ikeyan) #61066aa9acad5ca] - doc: restore @watilde to collaborators (Daijiro Wachi) #613509cafec084e] - doc: run license-builder (github-actions[bot]) #61348cdb12ccbc6] - doc: document ALPNCallback option for TLSSocket constructor (ikeyan) #61331461c5e65c5] - doc: update MDN links (Livia Medeiros) #61062dde45baeab] - doc: add documentation for process.traceProcessWarnings (Alireza Ebrahimkhani) #5364159a7aeec92] - doc: fix filename typo (Hardanish Singh) #612979a0a40d1ed] - doc: fix typos and grammar inBUILDING.md&onboarding.md(Hardanish Singh) #61267dca7005f9d] - doc: mention --newVersion release script (Rafael Gonzaga) #61255c0dc8ddf85] - doc: correct typo in api contributing doc (Mike McCready) #61260066af38fe1] - doc: add PR-URL requirement for security backports (Rafael Gonzaga) #6125671dd46bd0c] - doc: add reusePort error behavior to net module (mag123c) #61250f6abe3ba33] - doc: note corepack package removal in distribution doc (Mike McCready) #612079059d49d8c] - doc: fix tls.connect() timeout documentation (Azad Gupta) #61079e7b34b76b0] - doc: missingpassed,errorandpassedproperties onTestContext(Xavier Stouder) #611859ae2dcfbb6] - doc: clarify threat model for application-level API exposure (Rafael Gonzaga) #611849902331a7c] - doc: correct options for net.Socket class and socket.connect (Xavier Stouder) #61179a80122d2fe] - doc: document error event on readline InterfaceConstructor (Xavier Stouder) #6117038d73c9cfa] - doc: add a smooth scrolling effect to the sidebar (btea) #5900795c51fa984] - doc: correct invalid collaborator profile (JJ) #61091f5a044763c] - doc: exclude compile-time flag features from security policy (Matteo Collina) #61109b6ebf2cd53] - doc: add @avivkeller to collaborators (Aviv Keller) #6111535854f424d] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #610944932322c29] - doc: add File modes cross-references in fs methods (Mohit Raj Saxena) #60286c84904e047] - doc: add missingzstdto mjs example of zlib (Deokjin Kim) #60915e615b9e2f2] - doc: clarify fileURLToPath security considerations (Rafael Gonzaga) #6088799e384e6d4] - doc: replace column with columnNumber in example ofutil.getCallSites(Deokjin Kim) #608819351bb4d02] - doc: correct spelling in BUILDING.md (Rich Trott) #60875e1f6e7fc4d] - doc: update debuglog examples to use 'foo-bar' instead of 'foo' (xiaoyao) #60867ccbb2d7300] - doc: fix typos in changelogs (Rich Trott) #608551cb2fe8b35] - doc: mark module.register as active development (Chengzhong Wu) #60849ceeb4968a6] - doc: add fullName property to SuiteContext (PaulyBearCoding) #6076256155909dd] - doc: keep sidebar module visible when navigating docs (Botato) #604106b637763d5] - doc: correct concurrency wording in test() documentation (Azad Gupta) #607737183e8ffa1] - doc: clarify that CQ only picks up PRs targetingmain(René) #60731d5d94303be] - doc: clarify license section and add contributor note (KaleruMadhu) #60590e0210c8f53] - doc: correct tls ALPNProtocols types (René) #60143eff87b498a] - doc: remove mention of SMS 2FA (Antoine du Hamel) #60707e77ef94a51] - doc:domain.add()does not accept timer objects (René) #606754fe19c95ea] - doc: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) #60650eece59b6ce] - doc: fix linter issues (Antoine du Hamel) #606366e17e596e4] - doc: correct values/references for buffer.kMaxLength (René) #60305ac327ae9a7] - doc: recommend events.once to manage 'close' event (Dan Fabulich) #60017d9b149ea42] - doc: highlight module loading difference between import and require (Ajay A) #59815f6d62cb22c] - doc: fix typo inprocess.unrefdocumentation (우혁) #596986d5078b196] - doc: add some entries toglossary.md(Mohataseem Khan) #59277b0a5820dea] - doc: improve agent.createConnection docs for http and https agents (JaeHo Jang) #58205b5db02fe67] - doc: fix pseudo code in modules.md (chirsz) #57677e9b912d481] - doc: add missing variable in code snippet (Koushil Mankali) #5547844c06c7812] - doc: add missing word insingle-executable-applications.md(Konstantin Tsabolov) #53864482b43f160] - doc: fix typo in http.md (Michael Solomon) #59354cd323bc718] - doc: update devcontainer.json and add documentation (Joyee Cheung) #60472c7c70f3a16] - doc: add haramj as triager (Haram Jeong) #6034804b8c4d14e] - doc: clarify require(esm) description (dynst) #60520de382dc832] - doc: instantiate resolver object (Donghoon Nam) #60476b6845ce460] - doc: clarify --use-system-ca support status (Joyee Cheung) #603400894dae9bc] - doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny() (Jimmy Leung) #58899c86a69f692] - doc: useanyforworker_threads.Worker'error' event argumenterr(Jonas Geiler) #603000c5031e233] - doc: update decorator documentation to reflect actual policy (Muhammad Salman Aziz) #60288b01f710175] - doc: document wildcard supported by tools/test.py (Joyee Cheung) #60265b4524dabcc] - doc: fixblob.bytes()heading level (XTY) #602525df02776e3] - doc: fix not working code example in vm docs (Artur Gawlik) #602246a4359a0b5] - doc: improve code snippet alternative of url.parse() using WHATWG URL (Steven) #60209ad06bee70d] - doc: use markdown when branch-diff major release (Rafael Gonzaga) #60179c0d4b11ed4] - doc: update teams in collaborator-guide.md and add links (Bart Louwers) #6006520b5ffcac3] - doc: update previous version links in BUILDING (Mike McCready) #61457de345ea3a3] - doc: correct description oferror.stackaccessor behavior (René) #61090d8418d9de7] - doc: fix link in--env-file=filesection (N. Bighetti) #605631107bda21e] - doc: fix v22 changelog after security release (Marco Ippolito) #6137142aab9469a] - doc: add missing history entry forsqlite.md(Antoine du Hamel) #60607deb6d5deff] - doc, module: change async customization hooks to experimental (Gerhard Stöbich) #60302c659add7d1] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708dda95e91b9] - esm: avoid throw when module specifier is not url (Craig Macomber (Microsoft)) #61000912945be89] - events: remove redundant todo (Gürgün Dayıoğlu) #6059522e156eb10] - events: remove eventtarget custom inspect branding (Efe) #61128df6fd9b03f] - fs: remove duplicate getValidatedPath calls (Mert Can Altin) #613596ea3e4d850] - fs: fix errorOnExist behavior for directory copy in fs.cp (Nicholas Paun) #60946dd918b9980] - fs: fix ENOTDIR in globSync when file is treated as dir (sangwook) #612594908e67ba0] - fs: remove duplicate fd validation in sync functions (Mert Can Altin) #613614a27bce3d9] - fs: detect dot files when using globstar (Robin van Wijngaarden) #61012b0186ff65c] - fs: validate statfs path (Efe) #612306689775023] - gyp: aix: change gcc version detection so CXX="ccache g++" works (Stewart X Addison) #614645c4f4db663] - http: fix rawHeaders exceeding maxHeadersCount limit (Max Harari) #612857599e2eccd] - http: replace startsWith with strict equality (btea) #5939499a85213bf] - http: lazy allocate cookies array (Robert Nagy) #597347669e6a5ad] - http: fix http client leaky with double response (theanarkh) #60062f074c126a8] - http,https: fix double ERR_PROXY_TUNNEL emission (Shima Ryuhei) #60699d8ac368363] - http2: add diagnostics channels for client stream request body (Darshan Sen) #60480e26a7e464d] - http2: rename variable to additionalPseudoHeaders (Tobias Nießen) #602085df634f46e] - http2: validate initialWindowSize per HTTP/2 spec (Matteo Collina) #614022ccc9a6205] - http2: do not crash on mismatched ping buffer length (René) #601353e68a5f78a] - inspector: inspect HTTP response body (Chengzhong Wu) #60572a86ffa9a5d] - inspector: add network payload buffer size limits (Chengzhong Wu) #60236ea60ef5d74] - lib: fix typo inutil.jscomment (Taejin Kim) #613659d8d9322a4] - lib: fix TypeScript support check in jitless mode (sangwook) #61382fc26f5c78f] - lib: gbk decoder is gb18030 decoder per spec (Сковорода Никита Андреевич) #610993b87030012] - lib: enforce use ofURLParse(Antoine du Hamel) #610162a7479d4fc] - lib: useFastBufferfor empty buffer allocation (Gürgün Dayıoğlu) #605587cf4c43582] - lib: fix constructor in _errnoException stack tree (SeokHun) #60156f9d87fbfaa] - lib: fix typo in QuicSessionStats (SeokHun) #601558d26ccc652] - lib: remove redundant destroyHook checks (Gürgün Dayıoğlu) #60120705832a1be] - lib,src: isInsideNodeModules should test on the first non-internal frame (Chengzhong Wu) #609916f39ad190b] - meta: do not fast-track npm updates (Antoine du Hamel) #61475a6a0ff9486] - meta: fix typos in issue template config (Daijiro Wachi) #61399ec88c9b378] - meta: label v8 module PRs (René) #6132583143835de] - meta: bump step-security/harden-runner from 2.13.2 to 2.14.0 (dependabot[bot]) #612450802dc663a] - meta: bump actions/setup-node from 6.0.0 to 6.1.0 (dependabot[bot]) #61244587db55796] - meta: bump actions/cache from 4.3.0 to 5.0.1 (dependabot[bot]) #61243262c9d37a6] - meta: bump github/codeql-action from 4.31.6 to 4.31.9 (dependabot[bot]) #61241d9763b5afd] - meta: bump codecov/codecov-action from 5.5.1 to 5.5.2 (dependabot[bot]) #612400af73d1811] - meta: bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 (dependabot[bot]) #612378be6afd239] - meta: move lukekarrys to emeritus (Node.js GitHub Bot) #60985c497de5c74] - meta: bump actions/setup-python from 6.0.0 to 6.1.0 (dependabot[bot]) #60927774920f169] - meta: bump github/codeql-action from 4.31.3 to 4.31.6 (dependabot[bot]) #60926ef3b1e5991] - meta: bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 (dependabot[bot]) #609243ed667379f] - meta: bump github/codeql-action from 4.31.2 to 4.31.3 (dependabot[bot]) #607707c0cefb126] - meta: bump step-security/harden-runner from 2.13.1 to 2.13.2 (dependabot[bot]) #607695c6a076e5d] - meta: add Renegade334 to collaborators (Renegade334) #607144f4dda2a18] - meta: bump actions/download-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #60532c436f8d57c] - meta: bump actions/upload-artifact from 4.6.2 to 5.0.0 (dependabot[bot]) #60531402d9f87a6] - meta: bump github/codeql-action from 3.30.5 to 4.31.2 (dependabot[bot]) #6053361be78e326] - meta: bump actions/setup-node from 5.0.0 to 6.0.0 (dependabot[bot]) #605297e4164a623] - meta: bump actions/stale from 10.0.0 to 10.1.0 (dependabot[bot]) #605281bf6e1d010] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #60325c66fc0e9cf] - meta: loop userland-migrations in deprecations (Chengzhong Wu) #60299e4be0791e7] - meta: callcreate-release-post.ymlpost release (Aviv Keller) #603668674f6527f] - module: preserve URL in the parent created by createRequire() (Joyee Cheung) #6097441db87a975] - msi: fix WiX warnings (Stefan Stojanovic) #60251884f313f40] - node-api: use Node-API in comments (Vladimir Morozov) #61320375164190b] - node-api: use local files for instanceof test (Vladimir Morozov) #60190972a1107c0] - os: freeze signals constant (Xavier Stouder) #61038e992057ab7] - perf_hooks: fix stack overflow error (Antoine du Hamel) #600840bb1814fdf] - repl: fix pasting after moving the cursor to the left (Ruben Bridgewater) #6047035a12fb996] - src: replaceranges::sortfor libc++13 compatibility on armhf (Rebroad) #61789dbf00d4664] - src: add missing override specifier to Clean() (Tobias Nießen) #61429140eba35d3] - src: cache context lookup in vectored io loops (Mert Can Altin) #6138793e7e1708b] - src: use C++ nullptr in webstorage (Tobias Nießen) #61407ef868447bc] - src: fix pointer alignment (jhofstee) #61336a96256524c] - src: dump snapshot source with node:generate_default_snapshot_source (Joyee Cheung) #61101ec051b9efd] - src: add HandleScope to edge loop in heap_utils (Mert Can Altin) #6088541749eb5d6] - src: remove redundant CHECK (Tobias Nießen) #6113057c81e5af3] - src: fix off-thread cert loading in bundled cert mode (Joyee Cheung) #607644b0616e024] - src: handle DER decoding errors from system certificates (Joyee Cheung) #6078793393371f9] - src: use static_cast instead of C-style cast (Michaël Zasso) #60868900445b655] - src: move Node-API version detection to where it is used (Anna Henningsen) #605128353a6da2a] - src: avoid C strings in more C++ exception throws (Anna Henningsen) #6059227c860c51f] - src: movenapi_addon_register_functonode_api_types.h(Anna Henningsen) #60512e0517752e7] - src: remove unconditional NAPI_EXPERIMENTAL in node.h (Chengzhong Wu) #6034521e2a52f8e] - src: clean up generic counter implementation (Anna Henningsen) #60447aed23cb8ca] - src: add enum handle for ToStringHelper + formatting (Burkov Egor) #568292e93650ebc] - src: fix timing of snapshot serialize callback (Joyee Cheung) #60434ece4acc18f] - src: add COUNT_GENERIC_USAGE utility for tests (Joyee Cheung) #6043431c8e9d9ff] - src: use cached primordials_string (Sohyeon Kim) #602557f0ffddc14] - src: implement Windows-1252 encoding support and update related tests (Mert Can Altin) #60893c2ba56d6b2] - src,permission: fix permission.has on empty param (Rafael Gonzaga) #60674e55a2b895a] - src,permission: add debug log on is_tree_granted (Rafael Gonzaga) #60668902a78b43c] - stream: fix isErrored/isWritable for WritableStreams (René) #60905221b77cf41] - stream: don't try to read more if reading (Robert Nagy) #6045446d12d826f] - test: skip strace test with shared openssl (Richard Lau) #6198752e6b01a44] - test: marktest-strace-openat-opensslas flaky (Antoine du Hamel) #619214d7468d0e0] - test: skip --build-sea tests on platforms where SEA is flaky (Joyee Cheung) #61504f604b7ae67] - test: fix flaky debugger test (Ryuhei Shima) #58324fc2dc4024b] - test: ensure removeListener event fires for once() listeners (sangwook) #601375fba382816] - test: delay writing the files only on macOS (Luigi Pinca) #6153285cc9e20e4] - test: asserts that import.meta.resolve invokes sync loader hooks (Chengzhong Wu) #6115813831685ca] - test: check util.parseArgs argv parsing with actual process execution (René) #61089ec4b722cb8] - test: remove unneccessary repl magic_mode tests (Dario Piotrowicz) #610535c811106bc] - test: skip sea tests on riscv64 (Stewart X Addison) #611114e4a631c07] - test: mark stringbytes-external-max flaky on AIX (Stewart X Addison) #609959af0787043] - test: update test426 fixtures (Rich Trott) #60982277f16d247] - test: skip SEA inspect test if inspector is not available (Livia Medeiros) #608727dfa8c96bf] - test: useassert.matchfor non-literal regexp tests (René) #6087941e6cd8ce5] - test: fix embedtest in debug windows (Vladimir Morozov) #60806f65147b226] - test: fix debug test crashes caused by sea tests (Vladimir Morozov) #60807a93dff9e92] - test: replace deprecated regex test assertions in http trailers test (Aditya Chopra) #60831f90d5b954f] - test: prefer major GC in cppgc-object teardown (sangwook) #60672e1645cc78d] - test: skip test that cause timeout on IBM i (SRAVANI GUNDEPALLI) #607004f23eba22f] - test: limit the concurrency of WPTRunner for RISC-V (Levi Zim) #60591c2bef6522b] - test: fix test-strace-openat-openssl for RISC-V (Levi Zim) #605884c03a7f864] - test: fix status when compiled without inspector (Antoine du Hamel) #602892ef146a074] - test: apply a delay towatch-mode-kill-signaltests (Joyee Cheung) #60610dc3000c504] - test: async iife in repl (Tony Gorez) #448785e06e84db1] - test: parallelize sea tests when there's enough disk space (Joyee Cheung) #60604940d2752bc] - test: only show overridden env in child process failures (Joyee Cheung) #60556558a5743c6] - test: add more logs to test-esm-loader-hooks-inspect-wait (Joyee Cheung) #6046610fac8de45] - test: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) #605658bc84046be] - test: correct conditional secure heap flags test (Shelley Vohr) #60385ccc805f184] - test: fix flaky test-watch-mode-kill-signal-* (Joyee Cheung) #604431b8274453d] - test: capture stack trace in debugger timeout errors (Joyee Cheung) #604579fcf889279] - test: ensure assertions are reachable intest/async-hooks(Antoine du Hamel) #601507f5230333e] - test: increase debugger waitFor timeout on macOS (Chengzhong Wu) #603670e5ea3b795] - test: fix small compile warning in test_network_requests_buffer.cc (xiaocainiao633) #60281012780c7e8] - test: split test-runner-watch-mode-kill-signal (Joyee Cheung) #60298b53d35a8f8] - test: fix incorrect calculation in test-perf-hooks.js (Joyee Cheung) #60271b8ef464c08] - test: skip sea tests on x64 macOS (Joyee Cheung) #60250a3c4d905da] - test: move sea tests into test/sea (Joyee Cheung) #6025080bec9fd07] - test: skip tests that cause timeouts on IBM i (SRAVANI GUNDEPALLI) #601481d05b44c7c] - test: deflake test-fs-promises-watch-iterator (Luigi Pinca) #600608958096840] - test: deflaketest-repl-paste-big-data(Livia Medeiros) #60975e261a59ca4] - test: add newstartNewREPLSevertesting utility (Dario Piotrowicz) #59964d4a2d8aa8a] - test: skip failing tests when compiled without amaro (Yuki Okita) #608150e407a88bb] - test: skip failing test on macOS 15.7+ (Antoine du Hamel) #60419a253b7b6dc] - tools: switch to ARM runners on GHA jobs (Antoine du Hamel) #619038862c41494] - tools: avoid building twice in coverage jobs (Antoine du Hamel) #618997d11a22802] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #61759d0e7d6cb89] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #61734cf5ddd1811] - tools: use ubuntu-latest runner innotify-on-pushworkflow (Antoine du Hamel) #6174218bcf8e260] - tools: use ubuntu-slim runner in meta GitHub Actions (Tierney Cyren) #61663db76733b55] - tools: update gyp-next to 0.21.1 (Node.js GitHub Bot) #615281dd9d8a3b2] - tools: fix vcbuild lint-js-build (Vladimir Morozov) #61318ec67f8f9b5] - tools: only report commit validation failure on Slack (Antoine du Hamel) #611248e385c8c66] - tools: use sparse-checkout in linter jobs (Antoine du Hamel) #61123aed2e9c8eb] - tools: simplifynotify-on-push(Antoine du Hamel) #6105032680feefb] - tools: fix update-nghttp2 signature verification (Richard Lau) #61035c5f68f41e6] - tools: improve log output ofcreate-release-proposal(Antoine du Hamel) #6102832e0ae0ec7] - tools: fixvcbuild testwhen path contain spaces (stduhpf) #564819e0858e4a2] - tools: do not runtest-linuxworkflow for changes onvcbuild.bat(Antoine du Hamel) #60979fd656a79fc] - tools: disable some new cpplint rules before update (Michaël Zasso) #60901df4df52e67] - tools: don't fetch V8 deps in the source tree (Richard Lau) #60883e5c2fe8d6d] - tools: add temporal updater (Chengzhong Wu) #608287f031e097e] - tools: dump config.gypi as json (Chengzhong Wu) #607945e69488a5a] - tools: bump js-yaml from 4.1.0 to 4.1.1 in /tools/lint-md (dependabot[bot]) #607815119c50931] - tools: bump js-yaml from 4.1.0 to 4.1.1 in /tools/doc in the doc group (dependabot[bot]) #60766a4b073123d] - tools: remove unsupportedcooldownfrom Dependabot config (Antoine du Hamel) #60747a3df6b87bb] - tools: update sccache to v0.12.0 (Michaël Zasso) #607232efbd54a4a] - tools: update gyp-next to 0.21.0 (Node.js GitHub Bot) #60645bb7876e4f9] - tools: replace invalid expression in dependabot config (Riddhi) #60649e444e44d6a] - tools: skip unaffected GHA jobs for changes intest/internet(Antoine du Hamel) #60517a6a0ec107c] - tools: do not use short hashes for deps versioning to avoid collision (Antoine du Hamel) #60407c6e2eed65f] - tools: fix update-icu script (Michaël Zasso) #6052176fb3d123b] - tools: fix linter for semver-major release proposals (Antoine du Hamel) #60481f02889e24e] - tools: fix failing release-proposal linter for LTS transitions (Antoine du Hamel) #604658203df4432] - tools: remove undici from daily wpt.fyi job (Filip Skokan) #60444a58242b666] - tools: add lint rule to ensure assertions are reached (Antoine du Hamel) #6012558e3ef398f] - tools: update gyp-next to 0.20.5 (Node.js GitHub Bot) #60313996494482a] - tools: optimize wildcard execution in tools/test.py (Joyee Cheung) #60266cf84756d0d] - tools: use cooldown property correctly (Rafael Gonzaga) #601345469cb2651] - tools: validate release commit diff as part oflint-release-proposal(Antoine du Hamel) #614401b9eab4a1c] - tools,doc: fix format-md files list (Stefan Stojanovic) #61147b20d9c2ce7] - tools,doc: update JavaScript primitive types to match MDN Web Docs (JustApple) #6058131760b1beb] - typings: add typing for string_decoder (Taejin Kim) #61368d6b908917c] - typings: add missing properties and method in Worker (Woohyun Sung) #602571e8b6d5686] - typings: add missing properties in HTTPParser (Woohyun Sung) #6025727ae9b4a26] - typings: delete undefined property in ConfigBinding (Woohyun Sung) #60257f43c6434e2] - typings: add buffer internalBinding typing (방진혁) #60163e7f954f63a] - url: add fast path to getPathFromURL decoder (Gürgün Dayıoğlu) #60749c149b64473] - url: remove array.reduce usage (Gürgün Dayıoğlu) #607480bd291bff1] - util: optimize toASCIILower function using V8s native toLowerCase (Mert Can Altin) #61107bbc54b3c96] - util: limitinspectto only show own properties (Ruben Bridgewater) #6103278e5fa23c4] - util: fix parseArgs skipping positional arg with --eval and --print (azadgupta1) #60814f75ec19105] - util: assert getCallSites does not invoke Error.prepareStackTrace (Chengzhong Wu) #60922d77da9306c] - util: fix stylize of special properties in inspect (Ge Gao) #604793a4edc8f6d] - util: use more defensive code when inspecting error objects (Antoine du Hamel) #6013925c33af752] - util: mark special properties when inspecting them (Ruben Bridgewater) #601313f98b46716] - vm: make vm.Module.evaluate() conditionally synchronous (Joyee Cheung) #60205f64a691493] - win: upgrade Visual Studio workload from 2019 to 2022 (Jiawen Geng) #603188e04327954] - worker: update code examples fornode:worker_threadsmodule (fisker Cheung) #58264c4440dcc60] - worker: remove not implemented declarations (Artur Gawlik) #60655df4cc62954] - zlib: validate write_result array length (Ryuhei Shima) #61342v22.22.0: 2026-01-13, Version 22.22.0 'Jod' (LTS), @marco-ippolitoCompare Source
This is a security release.
Notable Changes
lib:
lib,permission:
src:
src,lib:
tls:
Commits
6badf4e6f4] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #6099737509c3ff0] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#791eb8e41f8db] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797ebbf942a83] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#7486b4849583a] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760ddadc31f09] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773d4d9f3915f] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#75925d6799df6] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796v22.21.1: 2025-10-28, Version 22.21.1 'Jod' (LTS), @aduh95Compare Source
Commits
af33e8e668] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #598726764ce8756] - benchmark: update count to n in permission startup (Bruno Rodrigues) #598724e8d99f0dc] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59872af0a8ba7f8] - benchmark: adjust dgram offset-length len values (Bruno Rodrigues) #5970878efd1be4a] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59708df72dc96e9] - console,util: improve array inspection performance (Ruben Bridgewater) #60037ef67d09f50] - http: improve writeEarlyHints by avoiding for-of loop (Haram Jeong) #5995823468fd76b] - http2: fix allowHttp1+Upgrade, broken by shouldUpgradeCallback (Tim Perry) #5992456abc4ac76] - lib: optimize priority queue (Gürgün Dayıoğlu) #60039ea5cfd98c5] - lib: implement passive listener behavior per spec (BCD1me) #59995c2dd6eed2f] - process: fix wrong asyncContext under unhandled-rejections=strict (Shima Ryuhei) #6010381a3055710] - process: fix defaultenvforprocess.execve(Richard Lau) #60029fe492c7ace] - process: fix hrtime fast call signatures (Renegade334) #5960076b4cab8fc] - src: bring permissions macros in line with general C/C++ standards (Anna Henningsen) #6005321970970c7] - src: removeAnalyzeTemporaryDtorsoption from .clang-tidy (iknoom) #60008609c063e81] - src: remove unused variables from report (Moonki Choi) #60047987841a773] - src: avoid unnecessary string allocations in SPrintF impl (Anna Henningsen) #600526e386c0632] - src: make ToLower/ToUpper input args more flexible (Anna Henningsen) #60052c3be1226c7] - src: allowstd::string_viewarguments toSPrintF()and friends (Anna Henningsen) #60058764d35647d] - src: remove unnecessarystd::stringerror messages (Anna Henningsen) #600571289ef89ec] - src: remove unnecessary shadowed functions on Utf8Value & BufferValue (Anna Henningsen) #60056d1fb8a538d] - src: avoid unnecessary string ->char*-> string round trips (Anna Henningsen) #6005554b439fb5a] - src: filloptions_args,options_envafter vectors are finalized (iknoom) #59945c7c597e2ca] - src: use RAII for uv_process_options_t (iknoom) #59945b928ea9716] - test: ensure that the message event is fired (Luigi Pinca) #59952e4b95a5158] - test: replace diagnostics_channel stackframe in output snapshots (Chengzhong Wu) #600244206406694] - test: mark test-web-locks skip on IBM i (SRAVANI GUNDEPALLI) #5999626394cd5bf] - test: expand tls-check-server-identity coverage (Diango Gavidia) #60002b58df47995] - test: fix typo of test-benchmark-readline.js (Deokjin Kim) #59993af3a59dba8] - test: verify tracing channel doesn't swallow unhandledRejection (Gerhard Stöbich) #59974cee362242b] - timers: fix binding fast call signatures (Renegade334) #5960040fea57fdd] - tools: add message on auto-fixing js lint issues in gh workflow (Dario Piotrowicz) #59128aac90d351b] - tools: verify signatures when updating nghttp* (Antoine du Hamel) #601139fae03c7d9] - tools: use dependabot cooldown and move tools/doc (Rafael Gonzaga) #5997881548abdf6] - wasi: fix WasiFunction fast call signature (Renegade334) #59600v22.21.0: 2025-10-20, Version 22.21.0 'Jod' (LTS), @aduh95Compare Source
Notable Changes
1486fedea1] - (SEMVER-MINOR) cli: add--use-env-proxy(Joyee Cheung) #59151bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch underNODE_USE_ENV_PROXY(Joyee Cheung) #57165af8b5fa29d] - (SEMVER-MINOR) http: addshouldUpgradeCallbackto let servers control HTTP upgrades (Tim Perry) #5982442102594b1] - (SEMVER-MINOR) http,https: add built-in proxy support inhttp/https.requestandAgent(Joyee Cheung) #58980686ac49b82] - (SEMVER-MINOR) src: add percentage support to--max-old-space-size(Asaf Federman) #59082Commits
a71dd592e3] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #5969616c4b466f4] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #5983653cb9f3b6c] - build: add the missing macro definitions for OpenHarmony (hqzing) #59804ec5290fe01] - build: do not include custom ESLint rules testing in tarball (Antoine du Hamel) #598091486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #591511f93913446] - crypto: usereturn awaitwhen returning Promises from async functions (Renegade334) #59841f488b2ff73] - crypto: use async functions for non-stub Promise-returning functions (Renegade334) #59841aed9fd5ac4] - crypto: avoid calls topromise.catch()(Renegade334) #5984137c2d186f0] - deps: update amaro to 1.1.4 (pmarchini) #6004428aea13419] - deps: update archs files for openssl-3.5.4 (Node.js GitHub Bot) #60101ddbc1aa0bb] - deps: upgrade openssl sources to openssl-3.5.4 (Node.js GitHub Bot) #60101badbba2da9] - deps: update googletest to50b8600(Node.js GitHub Bot) #5995548aaf98a08] - deps: update archs files for openssl-3.5.3 (Node.js GitHub Bot) #59901e02a562ea6] - deps: upgrade openssl sources to openssl-3.5.3 (Node.js GitHub Bot) #599017e0e86cb92] - deps: upgrade npm to 10.9.4 (npm team) #6007491dda5facf] - deps: update undici to 6.22.0 (Matteo Collina) #601123a3220a2f0] - dgram: restore buffer optimization in fixBufferList (Yoo) #5993409bdcce6b8] - diagnostics_channel: fix race condition with diagnostics_channel and GC (Ugaitz Urien) #59910b3eeb3bd13] - doc: provide alternative tourl.parse()using WHATWG URL (Steven) #597361ddaab1904] - doc: mention reverse proxy and include simple example (Steven) #597363b3b71e99c] - doc: mark.envfiles support as stable (Santeri Hiltunen) #59925d37f67d1bd] - doc: remove optional title prefixes (Aviv Keller) #60087ca2dff63f9] - doc: fix typo on child_process.md (Angelo Gazzola) #601143fca564a05] - doc: add automated migration info to deprecations (Augustin Mauroy) #600224bc366fc16] - doc: use "WebAssembly" instead of "Web Assembly" (Tobias Nießen) #599544808dbdd9a] - doc: fix typo in section on microtask order (Tobias Nießen) #59932d6e303d645] - doc: update V8 fast API guidance (René) #589990a3a3f729e] - doc: add security escalation policy (Ulises Gascón) #598068fd669c70d] - doc: type improvement of filehttp.md(yusheng chen) #581899833dc6060] - doc: rephrase dynamic import() description (Nam Yooseong) #592242870a73681] - doc,crypto: update subtle.generateKey and subtle.importKey (Filip Skokan) #5985185818db93c] - fs,win: do not add a second trailing slash in readdir (Gerhard Stöbich) #59847bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #57165af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824758271ae66] - http: optimize checkIsHttpToken for short strings (방진혁) #5983242102594b1] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980a33ed9bf96] - inspector: ensure adequate memory allocation forBinary::toBase64(René) #5987034c686be2b] - lib: update inspect output format for subclasses (Miguel Marcondes Filho) #5968712e553529c] - lib: add source map support for assert messages (Chengzhong Wu) #59751d2a70571f8] - lib,src: refactor assert to load error source from memory (Chengzhong Wu) #5975120a9e86b5d] - meta: move Michael to emeritus (Michael Dawson) #60070c591cca15c] - meta: bump github/codeql-action from 3.30.0 to 3.30.5 (dependabot[bot]) #60089090ba141b1] - meta: bump codecov/codecov-action from 5.5.0 to 5.5.1 (dependabot[bot]) #60091a0ba6884a5] - meta: bump actions/stale from 9.1.0 to 10.0.0 (dependabot[bot]) #600920feca0c541] - meta: bump actions/setup-node from 4.4.0 to 5.0.0 (dependabot[bot]) #600937cd2b42d18] - meta: bump step-security/harden-runner from 2.12.2 to 2.13.1 (dependabot[bot]) #600941f3b9d66ac] - meta: bump actions/cache from 4.2.4 to 4.3.0 (dependabot[bot]) #600950fedbb3de7] - meta: bump ossf/scorecard-action from 2.4.2 to 2.4.3 (dependabot[bot]) #6009604590b8267] - meta: bump actions/setup-python from 5.6.0 to 6.0.0 (dependabot[bot]) #600902bf0a9318f] - meta: add .npmrc with ignore-scripts=true (Joyee Cheung) #59914e10dc7b81c] - module: allow overriding linked requests for a ModuleWrap (Chengzhong Wu) #595272237142369] - module: link module with a module request record (Chengzhong Wu) #588866d24b88fbc] - node-api: added SharedArrayBuffer api (Mert Can Altin) #590714cc84c96f4] - node-api: make napi_delete_reference use node_api_basic_env (Jeetu Suthar) #59684e790eb6b50] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #5985799ea08dc43] - repl: add isValidParentheses check before wrap input (Xuguang Mei) #59607e4a4f63019] - sqlite: fix crash session extension callbacks with workers (Bart Louwers) #5984842c5544b97] - src: assert memory calc for max-old-space-size-percentage (Asaf Federman) #59460686ac49b82] - (SEMVER-MINOR) src: add percentage support to --max-old-space-size (Asaf Federman) #5908284701ff668] - src: clear all linked module caches once instantiated (Chengzhong Wu) #591178e182e561f] - src: remove unnecessaryEnvironment::GetCurrent()calls (Moonki Choi) #59814c9cde35c4d] - src: simplify is_callable by making it a concept (Tobias Nießen) #58169892b425ee1] - src: rename private fields to follow naming convention (Moonki Choi) #5992336b68db7f5] - src: reduce the nearest parent package JSON cache size (Michael Smith) #5988826b40bad02] - src: replace FIXED_ONE_BYTE_STRING with Environment-cached strings (Moonki Choi) #5989134dcb7dc32] - src: create strings inFIXED_ONE_BYTE_STRINGas internalized (Anna Henningsen) #598264d748add05] - src: removestd::arrayoverload ofFIXED_ONE_BYTE_STRING(Anna Henningsen) #59826bb6fd7c2d1] - src: ensurev8::Eternalis empty before setting it (Anna Henningsen) #598257a91282bf9] - src: use simdjson::pad (0hm☘️) #59391ba00875f01] - stream: use new AsyncResource instead of bind (Matteo Collina) #59867ebec3ef68b] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #589807067d79fb3] - test: mark sea tests flaky on macOS x64 (Richard Lau) #60068ca1942c9d5] - test: testcase demonstrating issue 59541 (Eric Rannaud) #59801660d57355e] - test,doc: skip --max-old-space-size-percentage on 32-bit platforms (Asaf Federman) #6014419a7b1ef26] - tls: load bundled and extra certificates off-thread (Joyee Cheung) #59856095e7a81fc] - tls: only do off-thread certificate loading on loading tls (Joyee Cheung) #59856c42c1204c7] - tools: fixtools/make-v8.shfor clang (Richard Lau) #59893b632a1d98d] - tools: skip test-internet workflow for draft PRs (Michaël Zasso) #598176021c3ac76] - tools: copyeditbuild-tarball.yml(Antoine du Hamel) #59808ef005d0c9b] - typings: update 'types' binding (René) #5969228ef564ecd] - typings: remove unused imports (Nam Yooseong) #59880f88752ddb6] - url: replaced slice with at (Mikhail) #5918124c224960c] - url: add type checking to urlToHttpOptions() (simon-id) #59753f2fbcc576d] - util: fix debuglog.enabled not being present with callback logger (Ruben Bridgewater) #598586277058e43] - vm: sync-ify SourceTextModule linkage (Chengzhong Wu) #590005bf21a4309] - vm: explain how to share promises between contexts w/ afterEvaluate (Eric Rannaud) #59801312b33a083] - vm: "afterEvaluate", evaluate() return a promise from the outer context (Eric Rannaud) #598011eadab863c] - win,tools: add description to signature (Martin Costello) #59877816e1befb1] - zlib: reduce code duplication (jhofstee) #57810v22.20.0: 2025-09-24, Version 22.20.0 'Jod' (LTS), @richardlauCompare Source
Notable Changes
OpenSSL updated to 3.5.2
For official Node.js builds, or builds using the default build configuration, Node.js now bundles OpenSSL 3.5.2. This update allows Node.js 22.x to be supported through to the planned End-of-Life date of 2027-04-30 as the previously bundled OpenSSL 3.0.x goes out of support in September 2026.
This change does not affect third-party builds of Node.js that link to an external OpenSSL (or OpenSSL-compatible) library.
Other notable changes
5b83e1e0a2] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #5957134b25fd97b] - doc: stabilize --disable-sigusr1 (Rafael Gonzaga) #59707bf41218ed9] - doc: markpath.matchesGlobas stable (Aviv Keller) #595721dbad2058f] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315062e837d5f] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #59455b8066611c3] - inspector: add http2 tracking support (Darshan Sen) #596119b7dd40da8] - (SEMVER-MINOR) sea: implement execArgvExtension (Joyee Cheung) #5956048bfbd3dca] - (SEMVER-MINOR) sea: support execArgv in sea config (Joyee Cheung) #59314cf06e74076] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #5946462bb80c17e] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #584389e2aa23be9] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #59428Commits
b7b78fd565] - assert: cap input size in myersDiff to avoid Int32Array overflow (Haram Jeong) #595789da50a6c53] - benchmark: sqlite prevent create both tables on prepare selects (Bruno Rodrigues) #597094c1538770e] - benchmark: calibrate config array-vs-concat (Rafael Gonzaga) #59587fc3f82d683] - benchmark: calibrate config v8/serialize.js (Rafael Gonzaga) #59586e95c9b2950] - benchmark: reduce readfile-permission-enabled config (Rafael Gonzaga) #59589e4fea38b31] - benchmark: calibrate length of util.diff (Rafael Gonzaga) #59588c5d68c4a0f] - benchmark, test: replace CRLF variable with string literal (Lee Jiho) #59466129a1d673b] - build: fix getting OpenSSL version on Windows (Michaël Zasso) #596099f53db7162] - build: fix 'implicit-function-declaration' on OpenHarmony platform (hqzing) #595473839593e07] - build: usewindows-2025runner (Michaël Zasso) #59673e430464669] - build: compile bundled uvwasi conditionally (Carlo Cabrera) #59622e2c9cab0cd] - build: do not set-mminimal-tocwithclang(Richard Lau) #59484208bc810a1] - child_process: remove unsafe array iteration (hotpineapple) #59347d74799d90c] - crypto: load system CA certificates off thread (Joyee Cheung) #595505b83e1e0a2] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #59571d289b1d1af] - deps: V8: cherry-picke3df60f(Chengzhong Wu) #58691cf5d91e2a6] - deps: update uvwasi to 0.0.23 (Node.js GitHub Bot) #597911cf24a0445] - deps: update histogram to 0.11.9 (Node.js GitHub Bot) #596898638bd3f2e] - deps: update googletest toeb2d85e(Node.js GitHub Bot) #593353ff4eb5b37] - deps: update amaro to 1.1.2 (Node.js GitHub Bot) #596164d268ac034] - deps: V8: cherry-pick7b91e3e(Milad Fa) #5948583410eb0e3] - deps: V8: cherry-pick59d52e3(Milad Fa) #594855780af02cb] - deps: update amaro to 1.1.1 (Node.js GitHub Bot) #591412986eca821] - deps: V8: cherry-pick6b1b9bc(zhoumingtao) #5928398e399b3ea] - deps: update archs files for openssl-3.5.2 (Node.js GitHub Bot) #593712b983a7520] - deps: upgrade openssl sources to openssl-3.5.2 (Node.js GitHub Bot) #593717ffbb42454] - deps: update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234bd48a60a75] - deps: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #5923424762a10ca] - deps: fix OpenSSL security level at 1 (Richard Lau) #598591233e92d10] - diagnostics_channel: revoke DEP0163 (René) #5975834b25fd97b] - doc: stabilize --disable-sigusr1 (Rafael Gonzaga) #59707d7adf8be64] - doc: update "Type stripping in dependencies" section (Josh Kelley) #59652a1d7e4fdbf] - doc: add Miles Guicent as triager (Miles Guicent) #59562bf41218ed9] - doc: markpath.matchesGlobas stable (Aviv Keller) #59572afaa1ccb74] - doc: improve documentation for raw headers in HTTP/2 APIs (Tim Perry) #59633b95ff56102] - doc: update install_tools.bat free disk space (Stefan Stojanovic) #595796ff939b8d3] - doc: fix filehandle.read typo (Ruy Adorno) #59635963bfa9d6f] - doc: fix missing link to the Error documentation in thehttppage (Alexander Makarenko) #590800e10a8ea27] - doc: improvesqlite.backup()progress/fulfillment documentation (René) #5959818ceefbabd] - doc: clarify experimental platform vulnerability policy (Matteo Collina) #5959166cdd00368] - doc: link toTypedArray.from()in signature (Aviv Keller) #592269f058ce7c0] - doc: fix typos inenvironment_variables.md(PhistucK) #595363cfec820e9] - doc: add security incident reponse plan (Rafael Gonzaga) #5947046aa3434e6] - doc: clarify maxRSS unit inprocess.resourceUsage()(Alex Yang) #59511adf98f600a] - doc: add missing Zstd strategy constants (RANDRIAMANANTENA Narindra Tiana Annaick) #59312f335989942] - doc: fix the version tls.DEFAULT_CIPHERS was added (Allon Murienik) #592477fa14fcf54] - doc: clarify glob's exclude option behavior (hotpineapple) #5924585b8d255c9] - doc: add RafaelGSS as performance strategic lead (Rafael Gonzaga) #5944516b1f7a602] - doc: add new environment variables doc page (Dario Piotrowicz) #59052b4a43ed83a] - doc: add missing environment variables to manpage (amir lavasani) #58963c923cfe898] - doc: fix links in test.md (Vas Sudanagunta) #58876a93a8b5eda] - doc: mark type stripping as release candidate (Marco Ippolito) #57705d302cb3bb2] - esm: add experimental support for addon modules (Chengzhong Wu) #55844d55c3e7f0b] - esm: link modules synchronously when no async loader hooks are used (Joyee Cheung) #595199e1fbb620f] - esm: show race error message for inner module job race (Joyee Cheung) #595198c4dcd5199] - esm: sync-ify module translation (Joyee Cheung) #5945371038932d3] - fs: fix wrong order of file names in cpSync error message (Nicholas Paun) #597755692dec451] - fs: fix dereference: false on cpSync (Nicholas Paun) #59681dafd561d37] - fs: fix return value of fs APIs (theanarkh) #58996da6e8cb75b] - http: unbreak keepAliveTimeoutBuffer (Robert Nagy) #59784673a48f0a2] - http: use cached '1.1' http version string (Robert Nagy) #597171dbad2058f] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315062e837d5f] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #594554d4fb51b89] - http2: report sent headers object in client stream dcs (Darshan Sen) #59419b8066611c3] - inspector: add http2 tracking support (Darshan Sen) #596119b2c013032] - inspector: prevent propagation of promise hooks to noPromise hooks (Shima Ryuhei) #58841a2329895e7] - lib: fix DOMException subclass support (Chengzhong Wu) #59680edb9248bdd] - lib: make domexception a native error (Chengzhong Wu) #58691ccf29cda19] - Revert "lib: optimize writable stream buffer clearing" (Yoo) #59743f291eda277] - lib: fix isReadable and isWritable return type value (Gabriel Quaresma) #5908910ae8684ea] - lib: revert to using default derived class constructors (René) #596505d3b80d62d] - lib: do not modify prototype deprecated asyncResource (encore) (Szymon Łągiewka) #595183c4541f878] - lib: simplify IPv6 checks in isLoopback() (Krishnadas) #593750b631bbffa] - lib: handle windows reserved device names on UNC (Rafael Gonzaga) #59286297f62ba1f] - meta: bumpcodecov/codecov-action(dependabot[bot]) #597263dcd8446b6] - meta: bump actions/download-artifact from 4.3.0 to 5.0.0 (dependabot[bot]) #59729d0d357f683] - meta: bump github/codeql-action from 3.29.2 to 3.30.0 (dependabot[bot]) #597282a0e264949] - meta: bump actions/cache from 4.2.3 to 4.2.4 (dependabot[bot]) #597270a013d1da1] - meta: bump actions/checkout from 4.2.2 to 5.0.0 (dependabot[bot]) #59725c690b53d24] - meta: update devcontainer to the latest schema (Aviv Keller) #5434761171c7756] - module: correctly detect top-level await in ambiguous contexts (Shima Ryuhei) #5864675bf3f4a87] - node-api: link to other programming language bindings (Chengzhong Wu) #595169a05107558] - node-api: clarify enum value ABI stability (Chengzhong Wu) #59085658c31d60c] - path: refactor path joining logic for clarity and performance (Lee Jiho) #597819cc89f55f7] - path,win: fix bug in resolve and normalize (Hüseyin Açacak) #5562324e825f8f5] - sea: implement sea.getAssetKeys() (Joyee Cheung) #59661c66af21e55] - sea: allow using inspector command line flags with SEA (Joyee Cheung) #595689b7dd40da8] - (SEMVER-MINOR) sea: implement execArgvExtension (Joyee Cheung) #5956048bfbd3dca] - (SEMVER-MINOR) sea: support execArgv in sea config (Joyee Cheung) #593145559456fe4] - sqlite: add sqlite-type symbol for DatabaseSync (Alex Yang) #594053478130da3] - sqlite: handle ?NNN parameters as positional (Edy Silva) #59350312bc4e5d1] - sqlite: avoid useless call to FromMaybe() (Tobias Nießen) #59490937e9bb1c6] - src: track BaseObjects with an efficient list (Chengzhong Wu) #55104be2a5e170d] - src: track async resources via pointers to stack-allocated handles (Anna Henningsen) #59704f232bf2c11] - src: fix build on NetBSD (Thomas Klausner) #59718e9a685bc3d] - src: fix race on process exit and off thread CA loading (Chengzhong Wu) #5963224428fc8fb] - src: add name for more threads (theanarkh) #59601fd7559f8c3] - src: remove JSONParser (Joyee Cheung) #596198c296bac99] - src: enforce assumptions in FIXED_ONE_BYTE_STRING (Tobias Nießen) #581551b4885a3f2] - src: use simdjson to parse --snapshot-config (Joyee Cheung) #594739f798de6b0] - src: fix order of CHECK_NOT_NULL/dereference (Tobias Nießen) #59487f764be27dc] - src: move shared_ptr objects in KeyObjectData (Tobias Nießen) #59472d30287fe12] - src: iterate metadata version entries with std::array (Chengzhong Wu) #57866b2bf620c7b] - src: internalizev8::ConvertableToTraceFormatin traces (Chengzhong Wu) #57866b3c507c8ef] - src: remove duplicate assignment ofO_EXCLin node_constants.cc (Daniel Osvaldo R) #5904920aec239d4] - src: add Intel CET properties to large_pages.S (tjuhaszrh) #593638e0f9cd061] - src: remove unused DSAKeyExportJob (Filip Skokan) #592910c2b6df94f] - src,sqlite: refactor value conversion (Edy Silva) #59659b95cfdf0e5] - stream: replace manual function validation with validateFunction (방진혁) #59529cf06e74076] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #59464903ebd373a] - test: skip more sea tests on Linux ppc64le (Richard Lau) #59755e961060bb6] - test: fix internet/test-dns (Michaël Zasso) #59660c2b22f50a8] - test: mark test-inspector-network-fetch as flaky again (Joyee Cheung) #596404ae958e59b] - test: skip test-fs-cp* tests that are constantly failing on Windows (Joyee Cheung) #59637d5b0a64598] - test: deflake test-http-keep-alive-empty-line (Luigi Pinca) #59595eb311f1754] - test: use mustSucceed in test-repl-tab-complete-import (Sohyeon Kim) #593688e047e32be] - test: skip sea tests on Linux ppc64le (Richard Lau) #595634a250479d8] - test: rename test-net-server-drop-connections-in-cluster.js to -http- (Meghan Denny) #59532d22f113aaf] - test: lazy-load internalTTy (Pietro Marchini) #5951736dd856897] - test: fixtest-setproctitlestatus whenpsis not available (Antoine du Hamel) #59523fd02295da6] - test: update WPT for WebCryptoAPI toff26d9b(Node.js GitHub Bot) #59497cce938c5f9] - test: make test-debug-process locale-independent (BCD1me) #592545a8f03df9e] - test: mark test-wasi-pthread as flaky (Joyee Cheung) #5948894f6d6b969] - test: split test-wasi.js (Joyee Cheung) #59488162ac9393c] - test: use case-insensitive path checking on Windows in fs.cpSync tests (Joyee Cheung) #59475ce9d6776c9] - test: add missing hasPostData in test-inspector-emit-protocol-event (Shima Ryuhei) #59412717ea2866d] - test: refactor error checks to use assert.ifError/mustSucceed (Sohyeon Kim) #59424b1c3e4a17c] - test: fix typos (Lee Jiho) #593303f4bd94b1f] - test: skip test-watch-mode inspect when no inspector (James M Snell) #594408b7a8efe96] - test: exclude mock from coverage (Shima Ryuhei) #59348f39352b55c] - test: split test-fs-cp.js (Joyee Cheung) #59408fb4180e9f6] - test_runner: fix todo inheritance (Moshe Atlow) #5972176bf6b908d] - test_runner: set mock timer's interval undefined (hotpineapple) #594790a05d06fcc] - test_runner: do not error when gettingfullNameof root context (René) #593773fdfb187d6] - test_runner: fix isSkipped check in junit (Sungwon) #5941437c6f7d7d8] - test_runner: remove unused callee convertion (Alex Yang) #5922157c30093e3] - test_runner: clean up promisified interval generation (René) #5882488bf1bab91] - test_runner: correct "already mocked" error punctuation placement (Jacob Smith) #58840d3259d660a] - test_runner: preferAtomicsprimordials (Renegade334) #5871662bb80c17e] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #584384b19439dea] - tools: print appropriate output when test aborted (hotpineapple) #59794847963bbba] - tools: use sparse checkout inbuild-tarball.yml(Antoine du Hamel) #59788ef11d118a4] - tools: remove unused actions frombuild-tarball.yml(Antoine du Hamel) #59787daa0615967] - tools: do not attempt to compress tgz archive (Antoine du Hamel) #59785fdc85e5045] - tools: add v8windbg target (Chengzhong Wu) #5976725801b9009] - tools: improve error handling in node_mksnapshot (James M Snell) #5943792100a813f] - tools: add sccache totest-internetworkflow (Antoine du Hamel) #597205f0090af53] - tools: update gyp-next to 0.20.4 (Node.js GitHub Bot) #5969031ee7fc3e9] - tools: add script to make reviewing backport PRs easier (Antoine du Hamel) #5916145906b0d5c] - tools: update gyp-next to 0.20.3 (Node.js GitHub Bot) #596036197eeee9b] - tools: avoid parsing test files twice (Pietro Marchini) #59526027ae4f67e] - tools: fix return value of try_check_compiler (theanarkh) #5943477682b52a1] - tools: bump @eslint/plugin-kit from 0.3.3 to 0.3.4 in /tools/eslint (dependabot[bot]) #5927191fa83fffd] - tools: disable nullability-completeness warnings (Michaël Zasso) #59392079a68d392] - typings: add typing for 'uv' (방진혁) #59606b8927967d9] - typings: add missing properties in ConfigBinding (Lee Jiho) #595859b66ce5ef7] - typings: add missing URLBinding methods (성우현 | Woohyun Sung) #59468ba5b6597aa] - url: add err.input to ERR_INVALID_FILE_URL_PATH (Joyee Cheung) #59730f660943471] - util: fix numericSeparator with negative fractional numbers (sangwook) #59379aed1b883f1] - util: remove unnecessary template strings (btea) #5920191e9b8d135] - util: remove outdated TODO comment (haramjeong) #59760421ab3c294] - util: use getOptionValue('--no-deprecation') in deprecated() (haramjeong) #597607864ad13bb] - util: hide duplicated stack frames when using util.inspect (Ruben Bridgewater) #59447a2d2003daa] - util: fix error's namespaced node_modules highlighting using inspect (Ruben Bridgewater) #59446f64d0def94] - util: add some additional error classes towellKnownPrototypes(Mark S. Miller) #594569807ffd6a0] - vm: expose import attributes on SourceTextModule.moduleRequests (Chengzhong Wu) #58829f334e2d539] - wasi: fixcleantarget intest/wasi/Makefile(Antoine du Hamel) #595769e2aa23be9] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #59428c5a93a3355] - worker: fix worker name with \0 (theanarkh) #59214a5ed96bb97] - worker: add worker name to report (theanarkh) #5893598cd7e27d4] - worker: add name for worker (theanarkh) #59213v22.19.0: 2025-08-28, Version 22.19.0 'Jod' (LTS), @aduh95Compare Source
Notable Changes
8e2076a24f] - (SEMVER-MINOR) cli: addNODE_USE_SYSTEM_CA=1(Joyee Cheung) #59276e592d739c2] - (SEMVER-MINOR) cli: support${pid}placeholder in--cpu-prof-name(Haram Jeong) #59072cda1dab6e2] - (SEMVER-MINOR) crypto: addtls.setDefaultCACertificates()(Joyee Cheung) #588221f184513e9] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440bace73a173] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113fa9a9e9c69] - (SEMVER-MINOR) esm: unflag--experimental-wasm-modules(Guy Bedford) #57038390a9dc20b] - (SEMVER-MINOR) http: addserver.keepAliveTimeoutBufferoption (Haram Jeong) #59243c12c5343ad] - lib: docs deprecate_http_*(Sebastian Beltran) #59293f57ee3d71f] - (SEMVER-MINOR) net: updatenet.blocklistto allow file save and file management (alphaleadership) #58087035da74c31] - (SEMVER-MINOR) process: addthreadCpuUsage(Paolo Insogna) #564678e697d1884] - (SEMVER-MINOR) zlib: add dictionary support tozstdCompressandzstdDecompress(lluisemper) #59240Commits
73aa0ae37f] - assert: change utils to use index instead of for...of (방진혁) #59278dfe3a11eed] - benchmark: remove deprecated _extend from benchmark (Rafael Gonzaga) #592289b9d30042a] - benchmark: add fs warmup to writefile-promises (Bruno Rodrigues) #59215a663f7f954] - benchmark: add calibrate-n script (Rafael Gonzaga) #591861b9b5bddd6] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #59187d0ac3319f9] - benchmark: add --track to benchmark (Rafael Gonzaga) #591742044968b86] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #591724e519934cb] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #5917107e173d969] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #591708440b6177f] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #591168615ea6db0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #590433deb5361d2] - build: fix node_use_sqlite for GN builds (Shelley Vohr) #590170f0ce63116] - build: remove suppressions.supp (Rafael Gonzaga) #59079b30a2117dc] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #581008e2076a24f] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276e592d739c2] - (SEMVER-MINOR) cli: support${pid}placeholder in --cpu-prof-name (Haram Jeong) #59072b5571047ed] - crypto: prepare webcrypto key import/export for modern algorithms (Filip Skokan) #59284cda1dab6e2] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #5882276dab34fb7] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #5823719d3ed64b6] - deps: update sqlite to 3.50.4 (Node.js GitHub Bot) #5933738bafc59e0] - deps: V8: backport493cb53(Chengzhong Wu) #59238e8da171cc3] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132fd4ba38ab6] - deps: update googletest to7e17b15(Node.js GitHub Bot) #59131f71f427b95] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #5913479c5a8f4d2] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #591340dcc84cf53] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #591331f184513e9] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440f64f5df80e] - doc: fix--use-system-cahistory (Joyee Cheung) #59411e22aeaa38f] - doc: add missing section forsetReturnArraysinsqlite.md(Edy Silva) #59074e44ef07235] - doc: rename x509.extKeyUsage to x509.keyUsage (Filip Skokan) #593322c5d0aac5e] - doc: fix Pbkdf2Params hash attribute heading (Filip Skokan) #59395fde94346e5] - doc: fix missing reference links for server.keepAliveTimeoutBuffer (Lee Jiho) #593569af8bcea58] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #593440edf17198f] - doc: run license-builder (github-actions[bot]) #593437f767a2e38] - doc: correct orthographyeg.→e.g.(Jacob Smith) #59329a46ed50350] - doc: clarify the need of compiler compatible with c++20 (Rafael Gonzaga) #59297212263a305] - doc: clarify release candidate stability index (Filip Skokan) #59295ce93b8b556] - doc: add WDYT to glossary (btea) #59280ebaaf2c67f] - doc: add manpage entry for --use-system-ca (Joyee Cheung) #5927343b5a21916] - doc: add path.join and path.normalize clarification (Rafael Gonzaga) #59262409c66d328] - doc: fix typo intest/common/README.md(Yoo) #59180cbb0a8eb13] - doc: add note on process memoryUsage (fengmk2) #590269892b15d81] - doc: format safely fordoc-kit(Aviv Keller) #59229bace73a173] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113b549deac02] - doc: copyedit SECURITY.md (Rich Trott) #59190ef1bc3f344] - doc: fix broken sentence inURL.parse(Superchupu) #591643c6639e8ec] - doc: improve onboarding instructions (Joyee Cheung) #591596ffaac66bc] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #58917e419d20144] - doc: add Aditi-1400 to collaborators (Aditi Singh) #59157ba380f7bf3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #59111fa1a532f2b] - doc: fix typo in writing-test.md (SeokHun) #591230b93ca3d19] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #590787d747aeac8] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #590500b5613f9fe] - doc: run license-builder (github-actions[bot]) #590561b6b5e72d3] - doc: fix typed list formatting (Aviv Keller) #59019756c7dd639] - doc: refineutil.parseArgsdefaultdefinition (Slayer95) #589580b840523a2] - doc: remove unused import inzlib.md(coderaiser) #590413e9ed4b080] - doc: add stability index to the--watch-kill-signalflag (Dario Piotrowicz) #58997cb08a5d43f] - doc: add missing<code>blocks (Antoine du Hamel) #589954a42360fe5] - doc: add scroll margin to links (Roman Reiss) #589829d073f32da] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #589833cc11fc9ac] - domain: remove deprecated API call (Alex Yang) #59339fa9a9e9c69] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038177ed3b3dd] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #590204619fe0e04] - fs: fix glob TypeError on restricted dirs (Sylphy-0xd3ac) #58674ad2089e32d] - fs: correct error message when FileHandle is transferred (Alex Yang) #59156390a9dc20b] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243659002359d] - http2: set Http2Stream#sentHeaders for raw headers (Darshan Sen) #59244d02831ef73] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077264a838779] - lib: add trace-sigint APIs (theanarkh) #59040d22d2fa6d4] - lib: optimize writable stream buffer clearing (Yoo) #59406a5e9759409] - lib: do not modify prototype deprecated asyncResource (RafaelGSS) #591959254257fc0] - lib: restructure assert to become a class (Miguel Marcondes Filho) #58253946eab8d77] - lib: handle superscript variants on windows device (Rafael Gonzaga) #59261cd857a97b5] - lib: use validateString (hotpineapple) #59296c12c5343ad] - lib: docs deprecate _http_* (Sebastian Beltran) #59293a28e5f0938] - lib: add type names in source mapped stack traces (Chengzhong Wu) #589766aec5aee7c] - lib: prefer AsyncIteratorPrototype primordial (René) #59097e704349858] - lib: fix incorrectArrayBufferPrototypeGetDetachedprimordial type (Dario Piotrowicz) #589782fc25fd400] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #58928446ee98e00] - meta: clarify pr objection process further (James M Snell) #5909646c339e4f3] - meta: add mailmap entry for aditi-1400 (Aditi) #5931670a586261f] - meta: add tsc and build team as codeowners building.md (Rafael Gonzaga) #59298e666e06781] - meta: add nodejs/path to path files (Rafael Gonzaga) #59289251b65dd6c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140c8a7964da8] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #589440eec5cc492] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #590114acf7cd6d3] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957f57ee3d71f] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #580874aefcfc318] - node-api: reword "implementation in an alternative VM" as implementable (Chengzhong Wu) #59036ff6be2ed5d] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #590878d60602677] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #59094035da74c31] - (SEMVER-MINOR) process: add threadCpuUsage (Paolo Insogna) #5646774e1aa4d06] - process: make execve's args argument optional (Allon Murienik) #584123366e60bd9] - src: use simdjson to parse SEA configuration (Joyee Cheung) #5932363cc06977a] - src: mark realm leaf classes final (Anna Henningsen) #59355133d410cd9] - src: use C++20contains()method (iknoom) #5930457fe96fe49] - src: added CHECK_NOT_NULL check for multiple eq_wrap_async (F3lixTheCat) #59267a8f381a6c5] - src: add nullptr checks inStreamPipe::New(Burkov Egor) #576130769e5a0dc] - src: call unmask after install signal handler (theanarkh) #590591e7639e9e1] - src: useFastStringKeyforTrackV8FastApiCall(Anna Henningsen) #591489075a1a4bf] - src: use C++20constevalforFastStringKey(Anna Henningsen) #591485a0fd5689b] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093c637a2c41d] - src: add cache to nearest parent package json (Ilyas Shabi) #590863375a6cfee] - test: deflake sequential/test-tls-session-timeout (Joyee Cheung) #59423438cb11a15] - test: update WPT resources,WebCryptoAPI,webstorage (Filip Skokan) #5931168bec19f76] - test: add known issue test for fs.cpSync dereference bug (James M Snell) #58941a100cce379] - test: deflake stream-readable-to-web test (Ethan Arrowood) #58948b7577d853b] - test: make test-inspector-network-resource sequential (Shima Ryuhei) #59104667ee82443] - test: don't use expose internals in test-http-outgoing-buffer.js (Meghan Denny) #59219feec26d3bb] - test: use mustSucceed in test-fs-read (Sungwon) #59204d7e23769ab] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #581003a9aca91c6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #591583aee7625b9] - test: expand linting rules aroundassertw literal messages (Anna Henningsen) #59147667c2ced38] - test: update WPT for WebCryptoAPI toab08796(Node.js GitHub Bot) #5912989ac344393] - test: update WPT for WebCryptoAPI to19d82c5(Node.js GitHub Bot) #59129d332957ac6] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #59014a23562ff72] - test: updatestartCLIto set--port=0by default (Dario Piotrowicz) #590424a12f5d83b] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #59091ac4f7aa69c] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #589778dd09267e3] - test,crypto: skip unsupported ciphers (Shelley Vohr) #5938845200b43ea] - tools: update coverage GitHub Actions to fixed version (Rich Trott) #595128f2b8b3dc4] - tools: allow selecting test subsystems with numbers in their names (Darshan Sen) #59242f9bc2573dd] - tools: clarify README linter error message (Joyee Cheung) #59160cba0de128d] - tools: add support for URLs to PR commits inmerge.sh(Antoine du Hamel) #59162039949ef5b] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #591196a8a73aa35] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #59037d0f40f3a3a] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #589929d801a3f00] - typings: improve internal binding types (Nam Yooseong) #593516dbda6cb25] - typings: improve internal binding types (Michaël Zasso) #59176e22dddf859] - util: respect nested formats in styleText (Alex Yang) #59098491f390515] - worker: add cpuUsage for worker (theanarkh) #591778e697d1884] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240v22.18.0: 2025-07-31, Version 22.18.0 'Jod' (LTS), @aduh95Compare Source
Notable Changes
Type stripping is enabled by default
Node.js will be able to execute TypeScript files without additional configuration:
There are some limitations in the supported syntax documented at
https://nodejs.org/api/typescript.html#type-stripping.
This feature is experimental and is subject to change. Disable it by passing
--no-experimental-strip-typesCLI flag.Contributed by Marco Ippolito in #56350.
Other notable changes
26f3711228] - (SEMVER-MINOR) deps: update amaro to 1.1.0 (Node.js GitHub Bot) #56350d80ef2a71f] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #587198ab24d21c9] - doc: add islandryu to collaborators (Shima Ryuhei) #58714430e66b9b8] - (SEMVER-MINOR) esm: implementimport.meta.main(Joe) #5780462f7926b6a] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #5849065f19a00c3] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853ccca1517f9] - (SEMVER-MINOR) sqlite: add support forreadBigIntsoption in db connection level (Miguel Marcondes Filho) #5869748003e87e8] - (SEMVER-MINOR) src,permission: add support topermission.has(addon)(Rafael Gonzaga) #58951fe4290a0e6] - (SEMVER-MINOR) url: addfileURLToPathBufferAPI (James M Snell) #587004dc6b4c67a] - (SEMVER-MINOR) watch: add--watch-kill-signalflag (Dario Piotrowicz) #587198dbc6b210f] - (SEMVER-MINOR) worker: makeWorkerasync disposable (James M Snell) #58385Commits
b19ffebea7] - assert: remove dead code (Yoshiya Hinosawa) #587605bc828beae] - benchmark: add source map and source map cache (Miguel Marcondes Filho) #58125f7c16985a7] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr) #58867ba42c72f7f] - build: option to use custom inspector_protocol path (Shelley Vohr) #588394fd8911653] - build: fix typo 'Stoage' to 'Storage' in help text (ganglike) #58777114cd95919] - crypto: fix inclusion of OPENSSL_IS_BORINGSSL define (Shelley Vohr) #588456699c75eac] - crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan) #58942f99aa748c0] - deps: upgrade npm to 10.9.3 (npm team) #5884702e971190b] - deps: update sqlite to 3.50.2 (Node.js GitHub Bot) #58882de2b85b5ae] - deps: update googletest to35b75a2(Node.js GitHub Bot) #58710e7591d7a19] - deps: update minimatch to 10.0.3 (Node.js GitHub Bot) #587128c61b96c43] - deps: update acorn to 8.15.0 (Node.js GitHub Bot) #58711113f4e2d3c] - deps: update sqlite to 3.50.1 (Node.js GitHub Bot) #586307ccd848995] - deps: update simdjson to 3.13.0 (Node.js GitHub Bot) #58629e9c51deb5c] - deps: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) #5862826f3711228] - (SEMVER-MINOR) deps: update amaro to 1.1.0 (Node.js GitHub Bot) #56350752dde182f] - (SEMVER-MINOR) deps: update amaro to 1.0.0 (Node.js GitHub Bot) #56350258534d0dc] - (SEMVER-MINOR) deps: update amaro to 0.5.3 (Node.js GitHub Bot) #563507fcf675503] - (SEMVER-MINOR) deps: update amaro to 0.5.2 (Node.js GitHub Bot) #5635081a10a67d5] - (SEMVER-MINOR) deps: update amaro to 0.5.1 (Marco Ippolito) #5635025f8682a62] - (SEMVER-MINOR) deps: update amaro to 0.5.0 (nodejs-github-bot) #563504baf2167e7] - dns: fix parse memory leaky (theanarkh) #58973e8f4a7df22] - dns: set timeout to 1000ms when timeout < 0 (theanarkh) #584411e373a0a25] - doc: update release key for aduh95 (Antoine du Hamel) #58877d5c104246f] - doc: remove broken link to permission model source code (Juan José) #58972b8885a25ff] - doc: clarify details of TSC public and private meetings (James M Snell) #58925aa05823b37] - doc: mark stability markers consistent inglobals.md(Antoine du Hamel) #589323856aee9b2] - doc: move "Core Promise APIs" to "Completed initiatives" (Antoine du Hamel) #58934c2f9735422] - doc: fixfetchsubsections inglobals.md(Antoine du Hamel) #589335f4c7a9d2d] - doc: add missingClass:mentions (Antoine du Hamel) #5893188ee38b37c] - doc: remove myself from security steward rotation (Michael Dawson) #5892702031a9b0d] - doc: add ovflowd back to core collaborators (Claudio W.) #589119551fa3c8f] - doc: update email address for Richard Lau (Richard Lau) #58910cd6bc982c0] - doc: update vm doc links (Chengzhong Wu) #58885ce49303cd0] - doc: add missing comma inchild_process.md(ronijames008) #58862d80ef2a71f] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719f8fcb1c83a] - doc: fix jsdoc definition of assert.ifError() fn in lib/assert.js (jesh) #5857328fddc04ca] - doc: add array type in http request headers (Michael Henrique) #580498bd698b688] - doc: add missing colon to headers inglobals.md(Aviv Keller) #58825fa5818e3c1] - doc: fixstream.mdsection order (Antoine du Hamel) #588112384bfdcbd] - doc: fix stability 1.x links excluding the decimal digit (Dario Piotrowicz) #587834e9fe670c9] - doc: fix wrong RFC number in http2 (Deokjin Kim) #58753bbe4ad7351] - doc: add history entry for TS support in hooks (Antoine du Hamel) #58732ec60473ab1] - doc: run license-builder (github-actions[bot]) #587228ab24d21c9] - doc: add islandryu to collaborators (Shima Ryuhei) #587148c641105cd] - doc: punctuation fix for Node-API versioning clarification (Jiacai Liu) #58599133b10a0bb] - doc: add path rules and validation for export targets in package.json (0hm☘️) #58604354a68c460] - doc: add history entries to--input-typesection (Antoine du Hamel) #56350430e66b9b8] - (SEMVER-MINOR) esm: implement import.meta.main (Joe) #5780442c4ca6024] - esm: syncify default path ofModuleLoader.load(Jacob Smith) #574193ac8c686a3] - esm: unwrap WebAssembly.Global on Wasm Namespaces (Guy Bedford) #57525c7ebf2e245] - fs: close dir before throwing ifoptions.bufferSizeis invalid (Livia Medeiros) #5885638ffed8744] - fs: special input-1onchown,lchownandfchown(Alex Yang) #588360e82f72a46] - fs: throwERR_INVALID_THISon illegal invocations (Livia Medeiros) #58848141b2b1954] - fs: makeDirdisposers idempotent (René) #58692dedd9d1961] - fs: avoid computing time coefficient constants in runtime (Livia Medeiros) #58728a029a06b49] - fs: add UV_ENOSPC to list of things to pass to err directly (Jacky Zhao) #5691862f7926b6a] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490927d2e77f3] - http: fix keep-alive not timing out after post-request empty line (Shima Ryuhei) #581785cd8145612] - http2: add diagnostics channel 'http2.server.stream.close' (Darshan Sen) #586020f2b31cba4] - inspector: add protocol methods retrieving sent/received data (Chengzhong Wu) #5864579428d8946] - lib: fixgetTypeScriptParsingModejsdoc (沈鸿飞) #586812c205d857c] - lib: renamevalidateInternalFieldintovalidateThisInternalField(LiviaMedeiros) #58765f67e927a5f] - lib: makevalidateInternalField()throwERR_INVALID_THIS(LiviaMedeiros) #58765914701d4f8] - lib,src: support DOMException ser-des (Chengzhong Wu) #5864912a75dca8b] - meta: bump step-security/harden-runner from 2.12.0 to 2.12.2 (dependabot[bot]) #589230d56fec6f0] - meta: bump github/codeql-action from 3.28.18 to 3.29.2 (dependabot[bot]) #589227f4f6e0409] - meta: add IlyasShabi to collaborators (Ilyas Shabi) #5891650b62c9663] - meta: add @nodejs/inspector as codeowner (Chengzhong Wu) #587902fc89892ab] - module: fix typescript import.meta.main (Marco Ippolito) #58661bfc68c8ae8] - module: convert schema-only core module onconvertCJSFilenameToURL(Alex Yang) #5861254634f5e53] - module: update tests for combined ambiguous module syntax error (Mert Can Altin) #5587410eb3db4af] - module: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) #58598fe7994eb0c] - module: improve typescript error message format (Marco Ippolito) #56350c898491017] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #56350c07745a436] - module: refactor commonjs typescript loader (Marco Ippolito) #563508d1f5df313] - (SEMVER-MINOR) module: unflag --experimental-strip-types (Marco Ippolito) #56350a8a1c9a960] - os: fix GetInterfaceAddresses memory lieaky (theanarkh) #5894065f19a00c3] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853f0a165d89f] - repl: fix eval errors thrown after close throwingERR_USE_AFTER_CLOSE(Dario Piotrowicz) #587919ef1cd1607] - repl: avoid deprecatedrequire.extensionsin tab completion (baki gul) #5865322a4c60e08] - repl: fix tab completion not working with computer string properties (Dario Piotrowicz) #58709ccca1517f9] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #58697690525881e] - src: simplify adding fast APIs to ExternalReferenceRegistry (René) #58896a381b4d990] - src: remove fast API for InternalModuleStat (Joyee Cheung) #58489390654e996] - src: fix internalModuleStat v8 fast path (Yagiz Nizipli) #58054b722647572] - src: fix -Wunreachable-code in src/node_api.cc (Shelley Vohr) #589016d1fe67f56] - src: -Wunreachable-code error in crypto_context.cc (Shelley Vohr) #589012d8e65c6db] - src: fix -Wunreachable-code-return in src/node_contextify.cc (Shelley Vohr) #58901e07adb3b18] - src: cleanup uv_fs_req before uv_fs_stat on existSync (RafaelGSS) #589156b30c0a511] - src: -Wmismatched-new-delete in debug_utils.cc (Shelley Vohr) #5884474ef07f2e7] - src: add FromV8Value<T>() for integral and enum types (Aditi) #5793128bf6ed87d] - src: pass resource on permission checks for spawn (Rafael Gonzaga) #58758daf65d479b] - src: replace std::array with static arrays in contextify (Mert Can Altin) #585809cb671fdb1] - src: add new CopyUtimes function to reduce code duplication (Dario Piotrowicz) #58625e515eb861c] - src: replace V8 Fast API todo comment with note comment (Dario Piotrowicz) #5861448003e87e8] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #5895172f75bb976] - src,permission: enhance permission model debug (Rafael Gonzaga) #5889866fccc252b] - (SEMVER-MINOR) test: add test for async disposable worker thread (James M Snell) #5838543d2ad8599] - test: deflake test-runner-watch-mode-kill-signal (Dario Piotrowicz) #589527c54085698] - test: add known issue tests for recursive readdir calls with Buffer path (Dario Piotrowicz) #58893cd2a5d9a51] - test: add known issue tests for fs.cp (James M Snell) #5888326072a7953] - test: add tests to ensure that node.1 is kept in sync with cli.md (Dario Piotrowicz) #588783fd187f559] - test: replace.filter()[0]with.find()(Livia Medeiros) #588720d538abb15] - test: remove reliance on in-treedeps/undici(Richard Lau) #58866e24dede403] - test: close dirs infs-opendirtest (Livia Medeiros) #58855ac6b8222e6] - test: correct SIMD support comment (Richard Lau) #587679d3e451181] - test: add tests for REPL custom evals (Dario Piotrowicz) #5785017a3246718] - test: reduce the use of private symbols in test-events-once.js (Yoshiya Hinosawa) #58685bbf33efcd0] - test: usecommon.skipIfInspectorDisabled()to skip tests (Dario Piotrowicz) #58675d6660baff7] - test: update WPT for dom/abort todc92816(Node.js GitHub Bot) #586446d9d5deb44] - test: split indirect eval import tests (Chengzhong Wu) #58637abd5b5fd20] - test: deflake async-hooks/test-improper-order on AIX (Baki Gul) #585673fc630e7cf] - test: close FileHandle objects in tests explicitly (James M Snell) #586157f0560dc4b] - test: skip broken sea on rhel8 (Marco Ippolito) #58914898e68a915] - test: save the config file in a temporary directory (Luigi Pinca) #587999f2132a4f6] - test: deflake test-config-file (Luigi Pinca) #58799f1b74cff9a] - test: skip tests failing when run under root (Livia Medeiros) #586104b0ee14a97] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #58921a84935fb0e] - tools: update inspector_protocol to69d69dd(Shelley Vohr) #58900af805186cd] - tools: update gyp-next to 0.20.2 (Node.js GitHub Bot) #58788a2d2d36bb1] - tools: make nodedownload module compatible with Python 3.14 (Lumír 'Frenzy' Balhar) #58752cc8b9aa43d] - tools: include toolchain.gypi in abseil.gyp (Chengzhong Wu) #58678fbbf49a7d3] - tools: bumpbrace-expansionin/tools/clang-format(dependabot[bot]) #586998db92a41c5] - tools: bump brace-expansion from 1.1.11 to 1.1.12 in /tools/eslint (dependabot[bot]) #586983a099cf88f] - tools: switch to@stylistic/eslint-plugin(Michaël Zasso) #586239798511e7c] - tools: remove config.status undermake distclean(René) #58603011290a4eb] - tools: edit commit-queue workflow file (Antoine du Hamel) #58667a7406f56da] - tools: improve release proposal linter (Antoine du Hamel) #58647c855310f83] - tools,doc: move more MDN links to types (Antoine du Hamel) #58930805239c824] - typings: add Atomics primordials (Renegade334) #58577d28b2aa0a2] - typings: add ZSTD_COMPRESS, ZSTD_DECOMPRESS to internalBinding (Meghan Denny) #58655fe4290a0e6] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700db648b92c1] - util: inspect: do not crash on an Error stack pointing to itself (Sam Verschueren) #58196791ecfac14] - v8: fix missing callback in heap utils destroy (Ruben Bridgewater) #588464dc6b4c67a] - (SEMVER-MINOR) watch: add--watch-kill-signalflag (Dario Piotrowicz) #587198dbc6b210f] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #58385v22.17.1: 2025-07-15, Version 22.17.1 'Jod' (LTS), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Commits
8cf5d66ab7] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#7219c0cb487ec] - win,build: fix MSVS v17.14 compilation issue (StefanStojanovic) #58902v22.17.0: 2025-06-24, Version 22.17.0 'Jod' (LTS), @aduh95Compare Source
Notable Changes
⚠️ Deprecations
Instantiating
node:httpclasses withoutnewConstructing classes like
IncomingMessageorServerResponsewithout thenewkeyword is now discouraged. This clarifies API expectations and aligns with standard
JavaScript behavior. It may warn or error in future versions.
Contributed by Yagiz Nizipli in #58518.
options.shell = ""innode:child_processUsing an empty string for
shellpreviously had undefined behavior. This changeencourages explicit choices (e.g.,
shell: trueor a shell path) and avoidsrelying on implementation quirks.
Contributed by Antoine du Hamel and Renegade334 #58564.
HTTP/2 priority signaling
The HTTP/2 prioritization API (e.g.,
stream.priority) is now deprecated due topoor real-world support. Applications should avoid using priority hints and expect future removal.
Contributed by Matteo Collina and Antoine du Hamel #58313.
✅ Features graduated to stable
assert.partialDeepStrictEqual()This method compares only a subset of properties in deep object comparisons,
useful for flexible test assertions. Its stabilization means it's now safe for
general use and won't change unexpectedly in future releases.
Contributed by Ruben Bridgewater in #57370.
Miscellaneous
dirent.parentPathfilehandle.readableWebStream()fs.glob()fs.openAsBlob()node:readline/promisesport.hasRef()readable.compose()readable.iterator()readable.readableAbortedreadable.readableDidReadDuplex.fromWeb()Duplex.toWeb()Readable.fromWeb()Readable.isDisturbed()Readable.toWeb()stream.isErrored()stream.isReadable()URL.createObjectURL()URL.revokeObjectURL()v8.setHeapSnapshotNearHeapLimit()Writable.fromWeb()Writable.toWeb()writable.writableAbortedERR_INPUT_TYPE_NOT_ALLOWEDERR_UNKNOWN_FILE_EXTENSIONERR_UNKNOWN_MODULE_FORMATERR_USE_AFTER_CLOSEContributed by James M Snell in
#57513 and
#58541.
Semver-minor features
🔧
fs.FileHandle.readableWebStreamgetsautoCloseoptionThis gives developers explicit control over whether the file descriptor should
be closed when the stream ends. Helps avoid subtle resource leaks.
Contributed by James M Snell in #58548.
🔧
fs.Dirnow supports explicit resource managementThis improves ergonomics around async iteration of directories. Developers can
now manually control when a directory is closed using
.close()or withSymbol.asyncDispose.Contributed by Antoine du Hamel in #58206.
📊
http2gains diagnostics channel:http2.server.stream.finishAdds observability support for when a stream finishes. Useful for logging,
monitoring, and debugging HTTP/2 behavior without patching internals.
Contributed by Darshan Sen in #58560.
🔐 Permissions: implicit allow-fs-read to entrypoint
Node.js permissions model now allows read access to the entry file by default.
It makes running permission-restricted apps smoother while preserving security.
Contributed by Rafael Gonzaga in #58579.
🎨
util.styleText()adds'none'styleThis lets developers remove styling cleanly without hacks. Useful for overriding
inherited terminal styles when composing styled strings.
Contributed by James M Snell in #58437.
🧑💻 Community updates
0105c13556] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #584993b857735ef] - doc: add JonasBa to collaborators (Jonas Badalic) #58355fdf7612735] - doc: add puskin to collaborators (Giovanni Bucci) #58308Commits
ffe7e1ace0] - (SEMVER-MINOR) assert: mark partialDeepStrictEqual() as stable (Ruben Bridgewater) #57370269931f289] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #581499e0746a4ff] - benchmark: fix broken fs.cpSync benchmark (Dario Piotrowicz) #58472dee8cb5bcb] - benchmark: add more options to cp-sync (Sonny) #58278e840fd5b85] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #58128b9a16e97e0] - buffer: give names toBuffer.prototype.*Write()functions (Livia Medeiros) #58258d56a5e40af] - buffer: use constexpr where possible (Yagiz Nizipli) #58141215587feca] - build: add support for OpenHarmony operating system (hqzing) #583509bcef6821c] - build: fix uvwasi pkgname (Antoine du Hamel) #582707c3883c2ae] - build: search for libnode.so in multiple places (Jan Staněk) #582133f954accb3] - build: fix pointer compression builds (Joyee Cheung) #5817104c8f59f84] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #580908c2cf3a372] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #58115cff8006792] - child_process: give names toChildProcessfunctions (Livia Medeiros) #583706816d779b6] - child_process: give names to promisifiedexec()andexecFile()(LiviaMedeiros) #579165572cecca4] - crypto: expose crypto.constants.OPENSSL_IS_BORINGSSL (Shelley Vohr) #58387d6aa02889c] - deps: use proper C standard when building libuv (Yaksh Bariya) #58587375a6413d5] - deps: update simdjson to 3.12.3 (Node.js GitHub Bot) #57682e0cd138e52] - deps: update googletest toe9092b1(Node.js GitHub Bot) #5856531e592631f] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #58566386c24260b] - deps: update sqlite to 3.50.0 (Node.js GitHub Bot) #58272f84998d40b] - deps: update OpenSSL gen container to Ubuntu 22.04 (Michaël Zasso) #58432d49fd29859] - deps: update llhttp to 9.3.0 (Fedor Indutny) #58144e397980a1a] - deps: update libuv to 1.51.0 (Node.js GitHub Bot) #58124a28c33645c] - dns: fix dns query cache implementation (Ethan Arrowood) #584046939b0c624] - doc: fix the order ofprocess.mdsections (Allon Murienik) #584031ca253c363] - doc: add support link for panva (Filip Skokan) #585918319edbcf6] - doc: update metadata for _transformState deprecation (James M Snell) #58530697d258136] - doc: deprecate passing an empty string tooptions.shell(Antoine du Hamel) #58564132fc804e8] - doc: correct formatting of example definitions for--test-shard(Jacob Smith) #585717d0df646f6] - doc: clarify DEP0194 scope (Antoine du Hamel) #585041e6d7da0ce] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #583135a917bc1d0] - doc: explain child_process code and signal null values everywhere (Darshan Sen) #584790105c13556] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #584992bdc87cd64] - doc: updategit node releaseexample (Antoine du Hamel) #5847528f9b43186] - doc: add missing options.info for ZstdOptions (Jimmy Leung) #58360e19496dfc1] - doc: add missing options.info for BrotliOptions (Jimmy Leung) #583597f905863db] - doc: clarify x509.checkIssued only checks metadata (Filip Skokan) #584575cc97df637] - doc: add links to parent class fornode:zlibclasses (Antoine du Hamel) #5843336e0d5539b] - doc: remove remaining uses of@@wellknownsyntax (René) #584132f36f8e863] - doc: clarify behavior of --watch-path and --watch flags (Juan Ignacio Benito) #581363b857735ef] - doc: add JonasBa to collaborators (Jonas Badalic) #583559d5e969bb6] - doc: add latest security release steward (Rafael Gonzaga) #58339b22bb03167] - doc: fix CryptoKey.algorithm type and other interfaces in webcrypto.md (Filip Skokan) #58294670f31060b] - doc: mark the callback argument of crypto.generatePrime as mandatory (Allon Murienik) #5829939d9a61239] - doc: remove comma delimiter mention on permissions doc (Rafael Gonzaga) #58297573b0b7bfe] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291a5a686a3ae] - doc: update commit-queue documentation (Dario Piotrowicz) #58275fdf7612735] - doc: add puskin to collaborators (Giovanni Bucci) #58308be492a1708] - doc: update stability status for diagnostics_channel to experimental (Idan Goshen) #582617d00fc2206] - doc: clarify napi_get_value_string_* for bufsize 0 (Tobias Nießen) #58158c8500a2c4a] - doc: fix typo of filehttp.md,outgoingMessage.setTimeoutsection (yusheng chen) #5818834a9b856c3] - doc: update return types for eventNames method in EventEmitter (Yukihiro Hasegawa) #58083faedee59d2] - doc: fix typo in benchmark script path (Miguel Marcondes Filho) #58129570d8d3f10] - doc: clarify future Corepack removal in v25+ (Trivikram Kamat) #57825a71b9fc2ff] - doc: mark multiple APIs stable (James M Snell) #5751373a97d47f3] - doc,lib: update source map links to ECMA426 (Chengzhong Wu) #585978b41429499] - doc,src,test: fix typos (Noritaka Kobayashi) #584770cea14ec7f] - errors: show url of unsupported attributes in the error message (Aditi) #58303b9586bf898] - (SEMVER-MINOR) fs: add autoClose option to FileHandle readableWebStream (James M Snell) #5854872a1b061f3] - fs: unexpose internal constants (Chengzhong Wu) #583275c36510dec] - fs: add support forURLforfs.glob'scwdoption (Antoine du Hamel) #581823642b0d944] - fs: improve cpSync no-filter copyDir performance (Dario Piotrowicz) #5846124865bc7e8] - fs: improvecpSyncdest overriding performance (Dario Piotrowicz) #581601b3847694d] - (SEMVER-MINOR) fs: add toDirsupport for explicit resource management (Antoine du Hamel) #58206cff62e3265] - fs: ensuredir.read()does not throw synchronously (Antoine du Hamel) #58228cb39e4ca1f] - fs: glob is stable, so should not emit experimental warnings (Théo LUDWIG) #58236597bfefbe1] - http: deprecate instantiating classes without new (Yagiz Nizipli) #585185298da0102] - http: remove unused functions and add todos (Yagiz Nizipli) #58143cff440e0fa] - http,https: give names to anonymous or misnamed functions (Livia Medeiros) #5818043bf1f619a] - http2: add raw header array support to h2Session.request() (Tim Perry) #57917e8a0f5b063] - http2: add lenient flag for RFC-9113 (Carlos Fuentes) #5811649cb90d4a5] - (SEMVER-MINOR) http2: add diagnostics channel 'http2.server.stream.finish' (Darshan Sen) #585606a56c68728] - http2: add diagnostics channel 'http2.server.stream.error' (Darshan Sen) #5851259806b41d3] - http2: add diagnostics channel 'http2.server.stream.start' (Darshan Sen) #58449d3d662ae47] - http2: remove no longer userful options.selectPadding (Jimmy Leung) #58373dec6c9af8c] - http2: add diagnostics channel 'http2.server.stream.created' (Darshan Sen) #583909e98899986] - http2: add diagnostics channel 'http2.client.stream.close' (Darshan Sen) #5832986610389d8] - http2: add diagnostics channel 'http2.client.stream.finish' (Darshan Sen) #583172d3071671e] - http2: add diagnostics channel 'http2.client.stream.error' (Darshan Sen) #583066c3e426d6f] - http2: add diagnostics channel 'http2.client.stream.start' (Darshan Sen) #58292b99d131a61] - http2: add diagnostics channel 'http2.client.stream.created' (Darshan Sen) #58246b0644330f5] - http2: give name to promisifiedconnect()(LiviaMedeiros) #579164092d3611a] - inspector: add mimeType and charset support to Network.Response (Shima Ryuhei) #58192d7d8599f7c] - inspector: add protocol method Network.dataReceived (Chengzhong Wu) #58001aabafbc28f] - inspector: support for worker inspection in chrome devtools (Shima Ryuhei) #5675920d978de9a] - lib: make ERM functions into wrappers returning undefined (Livia Medeiros) #5840013567eac5f] - (SEMVER-MINOR) lib: graduate error codes that have been around for years (James M Snell) #58541342b5a0d7a] - lib: remove no-mixed-operators eslint rule (Ruben Bridgewater) #58375af7baef75a] - lib: fix sourcemaps with ts module mocking (Marco Ippolito) #581938f73f42d4e] - meta: bump github/codeql-action from 3.28.16 to 3.28.18 (dependabot[bot]) #585525dfedbeb86] - meta: bump codecov/codecov-action from 5.4.2 to 5.4.3 (dependabot[bot]) #5855153c50f66f5] - meta: bump step-security/harden-runner from 2.11.0 to 2.12.0 (dependabot[bot]) #58109a1a7024831] - meta: bump ossf/scorecard-action from 2.4.1 to 2.4.2 (dependabot[bot]) #58550a379988ef6] - meta: bump rtCamp/action-slack-notify from 2.3.2 to 2.3.3 (dependabot[bot]) #58108f6a46c87f2] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #5845698b6aa0dcd] - meta: bump github/codeql-action from 3.28.11 to 3.28.16 (dependabot[bot]) #581125202b262e3] - meta: bump codecov/codecov-action from 5.4.0 to 5.4.2 (dependabot[bot]) #58110d97616ac6e] - meta: bump actions/download-artifact from 4.2.1 to 4.3.0 (dependabot[bot]) #58106f4065074cf] - meta: ignore mailmap changes in linux ci (Jonas Badalic) #58356e6d1224e54] - meta: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot[bot]) #5811126da160ab2] - meta: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot[bot]) #581074cc4195493] - module: handle instantiated async module jobs in require(esm) (Joyee Cheung) #5806772fac71b92] - module: clarify cjs global-like error on ModuleJobSync (Carlos Espa) #56491fecd841c93] - net: always publish to 'net.client.socket' diagnostics channel (Darshan Sen) #5834925ee328d2b] - path: improve path.resolve() performance when used as process.cwd() (Ruben Bridgewater) #583626fd1b23260] - permission: remove useless conditional (Juan José) #585145b2cca51a3] - report: use uv_getrusage_thread in report (theanarkh) #5840563ec23e84b] - sqlite: add build option to build without sqlite (Michael Dawson) #581229d8677bff5] - sqlite: handle thrown errors in result callback (Colin Ihrig) #584263490c75760] - sqlite: setnameandlengthonsqlite.backup()(Livia Medeiros) #5825150bdd94e0b] - src: update std::vector<v8::Local<T>> to use v8::LocalVector<T> (Aditi) #585007de58417cc] - src: env_vars caching and local variable scope optimization (Mert Can Altin) #576246d99ec33a4] - src: fix FIPS init error handling (Tobias Nießen) #583794c23a9575e] - src: fix possible dereference of null pointer (Eusgor) #58459eb143e902b] - src: fix -Wreturn-stack-address error (Shelley Vohr) #5843931058b8785] - src: reorganize ContextifyFunction methods (Chengzhong Wu) #584347521077299] - src: improve CompileFunctionAndCacheResult error handling (Chengzhong Wu) #584340c9efccb12] - src: fix build when using shared simdutf (Antoine du Hamel) #58407aa00f5946f] - src: add a variant of ToV8Value() for primitive arrays (Aditi) #5757629a11506fc] - src: remove unusedcheckMessagePortinternal binding (Dario Piotrowicz) #582670ce3feed5b] - src: remove unusedshouldRetryAsESMinternal binding (Dario Piotrowicz) #58265517219613d] - src: add a couple fast apis in node_os (James M Snell) #582103f834da09e] - src: fix module buffer allocation (X-BW) #57738a793706db0] - src: remove overzealous tcsetattr error check (Ben Noordhuis) #582005656c74517] - src: remove NonCopyableMaybe (Tobias Nießen) #58168cab242334b] - src: improve parsing of boolean options (Edy Silva) #58039a5df778150] - src,lib: obtain sourceURL in magic comments from V8 (Chengzhong Wu) #58389bd6743b434] - src,permission: implicit allow-fs-read to app entrypoint (Rafael Gonzaga) #585795bd99e4a4d] - stream: making DecompressionStream spec compilent for trailing junk (0hm☘️) #583166582b19488] - test: reduce flakiness in test-heapdump-http2 (Joyee Cheung) #581480f6a262744] - test: improve flakiness detection on stack corruption tests (Darshan Sen) #58601983affaea2] - test: mark timeouts & flaky test as flaky on IBM i (Abdirahim Musse) #585833603362b6f] - test: rewrite test-child-process-spawn-args (Michaël Zasso) #5854693900b0c17] - test: make sqlite-database-sync tests work with system sqlite (Jelle Licht) #585077d505f4185] - test: force slow JSON.stringify path for overflow (Shelley Vohr) #581812e8570b8f9] - test: account for truthy signal in flaky async_hooks tests (Darshan Sen) #584781f1e194c0f] - test: update WPT for WebCryptoAPI to591c95c(Node.js GitHub Bot) #58176d822632d91] - test: remove --no-warnings flag (Tobias Nießen) #5842401377713d7] - test: add tests ensuring worker threads cannot access internals (Joe) #5833299a20902fc] - test: leverage process.features.openssl_is_boringssl in test (Shelley Vohr) #58421b3e0cf1b15] - test: fix test-buffer-tostring-range on allocation failure (Joyee Cheung) #584161d4b3451c5] - test: skip in test-buffer-tostring-rangeerror on allocation failure (Joyee Cheung) #58415612c393c71] - test: fix missing edge case in test-blob-slice-with-large-size (Joyee Cheung) #58414b11b9cdad8] - test: make crypto tests work with BoringSSL (Shelley Vohr) #5811799711ee548] - test: test reordering of setAAD and setAuthTag (Tobias Nießen) #58396828aaaa3f7] - test: switch from deprecatedoptparsetoargparse(Aviv Keller) #582249af305408e] - test: do not skip OCB decryption in FIPS mode (Tobias Nießen) #583829527c876bf] - test: show more information in test-http2-debug upon failure (Joyee Cheung) #583919be0601112] - test: remove loop over single element (Tobias Nießen) #5836840a03d3d14] - test: add chacha20-poly1305 to auth tag order test (Tobias Nießen) #58367cccb15df7e] - test: skip wasm-allocation tests for pointer compression builds (Joyee Cheung) #58171f18041ae8e] - test: remove references to create(De|C)ipher (Tobias Nießen) #58363ca8d66c1fc] - test: remove unnecessaryconsole.logfrom test-repl-null-thrown (Dario Piotrowicz) #58281455372023d] - test: allowtmpDir.pathto be modified (Aviv Keller) #581731f1fab60c7] - test: fix executable flags (Livia Medeiros) #582508bafc0f061] - test: deflake test-http2-client-socket-destroy (Luigi Pinca) #5821297aac9f17a] - test: skip test-buffer-tostring-rangeerror when low on memory (Ruben Bridgewater) #581422896760da1] - test: marktest-http2-debugas flaky on LinuxONE (Richard Lau) #584947327d14780] - test: reduce iteration count in test-child-process-stdout-flush-exit (Antoine du Hamel) #582731bd7a2edf9] - test_runner: support mocking json modules (Jacob Smith) #58007a3877c53b1] - test_runner: add level parameter to reporter.diagnostic (Jacopo Martinelli) #57923253772c2d9] - tools: bump the eslint group in/tools/eslintwith 6 updates (dependabot[bot]) #58549b7feda97b0] - tools: disable failing coverage jobs (Antoine du Hamel) #587708a47096093] - tools: ignoredeps/andbenchmark/for CodeQL (Rafael Gonzaga) #5825470be158126] - tools: add read permission to workflows that read contents (Antoine du Hamel) #58255e4373be766] - tools: exclude deps/v8/tools from CodeQL scans (Rich Trott) #5813223ceb364d4] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #581055b6ced3255] - tty: improve color terminal color detection (Ruben Bridgewater) #581467be70979c6] - tty: use terminal VT mode on Windows (Anna Henningsen) #58358b7d7ffe793] - typings: add inspector internalBinding typing (Shima Ryuhei) #584920056d1a2e2] - typings: remove no longer validFixedSizeBlobCopyJobtype (Dario Piotrowicz) #58305581c0738f9] - typings: remove no longer validrevokeDataObjecttype (Dario Piotrowicz) #583051db1c870f0] - typings: add missing typings forTypedArray(Jason Zhang) #582486d3f43c9a6] - url: improve performance of the format function (Giovanni Bucci) #5709954288bdb42] - (SEMVER-MINOR) util: add 'none' style to styleText (James M Snell) #584376af5358f9c] - util: add internalassignFunctionName()function (LiviaMedeiros) #579169f2e5aad38] - vm: import call should return a promise in the current context (Chengzhong Wu) #5830992304a5e62] - watch: fix watch args not being properly filtered (Dario Piotrowicz) #58279539df8e98d] - win,tools: use Azure Trusted Signing (Stefan Stojanovic) #58502ef66357637] - worker: give names toMessagePortfunctions (Livia Medeiros) #58307b3cd847528] - zlib: remove mentions of unexposed Z_TREES constant (Jimmy Leung) #58371v22.16.0: 2025-05-21, Version 22.16.0 'Jod' (LTS), @aduh95Compare Source
Notable Changes
c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #578575059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #57765e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #58011832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #57610c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #574905d1230bec0] - (SEMVER-MINOR) src: set default config asnode.config.json(Marco Ippolito) #5717130bb1ccbb0] - (SEMVER-MINOR) src: createTHROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING(Marco Ippolito) #570160350c6f478] - (SEMVER-MINOR) src: add config file support (Marco Ippolito) #57016e1d3a9e192] - (SEMVER-MINOR) src: add ExecutionAsyncId getter for any Context (Attila Szegedi) #578200ec912f452] - (SEMVER-MINOR) stream: preserve AsyncLocalStorage context in finished() (Gürgün Dayıoğlu) #5786543490c8797] - (SEMVER-MINOR) util: addtypes.isFloat16Array()(Livia Medeiros) #57879dda6ca9172] - (SEMVER-MINOR) worker: add worker.getHeapStatistics() (Matteo Collina) #57888Commits
4252dc798c] - assert: supportFloat16Arrayin loose deep equality checks (Livia Medeiros) #578811c7396b078] - assert,util: fix constructor lookup in deep equal comparison (Ruben Bridgewater) #578761ded5f25c8] - assert,util: improve deep object comparison performance (Ruben Bridgewater) #57648696b5f85ca] - assert,util: improve unequal number comparison performance (Ruben Bridgewater) #57619775ee4d40f] - assert,util: improve array comparison (Ruben Bridgewater) #576193766992ba4] - benchmark: add sqlite prepare select get (Vinícius Lourenço) #580408390276be3] - benchmark: add sqlite prepare select all (Vinícius Lourenço) #580406a9b79e5c1] - benchmark: add sqlite is transaction (Vinícius Lourenço) #58040f689f98344] - benchmark: add sqlite prepare insert (Vinícius Lourenço) #5804014a82804d7] - benchmark: disambiguatefilenameanddirnameread perf (Antoine du Hamel) #58056e7e8256d35] - buffer: avoid creating unnecessary environment (Yagiz Nizipli) #58053d7d8e8e994] - buffer: define global v8::CFunction objects as const (Mert Can Altin) #57676f37633e85a] - build: use$(BUILDTYPE)when cleaning coverage files (Aviv Keller) #57995e5bf67fe77] - build: define python when generatingout/Makefile(Aviv Keller) #57970718f874ae0] - build: fix zstd libname (Antoine du Hamel) #5799953c5fdcae1] - crypto: fix cross-realmSharedArrayBuffervalidation (Antoine du Hamel) #5797478f4ffee5d] - crypto: fix cross-realm check ofArrayBuffer(Felipe Forbeck) #57828f606352b63] - crypto: forbid passingFloat16ArraytogetRandomValues()(Livia Medeiros) #5788023c4e941c2] - crypto: remove BoringSSL dh-primes addition (Shelley Vohr) #570238339d9bc14] - deps: V8: cherry-pickf915fa4(Chengzhong Wu) #55484c2111dd126] - deps: V8: backporte5dbbba(Darshan Sen) #581204cc49be951] - deps: update zstd to 1.5.7 (Node.js GitHub Bot) #57940c956d37c84] - deps: update zlib to 1.3.0.1-motley-780819f (Node.js GitHub Bot) #57768c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857b5cd0eb590] - deps: update simdutf to 6.4.2 (Node.js GitHub Bot) #578553eb6b814e9] - deps: update simdutf to 6.4.0 (Node.js GitHub Bot) #567640be9fa3218] - deps: update icu to 77.1 (Node.js GitHub Bot) #57455d5cf4254fb] - doc: add HBSPS as triager (Wiyeong Seo) #57980ad0861dba0] - doc: add ambassaor message (Brian Muenzenmeyer) #576000d3ec1aafe] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #581451f70baf3b0] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456ec6a48621f] - doc: fix typo of filezlib.md(yusheng chen) #5809337e360e386] - doc: make stability labels more consistent (Antoine du Hamel) #575162b5d63d36e] - doc: allow the $schema property in node.config.json (Remco Haszing) #57560a2063638e2] - doc: fixAsyncLocalStorageexample response changes after node v18 (Naor Tedgi (Abu Emma)) #57969474c2b14c3] - doc: mark Node.js 18 as End-of-Life (Richard Lau) #580845059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #581021eec170fc3] - doc: fix formatting ofimport.meta.filenamesection (Antoine du Hamel) #580797f108de525] - doc: fix env variable name inutil.styleText(Antoine du Hamel) #5807254b3f7fffc] - doc: add returns for https.get (Eng Zer Jun) #5802566f2c605a8] - doc: fix typo inbuffer.md(chocolateboy) #58052b0256dd42b] - doc: correct deprecation type ofassert.CallTracker(René) #57997581439c9e6] - doc: mark devtools integration section as active development (Chengzhong Wu) #57886a2a2a2f027] - doc: fix typo inmodule.md(Alex Schwartz) #57889c0ec4e2935] - doc: increase z-index of header element (Dario Piotrowicz) #5785193d19ec6cd] - doc: add missing TS formats forloadhooks (Antoine du Hamel) #57837f5ea06c61f] - doc: clarify the multi REPL example (Dario Piotrowicz) #5775980c4fe1b70] - doc: fix deprecation type forDEP0148(Livia Medeiros) #5778501cad99da0] - doc: list DOMException as a potential error raised by Node.js (Chengzhong Wu) #57783a08b714a46] - doc: add missing v0.x changelog entries (Antoine du Hamel) #57779d0b48350fd] - doc: fix typo in writing-docs (Sebastian Beltran) #57776bde3725f8b] - doc: clarify examples section in REPL doc (Dario Piotrowicz) #57762c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #5776592428c2609] - doc: explicitly state that corepack will be removed in v25+ (Trivikram Kamat) #57747298969e1dd] - doc: update position type to integer | null in fs (Yukihiro Hasegawa) #57745a9d28e27c9] - doc: update CI instructions (Antoine du Hamel) #57743133d2878a1] - doc: update example of usingawaitin REPL (Dario Piotrowicz) #57653fc5f126629] - doc: add back mention of visa fees to onboarding doc (Darshan Sen) #57730945f4ac538] - doc: process.execve is only unavailable for Windows (Yaksh Bariya) #57726f3b885bb5e] - doc: clarifyunhandledRejectionevents behaviors in process doc (Dario Piotrowicz) #576547326dda5b0] - doc: improved fetch docs (Alessandro Miliucci) #572966906c5eb1f] - doc: document REPL custom eval arguments (Dario Piotrowicz) #5769047a7564e8f] - doc: classify Chrome DevTools Protocol as tier 2 (Chengzhong Wu) #57634e274cc1310] - doc: replace NOTE that does not render properly (Colin Ihrig) #57484bef06b11df] - esm: avoidimport.metasetup costs for unused properties (Antoine du Hamel) #57286e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #58011832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #576108f643471ef] - fs: improve globSync performance (Rich Trott) #57725bf9e17ecc6] - http2: use args.This() instead of args.Holder() (Joyee Cheung) #58004137717354f] - http2: fix graceful session close (Kushagra Pandey) #578089baf580269] - http2: fix check forframe->hd.type(hanguanqiang) #57644b8189242b2] - http2: skip writeHead if stream is closed (Shima Ryuhei) #576864e02a1650a] - lib: remove unused filefetch_module(Michaël Zasso) #55880d9700fef26] - lib: avoid StackOverflow onserializeError(Chengzhong Wu) #58075f3a16b6d9c] - lib: resolve the issue of not adhering to the specified buffer size (0hm☘️🏳️⚧️) #55896d4fc282f73] - lib: fix AbortSignal.any() with timeout signals (Gürgün Dayıoğlu) #57867f7e2902861] - lib: use Map primordial for ActiveAsyncContextFrame (Gürgün Dayıoğlu) #576708652b0e168] - meta: set nodejs/config as codeowner (Marco Ippolito) #57237e98504ed95] - meta: allow penetration testing on live system with prior authorization (Matteo Collina) #57966340731bea0] - meta: fix subsystem in commit title (Luigi Pinca) #57945d767cbffcf] - meta: bump Mozilla-Actions/sccache-action from 0.0.8 to 0.0.9 (dependabot[bot]) #57720575f904b13] - meta: bump actions/download-artifact from 4.1.9 to 4.2.1 (dependabot[bot]) #57719acd323c069] - meta: bump actions/setup-python from 5.4.0 to 5.5.0 (dependabot[bot]) #5771821246fec20] - meta: bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 (dependabot[bot]) #5771797f32d5849] - meta: bump github/codeql-action from 3.28.10 to 3.28.13 (dependabot[bot]) #5771690ddbb8cfa] - meta: bump actions/cache from 4.2.2 to 4.2.3 (dependabot[bot]) #57715728425d03e] - meta: bump actions/setup-node from 4.2.0 to 4.3.0 (dependabot[bot]) #577141f799140e0] - meta: bump actions/upload-artifact from 4.6.1 to 4.6.2 (dependabot[bot]) #57713021b174a1f] - module: tidy code string concat → string templates (Jacob Smith) #5582044c5718476] - module: fix incorrect formatting in require(esm) cycle error message (haykam821) #57453bb09b4d4ae] - module: improvegetPackageTypeperformance (Dario Piotrowicz) #575999e6054e715] - module: remove unnecessaryreadPackagefunction (Dario Piotrowicz) #575964a8db273ba] - node-api: add nested object wrap and napi_ref test (Chengzhong Wu) #579813c65058f20] - node-api: convert NewEnv to node_napi_env__::New (Vladimir Morozov) #57834a4105db1f7] - os: fix netmask format check condition in getCIDR function (Wiyeong Seo) #57324248c938139] - process: disable building execve on IBM i (Abdirahim Musse) #57883972275697a] - repl: deprecaterepl.builtinModules(Dario Piotrowicz) #575087485309d7e] - sqlite: add location method (Edy Silva) #57860c12cd2a190] - sqlite: add timeout options to DatabaseSync (Edy Silva) #577525e0503a967] - sqlite: add setReturnArrays method to StatementSync (Gürgün Dayıoğlu) #57542ed9d2fd51a] - sqlite: enable common flags (Edy Silva) #5762106dcb318bc] - sqlite: refactor prepared statement iterator (Colin Ihrig) #57569c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #574904e24456a1a] - sqlite: reset statement immediately in run() (Colin Ihrig) #57350a9a6891b0b] - sqlite: fix coverity warnings related to backup() (Colin Ihrig) #56961d2e1bcf3d4] - sqlite: fix use-after-free in StatementSync due to premature GC (Divy Srivastava) #56840cfe15ca7b4] - sqlite: handle conflicting SQLite and JS errors (Colin Ihrig) #567870e999eb65f] - sqlite: add getter to detect transactions (Colin Ihrig) #5792520b27331c0] - sqlite, test: expose sqlite online backup api (Edy Silva) #562538856712171] - sqlite,doc,test: add aggregate function (Edy Silva) #56600120050db97] - sqlite,src: refactor sqlite value conversion (Edy Silva) #575714c5555d558] - src: initialize privateSymbols for per_context (Jason Zhang) #57479d2ce9023b1] - src: ensure primordials are initialized exactly once (Chengzhong Wu) #5751906179be6ca] - src: disable abseil deadlock detection (Chengzhong Wu) #575825121c47990] - src: fix node_config_file.h compilation error in GN build (Cheng) #572105d1230bec0] - (SEMVER-MINOR) src: set default config asnode.config.json(Marco Ippolito) #57171ccee741c43] - src: namespace config file flags (Marco Ippolito) #5717030bb1ccbb0] - (SEMVER-MINOR) src: createTHROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING(Marco Ippolito) #570160350c6f478] - (SEMVER-MINOR) src: add config file support (Marco Ippolito) #57016eef37d00cb] - src: add more debug logs and comments in NodePlatform (Joyee Cheung) #58047678e8f57c0] - src: add dcheck_eq for Object::New constructor calls (Jonas) #57943aee45e2036] - src: move windows specific fns to_WIN32(Yagiz Nizipli) #579516206a8edbc] - src: improve thread safety of TaskQueue (Shelley Vohr) #5791003936f31c1] - src: fixup errorhandling more in various places (James M Snell) #57852010dd91a19] - src: fix typo in comments (Edy Silva) #57868e00c1ecbd2] - src: add BaseObjectPtr nullptr operations (Chengzhong Wu) #56585648ad252e1] - src: removevoid*->char*->void*casts (Tobias Nießen) #57791680b434a62] - src: improve error handing in node_messaging (James M Snell) #5776018f5301747] - src: remove unused detachArrayBuffer method (Yagiz Nizipli) #58055065e8cd670] - src: use macros to reduce code duplication is cares_wrap (James M Snell) #5793739af5d678f] - src: improve error handling in cares_wrap (James M Snell) #57937ca020fdc4e] - src: fix -Wunreachable-code-return in node_sea (Shelley Vohr) #5766432b6e7094a] - src: change DCHECK to CHECK (Wuli Zuo) #57948e1d3a9e192] - (SEMVER-MINOR) src: add ExecutionAsyncId getter for any Context (Attila Szegedi) #5782096243a723a] - src: update std::vector<v8::Local<T>> to use v8::LocalVector<T> (Aditi) #576460f2cbc17c7] - src: update std::vector<v8::Local<T>> to use v8::LocalVector<T> (Aditi) #57642d1c6f861d5] - src: update std::vector<v8::Local<T>> to use v8::LocalVector<T> (Aditi) #57578ab0d3a38db] - src: improve error message for invalid child stdio type in spawn_sync (Dario Piotrowicz) #5758924b182e7b3] - src: implement util.types fast API calls (Ruben Bridgewater) #57819dda6423be9] - src: enter and lock isolate properly in json parser (Joyee Cheung) #578234754c693f8] - src: improve error handling innode_env_var.cc(Antoine du Hamel) #57767db483bbe63] - src: improve error handling in node_http2 (James M Snell) #57764b0277700d6] - src: improve error handling in crypto_x509 (James M Snell) #57757353587f984] - src: improve error handling in callback.cc (James M Snell) #57758bec053ab20] - src: remove unused variable in crypto_x509.cc (Michaël Zasso) #5775438a329a857] - src: fix kill signal 0 on Windows (Stefan Stojanovic) #5769570bb387f82] - src: fix inefficient usage of v8_inspector::StringView (Simon Zünd) #52372be038f0273] - src,permission: make ERR_ACCESS_DENIED more descriptive (Rafael Gonzaga) #575850ec912f452] - (SEMVER-MINOR) stream: preserve AsyncLocalStorage context in finished() (Gürgün Dayıoğlu) #578656ffb66f82f] - test: fix permission fixtures lint (Rafael Gonzaga) #55819fd37891186] - test: add repl preview timeout test (Chengzhong Wu) #554841be5a8c1b4] - test: skiptest-config-json-schemawith quic (Richard Lau) #57225e90583b657] - test: add more coverage tonode_config_file(Marco Ippolito) #57170df2a36bfcc] - test: remove deadlock workaround (Joyee Cheung) #58047103034b051] - test: prevent extraneous HOSTNAME substitution in test-runner-output (René) #580763e58f81a38] - test: update WPT for WebCryptoAPI tob48efd6(Node.js GitHub Bot) #580442f4e4164a3] - test: add missing newlines to repl .exit writes (Dario Piotrowicz) #58041b40769292e] - test: add fast api tests for getLibuvNow() (Yagiz Nizipli) #58022cbd5768d47] - test: add ALS test using http agent keep alive (Gerhard Stöbich) #580179e31ab502a] - test: deflake test-http2-options-max-headers-block-length (Luigi Pinca) #5795913f8f9cc12] - test: rename to getCallSites (Wuli Zuo) #5794892dce6ed6b] - test: force GC in test-file-write-stream4 (Luigi Pinca) #57930aa755d3acf] - test: enable skipped colorize test (Shima Ryuhei) #57887331f44c78c] - test: update WPT for WebCryptoAPI to164426a(Node.js GitHub Bot) #578544aaa8438b4] - test: add test for frame count being 0.5 (Jake Yuesong Li) #57732fb51d3a0c5] - test: fix the decimal fractions explaination (Jake Yuesong Li) #57732c6a45a9087] - Revert "test: add tests for REPL custom evals" (Tobias Nießen) #57793f3a4d03963] - test: add tests for REPL custom evals (Dario Piotrowicz) #57691a3be0df337] - test: update expected error message for macOS (Antoine du Hamel) #57742a7e73a0a74] - test: fix dangling promise in test_runner no isolation test setup (Jacob Smith) #57595edb7dd1ec7] - test_runner: match minimum file column to 'all files' (Shima Ryuhei) #57848c56f495e83] - tools: extract target abseil to abseil.gyp (Chengzhong Wu) #572891b37161a27] - tools: ignore V8 tests in CodeQL scans (Rich Trott) #5808123386308dd] - tools: enable CodeQL config file (Rich Trott) #580369c21abc169] - tools: ignore test directory in CodeQL scans (Rich Trott) #57978f210a1530d] - tools: add semver-major release support to release-lint (Antoine du Hamel) #57892234c417e98] - tools: add codeql nightly (Rafael Gonzaga) #57788938f1532da] - tools: edit create-release-proposal workflow to handle pr body length (Elves Vieira) #57841b362339f72] - tools: add zstd updater to workflow (KASEYA\yahor.siarheyenka) #5783161180db9c0] - tools: remove unusedosx-pkg-postinstall.sh(Antoine du Hamel) #576673ae04c94eb] - tools: do not use temp files when merging PRs (Antoine du Hamel) #57790d623c2c2b4] - tools: update gyp-next to 0.20.0 (Node.js GitHub Bot) #5768343ea4c532a] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #577215703147470] - tools: enable linter intest/fixtures/source-map/output(Antoine du Hamel) #5770080d58c372d] - tools: enable linter intest/fixtures/errors(Antoine du Hamel) #57701ef5275b7be] - tools: enable linter intest/fixtures/test-runner/output(Antoine du Hamel) #57698631733e41f] - tools: enable linter intest/fixtures/eval(Antoine du Hamel) #576996d0128695f] - tools: enable linter on some fixtures file (Antoine du Hamel) #57674f4d7cbae89] - tools: update ESLint to 9.23 (Antoine du Hamel) #576735a39a24cd1] - typings: fixModulesBindingtypes (Antoine du Hamel) #555492df7ce9ebd] - util: fix parseEnv handling of invalid lines (Augustin Mauroy) #57798416052a9f2] - util: fix formatting of objects with built-in Symbol.toPrimitive (Shima Ryuhei) #5783243490c8797] - (SEMVER-MINOR) util: addtypes.isFloat16Array()(Livia Medeiros) #5787930060e13d3] - util: preservelengthof deprecated functions (Livia Medeiros) #578069837e08a84] - util: fix parseEnv incorrectly splitting multiple ‘=‘ in value (HEESEUNG) #57421af41dd3c07] - watch: clarify completion/failure watch mode messages (Dario Piotrowicz) #579267229a29b47] - watch: check parent and child path properly (Jason Zhang) #574251b5a7c6dc8] - win: fix SIGQUIT on ClangCL (Stefan Stojanovic) #57659e935c3c6f2] - worker: add ESM version examples to worker docs (fisker Cheung) #57645dda6ca9172] - (SEMVER-MINOR) worker: add worker.getHeapStatistics() (Matteo Collina) #57888f2159f2a44] - zlib: fix pointer alignment (jhofstee) #57727v22.15.1: 2025-05-14, Version 22.15.1 'Jod' (LTS), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Commits
edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #578119f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709v22.15.0: 2025-04-23, Version 22.15.0 'Jod' (LTS), @UlisesGascon prepared by @RafaelGSSCompare Source
Notable Changes
3c88f3938b] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370db19a3f9fc] - (SEMVER-MINOR) assert: improve partialDeepStrictEqual (Ruben Bridgewater) #573701ee5f840b4] - (SEMVER-MINOR) cli: allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018872ee0f2ac] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #5738103a0f3a56b] - (SEMVER-MINOR) crypto: support --use-system-ca on Windows (Joyee Cheung) #5683394647bbdb2] - (SEMVER-MINOR) crypto: added support for reading certificates from macOS system store (Tim Jacomb) #565998f7b86a6e7] - deps: update timezone to 2025a (Node.js GitHub Bot) #56876f9f611fb58] - (SEMVER-MINOR) deps,tools: add zstd 1.5.6 (Jan Martin) #5210007a6d5f8cf] - (SEMVER-MINOR) dns: add TLSA record query and parsing (Rithvik Vibhu) #52983d8a83ef2f3] - doc: add @geeksilva97 to collaborators (Edy Silva) #572416b93ba723b] - (SEMVER-MINOR) module: use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698b2e44a8079] - (SEMVER-MINOR) module: implement module.registerHooks() (Joyee Cheung) #55698dc91ae7471] - (SEMVER-MINOR) process: add execve (Paolo Insogna) #56496bc672fcfdd] - (SEMVER-MINOR) sqlite: allow returningArrayBufferViews from user-defined functions (René) #567905edee197ab] - (SEMVER-MINOR) tls: implement tls.getCACertificates() (Joyee Cheung) #57107f9fe0e09ee] - (SEMVER-MINOR) util: expose diff function used by the assertion errors (Giovanni Bucci) #57462673a424180] - (SEMVER-MINOR) v8: add v8.getCppHeapStatistics() method (Aditi) #571464991e5d826] - (SEMVER-MINOR) zlib: add zstd support (Jan Martin) #52100Commits
ea70a379c3] - assert: improve partialDeepStrictEqual performance (Ruben Bridgewater) #575092b419d7e79] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370d817c17fd7] - (SEMVER-MINOR) assert: improve partialDeepStrictEqual (Ruben Bridgewater) #573707af0440073] - assert: improve myers diff performance (Giovanni Bucci) #5727901cf5fb871] - (SEMVER-MINOR) assert,util: improve performance (Ruben Bridgewater) #57370a58842cee4] - (SEMVER-MINOR) benchmark: adjust assert runtimes (Ruben Bridgewater) #57370b20b3697aa] - (SEMVER-MINOR) benchmark: skip running some assert benchmarks by default (Ruben Bridgewater) #57370ec5570fd1e] - (SEMVER-MINOR) benchmark: add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370b991bf4ca6] - benchmark: add a warmup on bench-openSync (Elves Vieira) #570514a455bc806] - build: fix update-wpt workflow (Jonas) #574686ec397e61c] - build: fix compatibility with V8'sdepot_tools(Richard Lau) #57330475aaca336] - build: print 'Formatting Markdown...' for long task markdown formatting (1ilsang) #5710873fced7a97] - build: fix GN build failure (Cheng) #57013af05f91425] - build: fix GN build of uv (Cheng) #56955fd3053e947] - build: gyp exclude libm linking on macOS (deepak1556) #569015ec6b9a50f] - build: remove explicit linker call to libm on macOS (deepak1556) #56901a893da9be7] - build: link with Security.framework in GN build (Cheng) #5689502cd8e0a50] - build: do not put commands in sources variables (Cheng) #5688573dc8c2140] - build: add double quotes around <(python) (Luigi Pinca) #5682665a3b5f73c] - build: add build option suppress_all_error_on_warn (Michael Dawson) #56647424aacc942] - build,win: disable node pch with ccache (Stefan Stojanovic) #57224901685c723] - build,win: enable ccache (Stefan Stojanovic) #5684779987676c1] - cli: clarify --cpu-prof-name allowed values (Eugenio Ceschia) #57433503d4237aa] - (SEMVER-MINOR) cli: allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018ada572b733] - crypto: ensure expected JWK alg in SubtleCrypto.importKey RSA imports (Filip Skokan) #574507e5aabde55] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #573817ea6ac1e09] - crypto: add support for intermediate certs in --use-system-ca (Tim Jacomb) #5716444b19ec534] - crypto: support --use-system-ca on non-Windows and non-macOS (Joyee Cheung) #57009e21d126438] - crypto: fix missing OPENSSL_NO_ENGINE guard (Shelley Vohr) #570122fdf82b357] - crypto: cleanup root certificates and skip PEM deserialization (Joyee Cheung) #5699903a0f3a56b] - (SEMVER-MINOR) crypto: support --use-system-ca on Windows (Joyee Cheung) #56833bbdb10bc2c] - crypto: fix X509* leak in --use-system-ca (Joyee Cheung) #568325470cab6d3] - crypto: add api to get openssl security level (Michael Dawson) #5660194647bbdb2] - (SEMVER-MINOR) crypto: added support for reading certificates from macOS system store (Tim Jacomb) #56599caf81ca549] - debugger: fix behavior of plain object exec in debugger repl (Dario Piotrowicz) #574981d703fe220] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #5779298457dfea3] - deps: update undici to 6.21.2 (Matteo Collina) #574424a852ba11b] - deps: V8: cherry-pickc172ffc(Choongwoo Han) #5743754a12e0bcc] - deps: update googletest to0bdccf4(Node.js GitHub Bot) #573802e350963e5] - deps: update acorn to 8.14.1 (Node.js GitHub Bot) #5738295e5d01c25] - deps: update amaro to 0.4.1 (marco-ippolito) #57121ef216deb05] - deps: update amaro to 0.3.2 (marco-ippolito) #569164ef4d6ecf6] - deps: update amaro to 0.3.1 (Node.js GitHub Bot) #56785a8bf5ef4a7] - deps: update simdjson to 3.12.2 (Node.js GitHub Bot) #570840bd612bb32] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #573357d65f79306] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #573355c88c52491] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265fa04bf4999] - deps: update gyp file for ngtcp2 1.11.0 (Richard Lau) #57225ca6b07258d] - deps: update cjs-module-lexer to 2.1.0 (Node.js GitHub Bot) #571800a72b16fe1] - deps: update ngtcp2 to 1.11.0 (Node.js GitHub Bot) #57179600fb41f54] - deps: update sqlite to 3.49.1 (Node.js GitHub Bot) #571787eb3b44010] - deps: update zlib to 1.3.0.1-motley-788cb3c (Node.js GitHub Bot) #56655257d22e181] - deps: update sqlite to 3.49.0 (Node.js GitHub Bot) #5665453a7bfce01] - deps: V8: cherry-pick9ab4059(Levi Zim) #56781636f65cb1a] - deps: update cjs-module-lexer to 2.0.0 (Michael Dawson) #568558f7b86a6e7] - deps: update timezone to 2025a (Node.js GitHub Bot) #56876db31276bfa] - deps: update simdjson to 3.12.0 (Node.js GitHub Bot) #56874d1d58d6198] - deps: update googletest toe235eb3(Node.js GitHub Bot) #5687305b3dff275] - deps: update simdjson to 3.11.6 (Node.js GitHub Bot) #56250f9f611fb58] - (SEMVER-MINOR) deps,tools: add zstd 1.5.6 (Jan Martin) #52100ef212a41a7] - dns: restore dns query cache ttl (Ethan Arrowood) #576407a10b01e97] - dns: remove redundant code using common variable (Deokjin Kim) #57386bc2603f086] - (SEMVER-MINOR) dns: add TLSA record query and parsing (Rithvik Vibhu) #5298338a2e5d60b] - doc: add gurgunday as triager (Gürgün Dayıoğlu) #57594b7ac0bd129] - doc: clarify behaviour of node-api adjust function (Michael Dawson) #57463fa834896c8] - doc: remove Corepack documentation (Antoine du Hamel) #576358988173286] - doc: remove mention of--requirenot supporting ES modules (Huáng Jùnliàng) #576203a7d179dbd] - doc: mention reports should align with Node.js CoC (Rafael Gonzaga) #57607983c5087f6] - doc: add section stating that very stale PRs should be closed (Dario Piotrowicz) #57541f4e1f702d4] - doc: add bjohansebas as triager (Sebastian Beltran) #575649b7fd6b076] - doc: update support channels (Claudio W.) #57538ef624aff55] - doc: remove cryptoStream API reference (Jonas) #575794a2afc255a] - doc: module resolution pseudocode corrections (Marcel Laverdet) #57080ee5059426d] - doc: add history entry for DEP0190 inchild_process.md(Antoine du Hamel) #575444deebb4fca] - doc: remove deprecated pattern inchild_process.md(Antoine du Hamel) #575686cd7b37d9c] - doc: mark multiple experimental APIS as stable (James M Snell) #57510c2f1fa0928] - doc: remove mertcanaltin from Triagers (Mert Can Altin) #575319b6047e520] - doc: recommend watching the collaborators repo in the onboarding doc (Darshan Sen) #57527bf1e297079] - doc: remove mention of visa fees from onboarding doc (Darshan Sen) #575261041331094] - doc: deprecate passingargstospawnandexecFile(Antoine du Hamel) #5738906994d5a75] - doc: remove some inconsistencies indeprecations.md(Antoine du Hamel) #57512707f851ba3] - doc: run license-builder (github-actions[bot]) #57511a7793195d6] - doc: add new writing-docs contributing md (Dario Piotrowicz) #5750230d4a43b3d] - doc: add node.js streams references to Web Streams doc (Dario Piotrowicz) #57393e08365980b] - doc: prefer to sign commits under nodejs repository (Rafael Gonzaga) #57311c35e1f9048] - doc: fixed the incorrect splitting of multiple words (letianpailove) #574543e1f3bc2bb] - doc: add review guidelines for collaborator nominations (Antoine du Hamel) #57449fef3f82a41] - doc: add history info for --use-system-ca (Darshan Sen) #5743296afdf949d] - doc: remove typo YAML snippet from tls.getCACertificates doc (Darshan Sen) #57459800d61d47e] - doc: fix typo in sqlite.md (Tobias Nießen) #574734876aee775] - doc: explicit mention arbitrary code execution as a vuln (Rafael Gonzaga) #574262dd72c658f] - doc: update maintaining-openssl.md for openssl (Richard Lau) #57413a49fd31f04] - doc: add missingdeprecatedbadges infs.md(Yukihiro Hasegawa) #573843a4ed77674] - doc: add note about sync nodejs-private branches (Rafael Gonzaga) #574041025e6dc7c] - doc: update Xcode version used for arm64 and pkg (Michaël Zasso) #5710477b9e04a70] - doc: improve type stripping documentation (Marco Ippolito) #569163a75e8410d] - doc: specificy support for erasable ts syntax (Marco Ippolito) #5691669f12f9686] - doc: make first parameter optional inutil.getCallSites(Deokjin Kim) #573872b4e737ffb] - doc: fix usage of module.registerSync in comment (Timo Kössler) #57328f320593958] - doc: add Darshan back as voting TSC member (Michael Dawson) #574022b7765469a] - doc: revise webcrypto.md types, interfaces, and added versions (Filip Skokan) #57376649828c74a] - doc: add info on how project manages social media (Michael Dawson) #573182a2e1cfd71] - doc: revisetsconfig.jsonnote (Steven) #5735317883b1d46] - doc: use more clear name in getSystemErrorMessage's example (ikuma-t) #573107feed9989b] - doc: recommend settingnoEmit: trueintsconfig.json(Steven) #57320fe707ab162] - doc: ping nodejs/tsc for each security pull request (Rafael Gonzaga) #57309f3c58ab693] - doc: fix Windows ccache section position (Stefan Stojanovic) #57326e69170bacd] - doc: update node-api version matrix (Chengzhong Wu) #572870bc1fd2245] - doc: recommenderasableSyntaxOnlyin ts docs (Rob Palmer) #57271068013744e] - doc: clarifypath.isAbsoluteis not path traversal mitigation (Eric Fortis) #57073238b0e856e] - doc: fix rendering of DEP0174 description (David Sanders) #56835db0bcefd14] - doc: add 1ilsang to triage team (1ilsang) #5718352a593feab] - doc: add @geeksilva97 to collaborators (Edy Silva) #5724189f4475e32] - doc: add missing assert return types (Colin Ihrig) #5721962b6d94c03] - doc: add streamResetBurst and streamResetRate (Sujal Raj) #57195f150017e70] - doc: add esm examples to node:util (Alfredo González) #5679399465ffa9c] - doc: update options to filehandle.appendFile() (Hasegawa-Yukihiro) #569726242520a90] - doc: add additional caveat for fs.watch (Michael Dawson) #5715019cda4791a] - doc: fix typo in Windows building instructions (Tim Jacomb) #57158ef206add59] - doc: fix web.libera.chat link in pull-requests.md (Samuel Bronson) #570767243c1713d] - doc: remove buffered flag from performance hooks examples (Pavel Romanov) #52607617fe71f67] - doc: fix 'introduced_in' version in typescript module (1ilsang) #571096cc15b8dc9] - doc: fix link and history ofSourceMapsections (Antoine du Hamel) #570986be8189041] - doc: addmodule namespace objectlinks (Dario Piotrowicz) #570938611c4a3ea] - doc: disambiguate pseudo-code statement (Dario Piotrowicz) #5709279da145a55] - doc: update clang-cl on Windows building guide (Joyee Cheung) #57087845eaf91be] - doc: fix wrong articles used to address modules (Dario Piotrowicz) #5709042c5e23eb1] - doc:modules.md: fixdistancedefinition (Alexander “weej” Jones) #57046bda851aaa3] - doc: fix wrong verb form (Dario Piotrowicz) #5709164e13fd36e] - doc: fix transpiler loader hooks documentation (Joyee Cheung) #5703751494d8b78] - doc: add a note aboutrequire('../common')in testing documentation (Aditi) #56953053b128e9c] - doc: recommend writing tests in new files and including comments (Joyee Cheung) #57028a20c62a00c] - doc: improve documentation on argument validation (Aditi) #569542921658813] - doc: buffer: fix typo onBuffer.copyBytesFrom(offsetoption (tpoisseau) #570156f4ab1c9b2] - doc: update cleanup to trust on vuln db automation (Rafael Gonzaga) #570045285facb3e] - doc: move stability index after history section for consistency (Antoine du Hamel) #56997a7646e17ff] - doc: addsignaltofilehandle.writeFile()options (Yukihiro Hasegawa) #56804ba031089e6] - doc: run license-builder (github-actions[bot]) #56985afa6f93a32] - doc: update history of stream.Readable.toWeb() (Jimmy Leung) #56928cc644de126] - doc: make MDN links to global classes more consistent (Antoine du Hamel) #5692493bba4eee1] - doc: make MDN links to global classes more consistent inassert.md(Antoine du Hamel) #56920ad03c85f98] - doc: make MDN links to global classes more consistent (Antoine du Hamel) #5692396c2a90dee] - doc: make MDN links to global classes more consistent inutil.md(Antoine du Hamel) #569226bb73c0745] - doc: make MDN links to global classes more consistent inbuffer.md(Antoine du Hamel) #56921824cf35475] - doc: update post sec release process (Rafael Gonzaga) #56907027749eb17] - doc: update websocket link to avoid linking to self (Chengzhong Wu) #568975dcb9d632b] - doc: mark--env-file-if-existsflag as experimental (Juan José) #568934f6d751bf5] - doc: fix typo in cjs example ofutil.styleText(Deokjin Kim) #56769313d9db7a5] - doc: clarify sqlite user-defined function behaviour (René) #56786eff42956c4] - doc: correct customization hook types & clarify descriptions (Jacob Smith) #5645464180421c2] - events: getMaxListeners detects 0 listeners (Matthew Aitken) #568072de27787b4] - fs: apply exclude function to root path (Rich Trott) #57420b6df9e350a] - fs: handle UV_ENOTDIR infs.statSyncwiththrowIfNoEntryprovided (Juan José Arboleda) #5699614b2d496a0] - fs: makeFileHandle.readableWebStreamalways create byte streams (Ian Kerins) #5546110d2f1d898] - http: coerce content-length to number (Marco Ippolito) #574589192b7fa25] - http: be more generational GC friendly (ywave620) #567671cf98a8788] - inspector: convert event params to protocol without json (Chengzhong Wu) #570276dcad868bb] - inspector: skip promise hook in the inspector async hook (Joyee Cheung) #57148787e93f75a] - inspector: add Network.Initiator in inspector protocol (Chengzhong Wu) #56805c7c04d0dc8] - inspector: fix GN build (Cheng) #56798177da9c3c3] - inspector: fix StringUtil::CharacterCount for unicodes (Chengzhong Wu) #567881b5418eeea] - lib: add warning when binding inspector to public IP (Demian Parkhomenko) #55736cc4d33842b] - lib: limit split function calls to prevent excessive array length (Gürgün Dayıoğlu) #575010546612d1d] - lib: make getCallSites sourceMap option truly optional (James M Snell) #57388d7d54e6bf3] - lib: optimize priority queue (Gürgün Dayıoğlu) #5710062761c73a1] - lib: fixup incorrect argument order in assertEncoding (James M Snell) #571775dce55c376] - meta: add some clarification to the nomination process (James M Snell) #57503a2a4cf1d95] - meta: remove collaborator self-nomination (Rich Trott) #57537244f74b844] - meta: edit collaborator nomination process (Antoine du Hamel) #57483dec204bb3f] - meta: move ovflowd to emeritus (Claudio W.) #57443c0b8b84384] - meta: bump codecov/codecov-action from 5.3.1 to 5.4.0 (dependabot[bot]) #5725714cbe292da] - meta: bump github/codeql-action from 3.28.8 to 3.28.10 (dependabot[bot]) #5725469d2dd69e2] - meta: bump ossf/scorecard-action from 2.4.0 to 2.4.1 (dependabot[bot]) #572535f3428ded6] - meta: move RaisinTen back to collaborators, triagers and SEA champion (Darshan Sen) #572923eea8c72fc] - meta: bump actions/download-artifact from 4.1.8 to 4.1.9 (dependabot[bot]) #572602508893edb] - meta: bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 (dependabot[bot]) #57259fc09523f44] - meta: bump step-security/harden-runner from 2.10.4 to 2.11.0 (dependabot[bot]) #57258b162402440] - meta: bump actions/cache from 4.2.0 to 4.2.2 (dependabot[bot]) #57256f781be1332] - meta: bump actions/upload-artifact from 4.6.0 to 4.6.1 (dependabot[bot]) #572557934ad9fc0] - meta: bumpactions/setup-pythonfrom 5.3.0 to 5.4.0 (dependabot[bot]) #56867eb4fb9ce90] - meta: bumppeter-evans/create-pull-requestfrom 7.0.5 to 7.0.6 (dependabot[bot]) #56866a14e7f1cc4] - meta: bumpmozilla-actions/sccache-actionfrom 0.0.6 to 0.0.7 (dependabot[bot]) #568656c8a9e3d0d] - meta: bumpcodecov/codecov-actionfrom 5.0.7 to 5.3.1 (dependabot[bot]) #56864f438c27cbf] - meta: bumpstep-security/harden-runnerfrom 2.10.2 to 2.10.4 (dependabot[bot]) #5686324b7fcb153] - meta: bumpactions/cachefrom 4.1.2 to 4.2.0 (dependabot[bot]) #56862a0afc47988] - meta: bumpactions/stalefrom 9.0.0 to 9.1.0 (dependabot[bot]) #568608abf4e5d7d] - meta: bumpgithub/codeql-actionfrom 3.27.5 to 3.28.8 (dependabot[bot]) #56859c5bff736e9] - meta: add CODEOWNERS for SQLite (Colin Ihrig) #57147fd2abaa088] - meta: update last name for jkrems (Jan Martin) #570062383f00aae] - meta: bumpactions/upload-artifactfrom 4.4.3 to 4.6.0 (dependabot[bot]) #5686135b3140d03] - meta: bumpactions/setup-nodefrom 4.1.0 to 4.2.0 (dependabot[bot]) #56868815fcef73d] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #5688908001127a2] - meta: add @nodejs/url as codeowner (Chengzhong Wu) #567833ceda2a035] - module: handle cached linked async jobs in require(esm) (Joyee Cheung) #571874c29cc7e6b] - module: add dynamic file-specific ESM warnings (Mert Can Altin) #56628d1845edd21] - module: improve error message from asynchronicity in require(esm) (Joyee Cheung) #5712641fa7d3c21] - module: allow omitting context in synchronous next hooks (Joyee Cheung) #57056deddecce3a] - module: fix require.resolve() crash on non-string paths (Aditi) #56942926b887534] - module: fixing url change in load sync hook chain (Vitalii Akimov) #564026b93ba723b] - (SEMVER-MINOR) module: use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698b2e44a8079] - (SEMVER-MINOR) module: implement module.registerHooks() (Joyee Cheung) #55698e79e67f6dc] - net: validate non-string host for socket.connect (Daeyeon Jeong) #57198e23056212e] - net: replace brand checks with identity checks (Yagiz Nizipli) #573419c0d5e140b] - net: emit an error when custom lookup resolves to a non-string address (Edy Silva) #571922ce79787de] - (SEMVER-MINOR) process: add execve (Paolo Insogna) #56496712db2232c] - readline: add support forSymbol.dispose(Antoine du Hamel) #5727655fb81c0f1] - readline: fix unresolved promise on abortion (Daniel Venable) #54030dfcd9b1ac2] - sea: suppress builtin warning with disableExperimentalSEAWarning option (koooge) #57086bd5c90654a] - sqlite: add support for unknown named parameters (Colin Ihrig) #57552ec571382a4] - sqlite: add DatabaseSync.prototype.isOpen (Colin Ihrig) #57522bb3bbed126] - sqlite: add DatabaseSync.prototype[Symbol.dispose]() (Colin Ihrig) #575066067bea027] - sqlite: restore changes from #55373 (Colin Ihrig) #56908bc672fcfdd] - (SEMVER-MINOR) sqlite: allow returningArrayBufferViews from user-defined functions (René) #56790227603dc30] - sqlite,test,doc: allow Buffer and URL as database location (Edy Silva) #569919dd324467a] - src: cleanup aliased_buffer.h (Mohammed Keyvanzadeh) #5739545a2b8532b] - src: do not pass nullptr to std::string ctor (Charles Kerr) #57354854370a06c] - src: fix process exit listeners not receiving unsettled tla codes (Dario Piotrowicz) #56872f7fb259193] - src: refactor SubtleCrypto algorithm and length validations (Filip Skokan) #57319c7bcc2d6c8] - src: allow embedder customization of OOMErrorHandler (Shelley Vohr) #57325fbd8862156] - src: use Maybe<void> in ProcessEmitWarningSync (Daeyeon Jeong) #5725004de550289] - src: make even more improvements to error handling (James M Snell) #57264f1c5e46f89] - src: use cachedemitv8::String (Daeyeon Jeong) #5724965b8e12689] - src: refactor SubtleCrypto algorithm and length validations (Filip Skokan) #57273b6091a8b21] - src: make more error handling improvements (James M Snell) #572623bd8a6c76e] - src: fix typo in comment (Antoine du Hamel) #57291f7e39385ae] - src: improve error handling innode_messaging.cc(James M Snell) #572111bb561bede] - src: improve error handling intty_wrap.cc(James M Snell) #57211567d321a40] - src: improve error handling intcp_wrap.cc(James M Snell) #57211f8bee871f7] - src: fix ThrowInvalidURL call in PathToFileURL (Daniel M Brasil) #57141817f7d0e2e] - src: improve error handling in buffer and dotenv (James M Snell) #5718911ef7f9d9c] - src: improve error handling in module_wrap (James M Snell) #571883b08d718b1] - src: improve error handling in spawn_sync (James M Snell) #571859221c2ad87] - src: detect whether the string is one byte representation or not (theweipeng) #56147e323694772] - src: fix crash when lazy getter is invoked in a vm context (Chengzhong Wu) #571689363b05a91] - src: do not format single string argument for THROW_ERR_* (Joyee Cheung) #571265d6a1bc35b] - src: move instead of copy shared pointer in node_blob (Michaël Zasso) #571205dab48fd9f] - src: replace NewFromUtf8 with OneByteString where appropriate (James M Snell) #570960fe60b478d] - src: portdefineLazyPropertiesto native code (Antoine du Hamel) #57081792959db1d] - src: improve error handling in node_blob (James M Snell) #57078e05e2cfb1e] - src: fix accessing empty string (Cheng) #57014619e52ce8d] - src: lock the isolate properly in IsolateData destructor (Joyee Cheung) #57031844a4a884d] - src: add self-assigment memcpy checks (Burkov Egor) #569860d1e79740f] - src: improve node::Dotenv trimming (Dario Piotrowicz) #5698350f164e23b] - src: improve error handling in string_bytes/decoder (James M Snell) #5697893aa4393a4] - src: improve error handling in process_wrap (James M Snell) #56977c1c824e38d] - src: useargs.This()in zlib (Michaël Zasso) #569880a8e474bdc] - src: add nullptr handling forNativeKeyObject(Burkov Egor) #569001ea6198a5a] - src: disallow copy/move fns/constructors (Yagiz Nizipli) #56811e4100853cb] - src: add a hard dependency v8_inspector_headers (Chengzhong Wu) #56805a1f92898c0] - src: improve error handling in encoding_binding.cc (James M Snell) #56915dee8793d94] - src: improve error handling in permission.cc (James M Snell) #56904f41bc4cfd7] - src: improve error handling in node_sqlite (James M Snell) #56891e4df6181bf] - src: improve error handling in node_os by removing ToLocalChecked (James M Snell) #568882c96e7a32c] - src: improve error handling in node_url (James M Snell) #5688636926ae8d8] - src: add check for Bignum in GroupOrderSize (Burkov Egor) #56702a68f127a30] - src: reduce string allocations on sqlite (Yagiz Nizipli) #57227e41b1735f1] - stream: fix sizeAlgorithm validation in WritableStream (Daeyeon Jeong) #572803bc877dc5c] - test: add more number cases for buffer.indexOf (Meghan Denny) #57200cac9a4e832] - test: update parallel/test-tls-dhe for OpenSSL 3.5 (Richard Lau) #574773082ab3a64] - test: module syntax should throw (Marco Ippolito) #571219b0dfc9a44] - test: update snapshots for amaro v0.3.2 (Marco Ippolito) #569162defc35ea8] - test: test runner run plan (Pietro Marchini) #57304ccb3df70be] - test: update WPT for WebCryptoAPI toedd42c0(Node.js GitHub Bot) #57365528103c5d0] - test: simplify test-tls-connect-abort-controller.js (Yagiz Nizipli) #5733817e21e6eb5] - test: useassert.matchintest-esm-import-meta(Antoine du Hamel) #5729077bbee5184] - test: update compression wpt (Yagiz Nizipli) #569604fe88f8f53] - Revert "test: temporary remove resource check from fs read-write" (Rafael Gonzaga) #56906766efc7758] - test: more common.mustNotCall in net, tls (Meghan Denny) #57246562e635e11] - test: swap assert.strictEqual() parameters (Luigi Pinca) #5721764fdfd5622] - test: assert write return values in buffer-bigint64 (Meghan Denny) #57212dd538e7cf1] - test: allow embedder running async context frame test (Shelley Vohr) #57193937bbeb2b6] - test: resolve race condition in test-net-write-fully-async-* (Matteo Collina) #5702232df9f27d8] - test: add doAppendAndCancel test (Hasegawa-Yukihiro) #5697290c98df258] - test: fix test-without-async-context-frame.mjs in debug mode (Joyee Cheung) #57034974817c9fc] - test: make eval snapshot comparison more flexible (Shelley Vohr) #5702009741cd129] - test: simplify test-http2-client-promisify-connect-error (Luigi Pinca) #5714489f3feb364] - test: improve error output of test-http2-client-promisify-connect-error (Antoine du Hamel) #5713525751eba4d] - test: add case for unrecognised fields within pjson "exports" (Jacob Smith) #57026bf0b9fa7c0] - test: remove unnecessary assert requiring from tests (Dario Piotrowicz) #570088cfb2df466] - test: reduce flakiness on test-net-write-fully-async-buffer (Yagiz Nizipli) #5697143c8c101da] - test: remove flakiness on macOS test (Yagiz Nizipli) #56971bd47178f7f] - test: improve timeout duration for debugger events (Yagiz Nizipli) #5697065694aa2fd] - test: remove unnecessary syscall to cpuinfo (Yagiz Nizipli) #569685633c4b2df] - test: update webstorage wpt (Yagiz Nizipli) #569632244a2776a] - test: execute shell directly for refresh() (Yagiz Nizipli) #55051afae4b1216] - test: change jenkins reporter (Carlos Espa) #56808b26592a7c4] - test: fix race condition in test-child-process-bad-stdio (Colin Ihrig) #5684572c2279649] - test: adjust check to use OpenSSL sec level (Michael Dawson) #568199551b27651] - test: test-crypto-scrypt.js doesn't need internals (Meghan Denny) #566733095db84be] - test: settest-fs-cpas flaky (Stefan Stojanovic) #5679931f98d7ccd] - test: search cctest files (Chengzhong Wu) #56791267f17d5f6] - test: convert test_encoding_binding.cc to a JS test (Chengzhong Wu) #56791a875d7bdd1] - test: test-crypto-prime.js doesn't need internals (Meghan Denny) #5667585482d69c6] - test: temporary remove resource check from fs read-write (Rafael Gonzaga) #56789ec63d72f16] - test: mark test-without-async-context-frame flaky on windows (James M Snell) #56753f16acc8521] - test: remove unnecessary code (Luigi Pinca) #567840573c19a97] - test: marktest-esm-loader-hooks-inspect-waitflaky (Richard Lau) #5680348e0fd3f13] - test: update WPT for url toa23788b(Node.js GitHub Bot) #56779642959b87f] - test: remove duplicate error reporter from ci (Carlos Espa) #567392023237b4e] - test,crypto: make tests work for BoringSSL (Shelley Vohr) #570211b33b976ec] - test_runner: refactor testPlan counter increse (Pietro Marchini) #56765d860f2bf42] - test_runner: differentiate test types in enqueue dequeue events (Eddie Abbondanzio) #54049993bab646c] - test_runner: print formatted errors on summary (Pietro Marchini) #569113ed3ba438f] - test_runner: allow special characters in snapshot keys (Carlos Espa) #57017d1da9a3a2f] - timers: optimize timer functions with improved argument handling (Gürgün Dayıoğlu) #5707244aa13990a] - timers: remove unnecessary allocation of _onTimeout (Gürgün Dayıoğlu) #57497401b965977] - timers: remove unused parameter from insertGuarded (Gürgün Dayıoğlu) #572519eac9c02c9] - timers: simplify the compareTimersLists function (Gürgün Dayıoğlu) #5711001215af350] - tls: remove unnecessary type check on normalize (Yagiz Nizipli) #57336f5e2b12a60] - (SEMVER-MINOR) tls: implement tls.getCACertificates() (Joyee Cheung) #571077a777cdb58] - tools: fix WPT update cron string (Antoine du Hamel) #57665c6d90dbf9b] - tools: remove stalled label on unstalled issues and PRs (Rich Trott) #5763096f7f64602] - tools: update sccache to support GH cache changes (Michaël Zasso) #575730b87027520] - tools: bump @babel/helpers from 7.26.9 to 7.26.10 in /tools/eslint (dependabot[bot]) #574447d561eb90c] - tools: add config subspace (Marco Ippolito) #5723946efdbf59f] - tools: import rather than require ESLint plugins (Michaël Zasso) #57315502bfaf876] - tools: switch back to official OpenSSL (Richard Lau) #57301ea821f419d] - tools: revert to use @stylistic/eslint-plugin-js v3 (Joyee Cheung) #57314bb857615d3] - tools: add more details about rolling inspector_protocol (Chengzhong Wu) #571673f29d39c1b] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #57261b3caac83d4] - tools: remove deps/zlib/GN-scraper.py (Chengzhong Wu) #57238ace99ffe79] - tools: run Linux tests on GitHub arm64 runners as well (Dennis Ameling) #57162e65e6269b7] - tools: consolidate 'introduced_in' check for docs (1ilsang) #57109890841e64b] - tools: do not run major-release workflow on forks (Rich Trott) #57064e3f86c5a0c] - tools: fix release URL computation in update-root-certs.mjs (Joyee Cheung) #56843280316f773] - tools: add support forimport sourcesyntax in linter (Antoine du Hamel) #56992998b2ae3cd] - tools: bump eslint version (dependabot[bot]) #56869ca4121b95a] - tools: remove test-asan/ubsan workflows (Michaël Zasso) #56823866ac37255] - tools: run macOS test workflow with Xcode 16.1 (Michaël Zasso) #5683155ca46ad8e] - tools: update sccache and sccache-action (Michaël Zasso) #56815be9c1c93a8] - tools: fix license-builder for inspector_protocol (Michaël Zasso) #568146dab980fab] - typings: fixImportModuleDynamicallyCallbackreturn type (Chengzhong Wu) #57160e301098854] - util: avoid run debug when enabled is false (fengmk2) #5749417016d7722] - (SEMVER-MINOR) util: expose diff function used by the assertion errors (Giovanni Bucci) #5746242b9e19f6b] - util: enforce shouldColorize in styleText array arg (Marco Ippolito) #567225ed6d8be40] - (SEMVER-MINOR) v8: add v8.getCppHeapStatistics() method (Aditi) #57146c06d218b23] - win,build: add option to enable Control Flow Guard (Hüseyin Açacak) #566058202211140] - win,test: disable test case failing with ClangCL (Stefan Stojanovic) #573971a12b4c119] - zlib: use modern class syntax for zstd classes (Yagiz Nizipli) #56965f9b3680268] - zlib: make all zstd functions experimental (Yagiz Nizipli) #569644991e5d826] - (SEMVER-MINOR) zlib: add zstd support (Jan Martin) #52100v22.14.0: 2025-02-11, Version 22.14.0 'Jod' (LTS), @aduh95Compare Source
Notable Changes
82a9000e9e] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566b7fe54fc88] - (SEMVER-MINOR) fs: allowexcludeoption in globs to accept glob patterns (Daeyeon Jeong) #564893ac92ef607] - (SEMVER-MINOR) lib: add typescript support to STDIN eval (Marco Ippolito) #563591614e8e7bc] - (SEMVER-MINOR) module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX (Marco Ippolito) #566106d6cffa9cc] - (SEMVER-MINOR) module: addfindPackageJSONutil (Jacob Smith) #55412d35333ae18] - (SEMVER-MINOR) process: add process.ref() and process.unref() methods (James M Snell) #5640007ff3ddcb5] - (SEMVER-MINOR) sqlite: support TypedArray and DataView inStatementSync(Alex Yang) #5638594d3fe1b62] - (SEMVER-MINOR) src: add --disable-sigusr1 to prevent signal i/o thread (Rafael Gonzaga) #564415afffb4415] - (SEMVER-MINOR) src,worker: add isInternalWorker (Carlos Espa) #56469697a851fb3] - (SEMVER-MINOR) test_runner: add TestContext.prototype.waitFor() (Colin Ihrig) #56595047537b48c] - (SEMVER-MINOR) test_runner: add t.assert.fileSnapshot() (Colin Ihrig) #56459926cf84e95] - (SEMVER-MINOR) test_runner: add assert.register() API (Colin Ihrig) #56434c658a8afdf] - (SEMVER-MINOR) worker: add eval ts input (Marco Ippolito) #56394Commits
bad1ad8650] - assert: make myers_diff function more performant (Giovanni Bucci) #56303e222e36f3b] - assert: make partialDeepStrictEqual work with urls and File prototypes (Giovanni Bucci) #56231e232789fe2] - assert: show diff when doing partial comparisons (Giovanni Bucci) #56211c99de1fdcf] - assert: make partialDeepStrictEqual throw when comparing [0] with [-0] (Giovanni) #562372386fd5840] - benchmark: add validateStream to styleText bench (Rafael Gonzaga) #56556b197dfa7ec] - build: fix GN build for ngtcp2 (Cheng) #563002a3cdd34ff] - build: test macos-13 on GitHub actions (Michaël Zasso) #5630712f716be0a] - build: build v8 with -fvisibility=hidden on macOS (Joyee Cheung) #56275c5ca15bd34] - child_process: fix parsing messages with splitted length field (Maksim Gorkov) #561068346b8fc2c] - crypto: add missing return value check (Michael Dawson) #5661582a9000e9e] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566890eef20a1] - crypto: fix checkPrime crash with large buffers (Santiago Gimeno) #565595edb7b5e87] - crypto: fix warning of ignoring return value (Cheng) #56527b89f123a0b] - crypto: make generatePrime/checkPrime interruptible (James M Snell) #5646063c1859e01] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #56795a48430d4d3] - deps: move inspector_protocol to deps (Chengzhong Wu) #5664974cccc824f] - deps: macro ENODATA is deprecated in libc++ (Cheng) #56698fa869ea0f2] - deps: fixup some minor coverity warnings (James M Snell) #566121a4fa2b015] - deps: update amaro to 0.3.0 (Node.js GitHub Bot) #56568b47076fd82] - deps: update amaro to 0.2.2 (Node.js GitHub Bot) #5656846bd4b8731] - deps: update simdutf to 6.0.3 (Node.js GitHub Bot) #565678ead9c693b] - deps: update simdutf to 5.7.2 (Node.js GitHub Bot) #5638818d4b502af] - deps: update amaro to 0.2.1 (Node.js GitHub Bot) #56390d938d7cc86] - deps: update googletest to7d76a23(Node.js GitHub Bot) #563879761e7dccb] - deps: update googletest toe54519b(Node.js GitHub Bot) #563708319dc6bc5] - deps: update ngtcp2 to 1.10.0 (Node.js GitHub Bot) #563346eacd19d6a] - deps: update simdutf to 5.7.0 (Node.js GitHub Bot) #5633228bec2dda3] - diagnostics_channel: capture console messages (Stephen Belanger) #56292d519d33502] - doc: update macOS and Xcode versions for releases (Michaël Zasso) #56337fcfe650507] - doc: add note for features usingInternalWorkerwith permission model (Antoine du Hamel) #56706efbba182b5] - doc: add entry to changelog about SQLite Session Extension (Bart Louwers) #5631831bf9c7dd9] - doc: move anatoli to emeritus (Michael Dawson) #565926096e38c7c] - doc: fix styles of the expandable TOC (Antoine du Hamel) #56755d423638281] - doc: add "Skip to content" button (Antoine du Hamel) #56750edeb157d75] - doc: improve accessibility of expandable lists (Antoine du Hamel) #567491a79e87687] - doc: add note regarding commit message trailers (Dario Piotrowicz) #56736927c7e47e4] - doc: fix typo in example code for util.styleText (Robin Mehner) #56720fade522538] - doc: fix inconsistencies inWeakSetandWeakMapcomparison details (Shreyans Pathak) #5668355533bf147] - doc: add RafaelGSS as latest sec release stewards (Rafael Gonzaga) #566828e978bdee1] - doc: clarify cjs/esm diff inqueueMicrotask()vsprocess.nextTick()(Dario Piotrowicz) #56659ae360c30dc] - doc:WeakSetandWeakMapcomparison details (Shreyans Pathak) #56648acd2a2fda5] - doc: mention prepare --security (Rafael Gonzaga) #56617d3c0a2831d] - doc: tweak info on reposts in ambassador program (Michael Dawson) #565893299505b49] - doc: add type stripping to ambassadors program (Marco Ippolito) #56598b1a6ffa4e4] - doc: improve internal documentation on built-in snapshot (Joyee Cheung) #565051641a28930] - doc: document CLI way to open the nodejs/bluesky PR (Antoine du Hamel) #565062042628fda] - doc: add section about using npx with permission model (Rafael Gonzaga) #56539ace19a0263] - doc: update gcc-version for ubuntu-lts (Kunal Kumar) #565534aa57b50f8] - doc: fix parentheses in options (Tobias Nießen) #56563b40b01b4d3] - doc: include CVE to EOL lines as sec release process (Rafael Gonzaga) #565206701360113] - doc: add esm examples to node:trace_events (Alfredo González) #56514d3207cca3e] - doc: add message for Ambassadors to promote (Michael Dawson) #5623597ece4ae06] - doc: allow request for TSC reviews via the GitHub UI (Antoine du Hamel) #5649303f25055ab] - doc: add example for piping ReadableStream (Gabriel Schulhof) #56415516d07482c] - doc: expand description ofparseArg'sdefault(Kevin Gibbons) #54431a6491effcb] - doc: use<ul>instead of<ol>inSECURITY.md(Antoine du Hamel) #56346e4ec134b21] - doc: clarify that WASM is trusted (Matteo Collina) #563450f7aed8a59] - doc: fix thecrc32documentation (Kevin Toshihiro Uehara) #55898721104a296] - doc: fix links inmodule.md(Antoine du Hamel) #56283928540d792] - doc: fix typos (Nathan Baulch) #55066e69d35f03b] - doc: add history info for Permission Model (Antoine du Hamel) #56707c6fd867ab5] - esm: fix jsdoc type refs toModuleJobBasein esm/loader (Jacob Smith) #564999cf9046bd7] - Revert "events: add hasEventListener util for validate" (origranot) #56282b7fe54fc88] - (SEMVER-MINOR) fs: allowexcludeoption in globs to accept glob patterns (Daeyeon Jeong) #564896ca27c2a59] - http2: omit server name when HTTP2 host is IP address (islandryu) #565309f1fa199bf] - inspector: roll inspector_protocol (Chengzhong Wu) #566490dae4bb3ab] - inspector: add undici http tracking support (Chengzhong Wu) #564882c6124cec4] - inspector: report loadingFinished until the response data is consumed (Chengzhong Wu) #5637296ec862ce2] - lib: refactor execution.js (Marco Ippolito) #563583ac92ef607] - (SEMVER-MINOR) lib: add typescript support to STDIN eval (Marco Ippolito) #56359d5bf3db0cf] - lib: allow skipping source maps in node_modules (Chengzhong Wu) #56639d33eaf2bcb] - lib: ensure FORCE_COLOR forces color output in non-TTY environments (Pietro Marchini) #55404dc003218a8] - lib: optimizeprepareStackTraceon builtin frames (Chengzhong Wu) #56299df06524863] - lib: suppress source map lookup exceptions (Chengzhong Wu) #5629935335a5a66] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #565801faabdb150] - meta: add codeowners of security release document (Rafael Gonzaga) #56521b4ece22ef5] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #563429ec67e7ce0] - meta: move MoLow to TSC regular member (Moshe Atlow) #56276bae4b2e20a] - module: use more defensive code when handling SWC errors (Antoine du Hamel) #566461614e8e7bc] - (SEMVER-MINOR) module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX (Marco Ippolito) #56610174d88eab1] - module: support eval with ts syntax detection (Marco Ippolito) #56285299d6fa829] - module: fix jsdoc forformatparameter in cjs/loader (pacexy) #565010307e4dd59] - module: unify TypeScript and .mjs handling in CommonJS (Joyee Cheung) #555901f4f9be93d] - module: fix async resolution error within the syncfindPackageJSON(Jacob Smith) #56382bbedffa0f0] - module: simplifyfindPackageJSONimplementation (Antoine du Hamel) #555436d6cffa9cc] - (SEMVER-MINOR) module: addfindPackageJSONutil (Jacob Smith) #55412cd7ce18233] - module: fix badrequire.resolvewith option paths for.and..(Dario Piotrowicz) #56735152df4da21] - module: rethrow amaro error message (Marco Ippolito) #56568acba5dc87e] - module: use buffer.toString base64 (Chengzhong Wu) #5631501e69be8ff] - node-api: define version 10 (Gabriel Schulhof) #55676724524528e] - node-api: remove deprecated attribute from napi_module_register (Vladimir Morozov) #56162c78e11064f] - process: remove support for undocumented symbol (Antoine du Hamel) #565523f69b18a23] - process: fix symbol key and mark experimental newnode:processmethods (Antoine du Hamel) #56517d35333ae18] - (SEMVER-MINOR) process: add process.ref() and process.unref() methods (James M Snell) #56400fa49f0f7d5] - punycode: limit deprecation warning (Colin Ihrig) #56632d77c7073b7] - sqlite: disable memstatus APIs at build time (Colin Ihrig) #5654107ff3ddcb5] - (SEMVER-MINOR) sqlite: support TypedArray and DataView inStatementSync(Alex Yang) #56385b6c2e91365] - sqlite: enable SQL math functions (Colin Ihrig) #564473462263e8b] - sqlite: pass conflict type to conflict resolution handler (Bart Louwers) #5635289ba3af743] - src: add nullptr handling from X509_STORE_new() (Burkov Egor) #5670089a7c82e0c] - src: add default value for RSACipherConfig mode field (Burkov Egor) #567017bae51e62e] - src: fix build with GCC 15 (tjuhaszrh) #56740432a4b8bd6] - src: fix to generate path from wchar_t via wstring (yamachu) #566968c9eaf82f0] - src: initialize FSReqWrapSync in path that uses it (Michaël Zasso) #56613bcdb42d40b] - src: handle duplicate paths granted (Rafael Gonzaga) #56591d6a7acc207] - src: update ECKeyPointer in ncrypto (James M Snell) #5652601922f8b1f] - src: update ECPointPointer in ncrypto (James M Snell) #565262a3a36eceb] - src: update ECGroupPointer in ncrypto (James M Snell) #5652667c10cdacb] - src: update ECDASSigPointer implementation in ncrypto (James M Snell) #5652617f931c68b] - src: cleaning up more crypto internals for ncrypto (James M Snell) #5652694d3fe1b62] - (SEMVER-MINOR) src: add --disable-sigusr1 to prevent signal i/o thread (Rafael Gonzaga) #564416594ee8dff] - src: fix undefined script name in error source (Chengzhong Wu) #56502b46bad3e91] - src: refactor --trace-env to reuse option selection and handling (Joyee Cheung) #5629376921b822b] - src: minor cleanups on OneByteString usage (James M Snell) #564823f0d1dd4fe] - src: move more crypto impl detail to ncrypto dep (James M Snell) #5642104f623b283] - src: fixup more ToLocalChecked uses in node_file (James M Snell) #564845aa436f5a1] - src: make some minor ToLocalChecked cleanups (James M Snell) #564836eec5e7ec2] - src: lock the thread properly in snapshot builder (Joyee Cheung) #563275614993968] - src: drain platform tasks before creating startup snapshot (Chengzhong Wu) #5640348493e9fd5] - src: use LocalVector in more places (James M Snell) #564577e5ea0681e] - src: use v8::LocalVector consistently with other minor cleanups (James M Snell) #56417ad3d857f2b] - src: use starts_with in fs_permission.cc (ishabi) #558115afffb4415] - (SEMVER-MINOR) src,worker: add isInternalWorker (Carlos Espa) #564697d1676e72e] - stream: fix typo in ReadableStreamBYOBReader.readIntoRequests (Mattias Buelens) #56560e658ea6b26] - stream: validate undefined sizeAlgorithm in WritableStream (Jason Zhang) #56067e4f133c20c] - test: add ts eval snapshots (Marco Ippolito) #56358f041742400] - test: remove empty lines from snapshots (Marco Ippolito) #56358801cde91f6] - test: reduce number of written chunks (Luigi Pinca) #567576fdf1879ab] - test: fix invalid common.mustSucceed() usage (Luigi Pinca) #56756d2bfbfa364] - test: use strict mode in global setters test (Rich Trott) #567425c030da42f] - test: cleanup and simplify test-crypto-aes-wrap (James M Snell) #56748f1442d6eaf] - test: do not use common.isMainThread (Luigi Pinca) #5676849405bd9e7] - test: make some requires lazy in common/index (James M Snell) #5671552ef376788] - test: add test that uses multibyte for path and resolves modules (yamachu) #56696b811dea85a] - test: replace more uses ofglobalwithglobalThis(James M Snell) #56712eb97076199] - test: make common/index slightly less node.js specific (James M Snell) #567121795202d19] - test: rely less on duplicative common test harness utilities (James M Snell) #567125be29a274e] - test: simplify common/index.js (James M Snell) #5671292e99780f0] - test: move hasMultiLocalhost to common/net (James M Snell) #567161c3204a4cc] - test: move crypto related common utilities in common/crypto (James M Snell) #56714fe79d63be0] - test: add missing test for env file (Jonas) #56642e08af61537] - test: enforce strict mode in test-zlib-const (Rich Trott) #56689c96792d7f8] - test: fix localization data for ICU 74.2 (Antoine du Hamel) #5666148b72f1195] - test: use --permission instead of --experimental-permission (Rafael Gonzaga) #56685de81d90fce] - test: test-stream-compose.js doesn't need internals (Meghan Denny) #56619f5b8499ad0] - test: add maxCount and gcOptions to gcUntil() (Joyee Cheung) #56522d9e5a81041] - test: add line break at end of file (Rafael Gonzaga) #5658859be346fbf] - test: mark test-worker-prof as flaky on smartos (Joyee Cheung) #5658312a2cae9e5] - test: update test-child-process-bad-stdio to use node:test (Colin Ihrig) #565622dc4a30e19] - test: disable openssl 3.4.0 incompatible tests (Jelle van der Waa) #561601950fbf51d] - test: make test-crypto-hash compatible with OpenSSL > 3.4.0 (Jelle van der Waa) #56160a533420a91] - test: clarify fork inherit permission flags (Rafael Gonzaga) #56523697e799dc1] - test: add error only reporter for node:test (Carlos Espa) #564384844fa212d] - test: mark test-http-server-request-timeouts-mixed as flaky (Joyee Cheung) #56503843c2389b9] - test: update error code in tls-psk-circuit for for OpenSSL 3.4 (sebastianas) #56420ccb2ddbd83] - test: update compiled sqlite tests to match other tests (Colin Ihrig) #56446b40f50324d] - test: add initial test426 coverage (Chengzhong Wu) #56436059f81e4fd] - test: update test-set-http-max-http-headers to use node:test (Colin Ihrig) #56439ec2940b418] - test: update test-child-process-windows-hide to use node:test (Colin Ihrig) #564370362924880] - test: use unusual chars in the path to ensure our tests are robust (Antoine du Hamel) #48409b6c3869910] - test: improve abort signal dropping test (Edy Silva) #56339cc648ef923] - test: enable ts test on win arm64 (Marco Ippolito) #5634968819b4997] - test: deflake test-watch-file-shared-dependency (Luigi Pinca) #56344ca6ed2190c] - test: skiptest-sqlite-extensionswhen SQLite is not built by us (Antoine du Hamel) #563418ffeb8b58c] - test: increase spin for eventloop test on s390 (Michael Dawson) #562286ae9950f08] - test: migrate message eval tests from Python to JS (Yiyun Lei) #504824352bf69e9] - test: check typescript loader (Marco Ippolito) #54657406e7db9c3] - test: remove async-hooks/test-writewrap flaky designation (Luigi Pinca) #56048fa56ab2bba] - test: deflake test-esm-loader-hooks-inspect-brk (Luigi Pinca) #560508e149aac99] - test: add test case for listeners (origranot) #56282a3f5ef22cd] - test: maketest-permission-sqlite-load-extensionmore robust (Antoine du Hamel) #562958cbb7cc838] - test_runner: print failing assertion only once with spec reporter (Pietro Marchini) #566621f426bad9a] - test_runner: remove unused errors (Pietro Marchini) #56607697a851fb3] - (SEMVER-MINOR) test_runner: add TestContext.prototype.waitFor() (Colin Ihrig) #56595047537b48c] - (SEMVER-MINOR) test_runner: add t.assert.fileSnapshot() (Colin Ihrig) #5645919b4aa4b14] - test_runner: run single test file benchmark (Pietro Marchini) #56479926cf84e95] - (SEMVER-MINOR) test_runner: add assert.register() API (Colin Ihrig) #56434fb4661a4cf] - test_runner: finish marking snapshot testing as stable (Colin Ihrig) #56425900c6c3940] - tls: fix error stack conversion in cryptoErrorListToException() (Joyee Cheung) #56554e9f185b658] - tools: update doc to new version (Node.js GitHub Bot) #562597644c7e619] - tools: update inspector_protocol roller (Chengzhong Wu) #56649362272b0a4] - tools: do not throw on missingcreate-release-proposal.sh(Antoine du Hamel) #56704df8b835953] - tools: fix tools-deps-update (Daniel Lemire) #56684feba5d3274] - tools: do not throw on missingcreate-release-proposal.sh(Antoine du Hamel) #566959827f7d395] - tools: fix permissions inlint-release-proposalworkflow (Antoine du Hamel) #5661414c562c0dc] - tools: remove github reporter (Carlos Espa) #56468ed1785d0ae] - tools: editcreate-release-proposalworkflow (Antoine du Hamel) #56540294e4c42f5] - tools: validate commit list as part oflint-release-commit(Antoine du Hamel) #5629198d3474267] - tools: fix loong64 build failed (Xiao-Tao) #564663e729ceec8] - tools: disable unneeded rule ignoring in Python linting (Rich Trott) #56429d5c05328e2] - tools: use a configurable value for number of open dependabot PRs (Antoine du Hamel) #564271705cbe002] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #5642653b29b0469] - tools: fixrequire-common-firstlint rule from subfolder (Antoine du Hamel) #56325105c4ed4fb] - tools: add release line label when opening release proposal (Antoine du Hamel) #5631730f61f4aa5] - url: use resolved path to convert UNC paths to URL (Antoine du Hamel) #56302a0aef4dfb6] - util: inspect: do not crash on an Error stack that contains a Symbol (Jordan Harband) #56573a8a060341f] - util: inspect: do not crash on an Error with a regexname(Jordan Harband) #56574ea66bf3553] - util: rename CallSite.column to columnNumber (Chengzhong Wu) #565849cdc3b373c] - util: do not crash on inspecting function withSymbolname (Jordan Harband) #565720bfbb68569] - util: expose CallSite.scriptId (Chengzhong Wu) #565515dd7116e09] - watch: reload env file for --env-file-if-exists (Jonas) #56643c658a8afdf] - (SEMVER-MINOR) worker: add eval ts input (Marco Ippolito) #563942e5d038f48] - worker: refactor stdio to improve performance (Matteo Collina) #56630f959805d01] - worker: flush stdout and stderr on exit (Matteo Collina) #56428v22.13.1: 2025-01-21, Version 22.13.1 'Jod' (LTS), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Dependency update:
Commits
520da342e0] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#66299f217369f] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555984f735e35] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#6502446870618] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#651prettier/prettier (prettier)
v3.9.10Compare Source
diff
Markdown: Update
micromark-extension-gfm-tableto fix the table parse issue on performance (#20266 by @fisker)See micromark/micromark-extension-gfm-table@
4f43eadfor details.v3.9.9Compare Source
diff
Markdown: Fix text with
$been incorrectly parsed as math syntax (#20140 by @fisker)v3.9.8Compare Source
diff
Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)
v3.9.7Compare Source
diff
Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @Austin1serb, @giaBaoJS)
JavaScript: Fix embedded template literal idempotency (#19725 by @fisker)
Markdown: Preserve Liquid blocks after Markdown tables (#19730 by @wanxiankai, @seiyab)
Markdown: Preserve single tildes in Markdown (#19739 by @lazerg)
Since 3.9.0, single-tilde spans like
H~2~Owere rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.Markdown: Fix Markdown blockquote containing
>characters (#19802 by @seiyab)Markdown: Strip blockquote markers from a setext heading's continuation lines (#19878 by @Kjubikstronk)
A setext heading spanning multiple lines inside a blockquote kept the
>marker of its continuation lines as literal text.Markdown: Fix HTML block indentation drift in markdown list items (#19987 by @lazerg)
Angular: Support
@boundaryerror boundaries (#20014 by @Yahiro025)v3.9.6Compare Source
diff
TypeScript: Preserve quotes for methods named
new(#19621 by @kovsu)TypeScript: Support
import defer(#19624, #19675 by @fisker)JavaScript: Added a new official plugin
@prettier/plugin-yuku(#19628, #19629 by @fisker)@prettier/plugin-yukuis powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).This plugin includes two new parsers:
yuku(JavaScript syntax) andyuku-ts(TypeScript syntax).To use this plugin:
Install the plugin:
Add it to your
.prettierrc:Due to package size limitations, this plugin is not bundled with the main prettier package and must be installed separately.
For more information, check the package homepage.
Big thanks to @arshad-yaseen for his excellent work.
v3.9.5Compare Source
diff
Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)
CommonMark parsers only support ordered list item numbers up to 999,999,999.
With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)
Do not remove
<>from an inline link or image with an empty URL and a title, as this removal would change its interpretation.Less: Remove extra spaces after
[in map lookups (#19503 by @kovsu)CSS: Prevent addition space in
type()with+(#19516 by @bigandy)This fixes the addition space before
+in CSStype()declaration. For exampletype(<number>+)was being converted intotype(<number> +)which is invalid CSS and does not work.Less: Remove spaces between merge markers and colons (#19517 by @kovsu)
Markdown: Preserve wiki links with aliases (#19527 by @kovsu)
TypeScript: Fix comments being dropped on shorthand
typeimport/export specifiers (#19565 by @kirkwaiblinger)Miscellaneous: Preserving comments'
placementproperty (#19567 by @Janther)Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins,
comment.placementis now available again after comment attach.Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)
Angular: Support expression for exhaustive typechecking (#19571 by @fisker)
TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)
Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)
JavaScript: Handle dangling comments in
SwitchStatement(#19581 by @fisker)TypeScript: Remove space in comment-only object type (#19583 by @fisker)
v3.9.4Compare Source
diff
Angular: Format
@content(name)->@content (name)to align with other block syntax (#19499 by @fisker)v3.9.3Compare Source
diff
Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @seiyab)
TypeScript: Allow decorators to be used with declare on class fields (#19492 by @evoactivity)
Extensively used within the Ember ecosystem, decorators with
declareon class fields will ignore the babel parser error and allow Prettier to format the code without breaking it.v3.9.2Compare Source
v3.9.1Compare Source
diff
Markdown: Update
micromark-extension-gfm-tableto fix the table parse issue on performance (#20266 by @fisker)See micromark/micromark-extension-gfm-table@
4f43eadfor details.v3.9.0Compare Source
diff
🔗 Release Notes
v3.8.5Compare Source
diff
Flow: Support
readonlyas a variance annotation (#19022 by @marcoww6)Flow now accepts
readonlyas a property variance annotation, equivalent to+(covariant/read-only).v3.8.4Compare Source
diff
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
sass/dart-sass (sass)
v1.107.1Compare Source
v1.107.0Compare Source
Command-Line Interface
The
--fatal-deprecationflag can now exclude deprecations that wouldotherwise be included by passing a version number. To exclude a deprecation,
add
-before its name. For example,--fatal-deprecation=1.107.0,-importincludes all deprecations that were present in Dart Sass 1.107.0 except for
the
@importdeprecation.The
--fatal-deprecationflag now takes the special valuedart-sass-2,which treats as fatal all deprecations that will become fatal in Dart Sass
2.0.0.
JavaScript API
Options.fatalDeprecationscan now take aDeprecationSelectorDifferenceobject of the form
{include: ..., except: ...}, where theincludefieldlists deprecations to mark fatal (which can be version numbers) and the
exceptfield lists deprecations not to mark fatal. Theexceptfieldtakes precedence over
include.Add a (non-enumerable)
sass.deprecations.dartSass2property which can bepassed to
Options.fatalDeprecationsto mark as fatal exactly thedeprecations that will become fatal in Dart Sass 2.0.0. This can be combined
with other deprecations or used in a
DeprecationSelectorDifferenceto modifyexactly which deprecations it covers.
Passing a version number beyond the current Dart Sass version to
Options.fatalDeprecationsis now deprecated. See the Sasswebsite for details.
Dart API
Add a
Deprecation.dartSass2property which returns exactly the set ofdeprecations that will become fatal in Dart Sass 2.0.0.
Passing a version number beyond the current Dart Sass version to
Deprecation.forVersionis now deprecated.Embedded Protocol
CompileRequest.fatal_deprecation_exceptfield which excludesdeprecations from being considered fatal if they would have been enabled by
CompileRequest.fatal_deprecation.v1.106.1Compare Source
Fix a bug where an attribute selector with an empty value (such as
[class=""]) would crash when serializing.Don't crash when serializing a number with an empty unit. This is only
possible through the JavaScript and Dart APIs or the embedded protocol.
Embedded Dart Sass
PARAMSerrors.v1.106.0Compare Source
Don't normalize CSS escapes in statement contexts that can contain
interpolation. For example,
@f\6Fois now emitted as written rather thannormalized to
@foo.Fix a bug where quotes would be removed from attribute selector values that
contained backslashes.
Fix invalid source spans that could cause crashes when encountering a syntax
error in selectors or media queries that also contain escape sequences.
Fix a bug where the indented syntax parser would crash when parsing a file
where the first statement was indented and appeared after the first line.
Fix a bug that could cause crashes when encountering errors or warnings in
interpolations that contain patterns like
// */.Potentially breaking compatibility fix: CSS escape codes whose values are
0, for Unicode surrogates, or greater than the maximum allowed code point are
now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression
contexts. Previously, in some cases these were instead normalized to the
normalized form of the original escape sequence, which violates the principle
that all escape sequences for identical values should be normalized the same
way. In other cases, these would simply throw errors.
As a special case,
\0on its own will continue to be normalized to\0tosupport historical CSS hacks.
Potentially breaking bug fix: Throw an error for mixins and functions that
have rest parameters which are the same as normal parameters. Previously, the
positional parameters wouldn't be accessible and calling such a mixin or
function with a named argument would crash the compiler.
Potentially breaking bug fix: Fix various cases where using a CSS escape
code at the beginning of an identifier would change parsing behavior versus
using the character directly.
Potentially breaking bug fix: When a number's unit is ambiguous with a
numeric exponent, the unit is now serialized as an escape code rather than a
literal
eto avoid being interpreted as an exponent by CSS.Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN
CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in
@keyframespercentage selectors.Potentially breaking bug fix: Properly normalize underscores written as
CSS escape codes in variable, mixin, and function names.
v1.105.2Compare Source
Node.js Embedded Host
v1.105.1Compare Source
@extends across different media queries.v1.105.0Compare Source
Add support for first-class modules. These can be accessed using the new
meta.load()andmeta.get-module()functions, and may be passed as the$moduleargument to numerous eistingsass:metafunctions.Add the
meta.css()mixin, which includes CSS from a first-class module.JS API
SassModuleclass and a correspondingValue.assertModule()method.Dart API
SassModuleclass and a correspondingValue.assertModule()method.v1.104.1Compare Source
Fix a bug where loud comments before
@userules could be emitted multipletimes under certain circumstances.
Fix a bug in which an invalid selector at the end of an indented syntax
stylesheet would cause the parser to crash instead of emitting a useful error
message.
Command Line Interface
Many-to-many compilations no longer compile any files that appear in the
output directory if the output directory is also within the source directory.
This fixes a bug where
--watchmode could enter an infinite loop recompilingthe same CSS file over and over.
Sass now sets the modification time of output files to the time compilation
started rather than the time it ended. This ensures that, if a source file
is modified during compilation,
--watchand--updatemode will recompilethe outputs to include the new source file contents.
v1.104.0Compare Source
Potentially breaking compatibility fix: Colors now convert the special
values NaN and negative zero, as well as infinity and negative infinity for
polar-hue channels, to 0 as per the CSS spec.
The special value negative zero is now serialized as
-0instead of0forgreater compatibility when using it in CSS calculations.
v1.103.1Compare Source
v1.103.0Compare Source
sets" of missing channels during conversions, per the CSS spec. For example,
color.to-space(lch(50% none none), lab)now returnslab(50% none none)instead of
lab(50% 0 0).v1.102.0Compare Source
draft of CSS Color 4.
v1.101.7Compare Source
v1.101.6Compare Source
v1.101.5Compare Source
v1.101.4Compare Source
Avoid emitting
rgb()orrgba()functions with non-percent decimalchannels. Older browsers only support integer values or (potentially decimal)
percentages for these functions, so in order to preserve
backwards-compatibility while retaining full precision for modern browsers,
legacy colors that contain at least one non-integer channel will now use
percentages for their channels (for example,
rgb(0%, 100%, 50%)rather thanrgb(0, 255, 127.5)).Fix a bug where the values of plain-CSS
if()expressions were emitted usingtheir
meta.inspect()format rather than their CSS serialization format.v1.101.3Compare Source
v1.101.0Compare Source
supports resolving import-only variants of Sass files declared in the
exports,sass, andstylefields ofpackage.json. Previously, thesefiles were ignored even when loaded via
@import, so any code relying onloading module-system-only files this way may break.
lovell/sharp (sharp)
v0.35.5Compare Source
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4
Add upper bounds check on length of
linearand GIFdelayarrays.Improve error handing when WebAssembly fallback also fails.
#4593
@lazerg
TypeScript: Allow multi-frame options for JXL output.
#4602
@ramin-010
TypeScript: Remove non-existent named export.
#4604
Increase accepted dimensions when extending an image.
#4605
Improve gain map support for
extractandrotateoperations.#4606
Tests: Ensure composite tests pass on big endian platforms.
#4609
v0.35.4Compare Source
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3
Bound resize dimensions to coordinate limit.
Bound composite left and top to coordinate limit.
#4564
@metsw24-max
Round palette bit depth up for png and gif colours.
#4569
@metsw24-max
Ensure tiff.subifd input option is used.
#4572
@metsw24-max
Ensure
info.pagesis correct when limiting input page range.#4578
@metsw24-max
Improve support for input Streams finishing before output is requested.
#4584
@Jaybhade
v0.35.3Compare Source
Tighten verification of
textdimensions, TIFF tile dimensions andextendvalues.Improve code bundler support by resolving path to libvips binary.
Increase default concurrency when use of
MALLOC_ARENA_MAXis detected.Emit warning about binaries provided by Electron for use on Linux.
Add
hasAlphaproperty to outputinfo.#4500
TypeScript: Return more precise
Buffer<ArrayBuffer>fromtoBuffer.#4520
@Andarist
Bound
clahewidth and height to avoid signed overflow.#4551
@metsw24-max
Bound
trimmargin to avoid signed overflow.#4552
@metsw24-max
Reject infinite values when validating numbers.
#4553
@metsw24-max
Bound extract region to libvips coordinate limit.
#4555
@metsw24-max
Verify background colour values are numbers.
#4556
@metsw24-max
Bound create and raw input dimensions to coordinate limit.
#4558
@metsw24-max
Tighten recomb and affine matrix verification.
#4560
@chatman-media
Verify cache memory limit to avoid overflow.
#4561
@metsw24-max
v0.35.2Compare Source
TypeScript: Add
mediaTypeto metadata response.#4492
Improve WebAssembly fallback detection.
#4513
Improve code bundler support with stub binaries.
#4543
Verify GIF
effortoption is an integer.#4544
@metsw24-max
Verify
recombmatrix entries are numbers.#4545
@metsw24-max
TypeScript: Replace namespace with named exports for ESM.
#4546
Bound dilate and erode width to avoid mask-size overflow.
#4548
@metsw24-max
Verify
convolvekernel values are numbers.#4549
@metsw24-max
v0.35.1Compare Source
TypeScript: Ensure type definitions are published for both ESM and CJS.
#4537
WebAssembly: Ensure wrapper file is published.
#4538
v0.35.0Compare Source
Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.
Breaking: Remove
installscript frompackage.jsonfile.Compiling from source is now opt-in via the
buildscript.Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based
iqquality metrics.Breaking: Add
limitInputChannelswith a default value of 5.Breaking: Remove deprecated
failOnErrorconstructor property.Breaking: Remove deprecated
paletteBitDepthfrommetadataresponse.Breaking: Remove deprecated properties from
sharpenoperation.Breaking: Rename
format.jp2kasformat.jp2for API consistency.Upgrade to libvips v8.18.3 for upstream bug fixes.
Remove experimental status from WebAssembly binaries.
Add prebuilt binaries for FreeBSD (WebAssembly).
Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.
Ensure TIFF output
bitdepthoption is limited to 1, 2 or 4.Add AVIF/HEIF
tuneoption for control over quality metrics.#4227
Add
keepGainMapandwithGainMapto process HDR JPEG images with embedded gain maps.#4314
Add
toUint8Arrayfor output image as aTypedArraybacked by a transferableArrayBuffer.#4355
Require prebuilt binaries using static paths to aid code bundling.
#4380
TypeScript: Ensure
FormatEnumkeys match reality.#4475
Add
marginoption totrimoperation.#4480
@eddienubes
Ensure HEIF primary item is used as default page/frame.
#4487
Add image Media Type (MIME Type) to metadata response.
#4492
Add
withDensityto set output density in EXIF metadata.#4496
Improve
pkg-configpath discovery.#4504
Add WebP
exactoption for control over transparent pixel colour values.Add support for ECMAScript Modules (ESM).
#4509
@florian-lefebvre
stylelint/stylelint (stylelint)
v17.16.0Compare Source
It fixes 2 bugs in the
layout-mappingsrules. This will likely be the last17.xrelease, as we prepare for18.0.0.property-layout-mappingsandunit-layout-mappingsfalse negatives for uppercase property names and units (#9485) (@giaBaoJS).value-keyword-layout-mappingsfalse positives forcaption-side(#9483) (@giaBaoJS).v17.15.0Compare Source
It adds 1 new rule and 2 new rule options, and fixes 4 bugs.
selector-no-unmatchablerule (#9451) (@jeddy3).ignoreFunctions: []tocolor-namedandcolor-no-hex(#9463) (@jsmitty12).custom-property-no-missing-var-functionfalse positives for anchor positioning (#9466) (@giaBaoJS).declaration-block-no-redundant-longhand-propertiesautofix forfontshorthand (#9402) (@sarathfrancis90).declaration-property-max-valuesfalse positives for interpolated inline expressions (#9437) (@alexchen-sys).selector-no-invalidfalse negatives for pseudo-elements, combinators and nested:has()(#9452) (@jeddy3).v17.14.1Compare Source
It fixes 4 bugs.
quietoption suppressesreport*warning reports (#9387) (@ychampion).declaration-block-no-redundant-longhand-propertiesautofix producing invalidbackgroundshorthand whenbackground-sizeis present (#9364) (@sarathfrancis90).rule-empty-line-beforefalse positives for shared-line comments withexcept: ["after-single-line-comment"](#9394) (@sarathfrancis90).v17.14.0Compare Source
It fixes 3 bugs, including a false negative one.
TIMINGonly on use (#9356) (@jeddy3).function-calc-no-unspaced-operatorfalse negatives for unspaced+and-operators following a*or/operator (#9357) (@sarathfrancis90).v17.13.0Compare Source
It fixes 3 bugs, including a false negative one.
declaration-block-no-duplicate-propertiesfalse negatives for interleaved non-consecutive duplicates withignore: ["consecutive-duplicates(-*)"](#9324) (@sarathfrancis90).selector-max-typefalse positives for nested selectors (#9319) (@romainmenke).selector-type-no-unknownfalse positives forinstall(#9308) (@Mouvedia).typescript-eslint/typescript-eslint (typescript-eslint)
v8.72.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.72.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.71.2Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.71.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.71.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.70.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.70.0Compare Source
🩹 Fixes
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.69.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.68.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.67.0Compare Source
🚀 Features
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.66.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.65.0Compare Source
🚀 Features
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.64.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.63.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.62.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.62.0Compare Source
🚀 Features
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.61.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.61.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.60.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
vitejs/vite (vite)
v8.3.5Compare Source
Bug Fixes
server.originto asset URLs (#23683) (52ba877)import.meta.env.*defines in theimport.meta.envobject (#23713) (6019aa7)%inurl()(#23676) (50b382d)oxc.jsxInjectimports (#23758) (38f3cb4)#(#23631) (0d86b34)Performance Improvements
Miscellaneous Chores
Code Refactoring
@vercel/detect-agentwithstd-env(#23744) (ce4293f)v8.3.4Compare Source
Features
import.meta.hot.acceptExports(#23463) (bc0f21c)Bug Fixes
/@vite/clientand stub@vite/env(#23664) (5afc5a8)ensureWatchedFile(#23673) (12bb28c)Performance Improvements
Code Refactoring
/@vite/client(#23674) (182f5b2)v8.3.3Compare Source
Bug Fixes
fs.servefor?vite-wasm-instance(#23655) (ba8b7ab)safeModulePathsrather than URLs (#23656) (c3e06f9)v8.3.2Compare Source
Bug Fixes
renderBuiltUrlreturns URLs with queries (#23611) (64e0a21)forwardConsole(#23565) (e64a587)build.rolldownOptions.output.minifycorrectly (#23536) (bba3bb8)renderBuiltUrl(#23586) (744269e)Performance Improvements
Documentation
Miscellaneous Chores
Code Refactoring
tinyexecinstead ofcross-spawn(#23583) (db915e5)Tests
v8.3.1Compare Source
Bug Fixes
server.ws: falsein mergeConfig (#23511) (f68c0d5)build.rolldownOptions.output.commentscorrectly (#23514) (4aba8d8)Miscellaneous Chores
optimizeDeps.includecomment (#23489) (6a84c72)Code Refactoring
findwithsome(#23554) (af7cdf6)v8.3.0Compare Source
Features
server.watch(#23133) (1b5cfe3)tsconfigoption (#23310) (93164c3)applyToEnvironmenthook (#23191) (fdef04f)import.meta.ROLLDOWN_FILE_URL_*for assets in JS (#22888) (4366ac4)import.meta.ROLLDOWN_FILE_URL_*for other plugins (#22894) (e38f29e)Bug Fixes
node_modulespath segments as dependencies (fix #17467) (#23437) (ef0dc17)resolveFileUrlhook (#23422) (e8d6a4d)import.meta.hot.invalidatein virtual module (#23171) (6162968)Performance Improvements
Miscellaneous Chores
@e18e/eslint-plugin(#23357) (f794133)PluginContainerOptions(#23382) (ee64401)sortImports(#23319) (97ad042)Code Refactoring
esbuildPlugin(#23381) (f40efef)__VITE_ASSET__(#22886) (a6c08e1)urlIdofimport.meta.ROLLDOWN_FILE_URLin wasm plugin (#22962) (92bd2a7)Tests
renderBuiltUrlchange changes hash (#23118) (0291408)Beta Changelogs
8.3.0-beta.1 (2026-09-07)
See 8.3.0-beta.1 changelog
8.3.0-beta.0 (2026-09-02)
See 8.3.0-beta.0 changelog
v8.2.4Compare Source
Please refer to CHANGELOG.md for details.
v8.2.2Compare Source
Features
server.watch(#23133) (1b5cfe3)tsconfigoption (#23310) (93164c3)applyToEnvironmenthook (#23191) (fdef04f)import.meta.ROLLDOWN_FILE_URL_*for assets in JS (#22888) (4366ac4)import.meta.ROLLDOWN_FILE_URL_*for other plugins (#22894) (e38f29e)Bug Fixes
node_modulespath segments as dependencies (fix #17467) (#23437) (ef0dc17)resolveFileUrlhook (#23422) (e8d6a4d)import.meta.hot.invalidatein virtual module (#23171) (6162968)Performance Improvements
Miscellaneous Chores
@e18e/eslint-plugin(#23357) (f794133)PluginContainerOptions(#23382) (ee64401)sortImports(#23319) (97ad042)Code Refactoring
esbuildPlugin(#23381) (f40efef)__VITE_ASSET__(#22886) (a6c08e1)urlIdofimport.meta.ROLLDOWN_FILE_URLin wasm plugin (#22962) (92bd2a7)Tests
renderBuiltUrlchange changes hash (#23118) (0291408)Beta Changelogs
8.3.0-beta.1 (2026-09-07)
See 8.3.0-beta.1 changelog
8.3.0-beta.0 (2026-09-02)
See 8.3.0-beta.0 changelog
v8.2.1Compare Source
Bug Fixes
sharedPlugins: true(#23184) (15f0307)input(#23135) (b4bf596)Performance Improvements
Documentation
@defaultfor build.minify (#23177) (ef02435)Miscellaneous Chores
Code Refactoring
Tests
v8.2.0Compare Source
Features
inputtoserver.fs.allow(#23035) (95a3cda)inputoption (#22642) (9beae37)Bug Fixes
Object.prototypeis frozen (#23073) (599c5b0)Performance Improvements
Documentation
@experimentalfromresolve.tsconfigPathsJSDoc (#23006) (961643a)Miscellaneous Chores
Tests
Beta Changelogs
8.2.0-beta.0 (2026-07-22)
See 8.2.0-beta.0 changelog
v8.1.6Compare Source
Please refer to CHANGELOG.md for details.
v8.1.5Compare Source
Features
inputtoserver.fs.allow(#23035) (95a3cda)inputoption (#22642) (9beae37)Bug Fixes
Object.prototypeis frozen (#23073) (599c5b0)Performance Improvements
Documentation
@experimentalfromresolve.tsconfigPathsJSDoc (#23006) (961643a)Miscellaneous Chores
Tests
Beta Changelogs
8.2.0-beta.0 (2026-07-22)
See 8.2.0-beta.0 changelog
v8.1.4Compare Source
Features
Bug Fixes
import.meta.urlin preload function as-is (#22839) (f1f90ed)Documentation
@defaultforserver.cors(#22859) (70435b2)Miscellaneous Chores
Code Refactoring
Tests
Build System
onwarnwithonLog(#22741) (c581b55)v8.1.3Compare Source
Bug Fixes
es-module-lexerto 2.3.0 (#22838) (7103c3a)v8.1.2Compare Source
Bug Fixes
v8.1.1Compare Source
Features
Bug Fixes
import.meta.hot.invalidate()(#22797) (709eb8e)@importurls with lightningcss (#22718) (9fa7ab4)esbuild.jsxSideEffectswhen converting tooxc.jsx.pure(#22809) (33895ba)ERR_CLOSED_SERVERin scanner (#22784) (085a0ab)inputfromroot(#22769) (9722b07)Miscellaneous Chores
Code Refactoring
Object.valuescalls (#22790) (1113acf)Tests
v8.1.0Compare Source
Features
server.fs.denylist with common files (#22707) (61ba8fd)~for Rolldown (#22693) (9928722)import.meta.globsupportcaseSensitiveoption (#21707) (2ad6737)html.additionalAssetSourcesoption (#21412) (a41404b)server.hmroptions toserver.wsoptions (#21357) (9ce3036)querytypes to match knownastypes (#21863) (cc39e55)Bug Fixes
Documentation
loadEnvmergesprocess.env(#22561) (28d8e12)Miscellaneous Chores
parseAst/parseAstAsyncdeprecation hints (#22656) (983b7e3)create-react-applinks (#22659) (6ebcf6a)es-module-lexerto 2.0.0 (#22288) (d1e8a78)Code Refactoring
rolldownOptionsproperty for chunkImportMap (#22692) (8e8816c)bundledDevinDevEnvironmentinstead of having a separate FBMDevEnvironment(#22587) (5edd1d5)Beta Changelogs
8.1.0-beta.0 (2026-06-15)
See 8.1.0-beta.0 changelog
v8.0.16Compare Source
Features
server.fs.denylist with common files (#22707) (61ba8fd)~for Rolldown (#22693) (9928722)import.meta.globsupportcaseSensitiveoption (#21707) (2ad6737)html.additionalAssetSourcesoption (#21412) (a41404b)server.hmroptions toserver.wsoptions (#21357) (9ce3036)querytypes to match knownastypes (#21863) (cc39e55)Bug Fixes
Documentation
loadEnvmergesprocess.env(#22561) (28d8e12)Miscellaneous Chores
parseAst/parseAstAsyncdeprecation hints (#22656) (983b7e3)create-react-applinks (#22659) (6ebcf6a)es-module-lexerto 2.0.0 (#22288) (d1e8a78)Code Refactoring
rolldownOptionsproperty for chunkImportMap (#22692) (8e8816c)bundledDevinDevEnvironmentinstead of having a separate FBMDevEnvironment(#22587) (5edd1d5)Beta Changelogs
8.1.0-beta.0 (2026-06-15)
See 8.1.0-beta.0 changelog
v8.0.15Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
collectAllModulesfunction (#22562) (6978a9c)vitest-dev/vitest (vitest)
v4.1.12Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
f94e3f3161a4187a7d61Update all dependenciesto Update all non-major dependenciesa4187a7d61f73df23cbf