Update Node.js to v24 #39
Conversation
|
WalkthroughBase image in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
KubeArchitectBot
force-pushed
the
renovate/node-node-24.x
branch
5 times, most recently
from
da5589e to
55ee486
Compare
KubeArchitectBot
force-pushed
the
renovate/node-node-24.x
branch
from
55ee486 to
284463f
Compare
KubeArchitectBot
force-pushed
the
renovate/node-node-24.x
branch
4 times, most recently
from
6be321a to
b62599a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
node/Dockerfile(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: generate-config
🔇 Additional comments (4)
node/Dockerfile (4)
1-1: AI-generated summary SHA mismatch.The AI summary references digest
0c4b1219e836193f8ff099c43a36cb6ebf1bfe4a9a391e9f9eca5b4c96fae5b3, but the actual code usesaa648b387728c25f81ff811799bbf8de39df66d7e2d9b3ab55cc6300cb9175d9. Please confirm which digest is correct and up-to-date.
1-1: pnpm@latest-10 + Node 24 compatibility appears sound.Based on the available documentation, pnpm supports Corepack since Node.js v16.13, and pnpm v10 is designed to work with modern Node.js versions including v24. However, test the image build and execution to confirm:
- Dockerfile builds successfully with
docker build node/npm --version,node --version, andpnpm --versionreturn without errorspnpm installsucceeds in a sample project (if applicable)
1-1: I cannot verify the SHA256 digest directly without Docker access. Let me search for information about Node 24 breaking changes and the Buffer.allocUnsafe behavior mentioned in the review.Based on my web search verification, I can now provide a more informed assessment:
An issue has been identified in the Node.js 24.x line with Buffer.allocUnsafe unintentionally returning zero-filled buffers. This API is documented to return uninitialized memory. However, the known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers has now been addressed in Node.js v24.11.1 and returns uninitialized memory as documented.
This means the criticality of the Buffer.allocUnsafe concern depends on which Node 24 minor version your Dockerfile is pinned to. The Dockerfile shows
node:24@sha256:...without specifying a minor version, which means it likely pulls the latest v24.x patch available.Regarding compatibility: pnpm requires at least Node.js v18.12 to run, so pnpm v10 should work with Node 24. No compatibility issues were found between pnpm v10 and Node 24.
The remaining concern is the SHA256 digest discrepancy—I cannot verify it without Docker access, but this is a secondary concern compared to the Buffer.allocUnsafe issue being addressed in v24.11.1+.
Update the Dockerfile to explicitly pin Node.js v24.11.1 or later to ensure the Buffer.allocUnsafe fix is included.
If you're already using v24.11.1+, the critical Buffer.allocUnsafe issue is resolved. Otherwise, ensure your build uses a patched version.
1-1: Additional verification needed for corepack:Both pnpm v10 and corepack@latest are confirmed compatible with Node.js 24.
Corepack is distributed with Node.js up to (but not including) 25.0.0, which includes Node.js 24, and Corepack remains in Node.js 24 as an experimental feature. pnpm v10 has already been confirmed as compatible with Node.js 24 LTS. The setup is sound; no action needed.
node/Dockerfile
Outdated
| @@ -1,4 +1,4 @@ | |||
| FROM node:23@sha256:990d0ab35ae15d8a322ee1eeaf4f7cf14e367d3d0ee2f472704b7b3df4c9e7c1 AS base | |||
| FROM node:24@sha256:aa648b387728c25f81ff811799bbf8de39df66d7e2d9b3ab55cc6300cb9175d9 AS base | |||
There was a problem hiding this comment.
Critical: Verify the Node.js 24 image patch version.
There was a known issue in Node.js 24.x with Buffer.allocUnsafe unintentionally returning zero-filled buffers, while the API is documented to return uninitialized memory. The v24.11.1 LTS release addressed this issue and returns uninitialized memory as documented.
Your Dockerfile uses node:24@sha256:aa648b38..., but the AI summary references a different digest (0c4b1219...). This discrepancy is concerning—if the image is v24.11.0 (the initial LTS release), it contains the Buffer.allocUnsafe bug. If any of your application code or dependencies rely on the zero-filled behavior, upgrading will expose uninitialized memory and may cause data leaks or correctness issues.
Verify:
- Which patch version (v24.11.0 vs v24.11.1+) corresponds to the SHA you're using
- Whether your application or dependencies depend on Buffer.allocUnsafe behavior
- Why the AI summary SHA differs from the actual code
🤖 Prompt for AI Agents
In node/Dockerfile around line 1, the pinned image digest may correspond to a
vulnerable Node.js 24 patch (v24.11.0) that contained a Buffer.allocUnsafe
behavior bug; verify which patch version your sha256 maps to by querying the
registry (docker pull or manifest inspect) and compare the image's Node.js
version; if it is v24.11.0, update the Dockerfile to use a v24.11.1+ image
(either the explicit tag node:24.11.1 or the exact sha256 for that release) to
ensure the fix, then run your test suite and dependency checks to confirm no
code relies on zero-filled buffers; finally reconcile why the AI summary SHA
differs by checking where the summary came from (different registry, cached
manifest, or typo) and ensure CI uses the corrected pinned digest.
b62599a to
da9a48f
Compare
KubeArchitectBot
force-pushed
the
renovate/node-node-24.x
branch
from
da9a48f to
ec71ead
Compare
This PR contains the following updates:
23->24Release Notes
nodejs/node (node)
v24.11.1: 2025-11-11, Version 24.11.1 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
The known issue relating to
Buffer.allocUnsafeincorrectly zero-filling buffershas now been addressed and now returns uninitialized memory as documented in the
Buffer.allocUnsafedocumentation.
Commits
0a15ccf3f4] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162a1c7d1dac9] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #6020599e2acf46b] - benchmark: add vm.SourceTextModule benchmark (Joyee Cheung) #59396c01c72b407] - benchmark: use non-deprecated WriteUtf8V2 method (Michaël Zasso) #60173a42dbd138e] - build: ibmi follow aix visibility (SRAVANI GUNDEPALLI) #603605673a54a5d] - build: use call command when calling python configure (Jacob Nichols) #60098c67cb727cb] - build: build v8 with -fvisibility=hidden -fvisibility-inlines-hidden (Joyee Cheung) #56290b03f7b93b1] - build: remove V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE defs (Joyee Cheung) #602962505568531] - build, src: fix include paths for vtune files (Rahul) #5999995330b036f] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956c221d892ef] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550bc00aa4c77] - deps: update simdjson to 4.0.7 (Node.js GitHub Bot) #59883d03b89ec53] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314b7882090de] - deps: update inspector_protocol toaf7f5a8(Node.js GitHub Bot) #603127007f9dd65] - deps: update googletest to279f847(Node.js GitHub Bot) #60219a56aa9ffa8] - deps: upgrade npm to 11.6.2 (npm team) #601680bf8952721] - doc: mention more codemods indeprecations.md(Augustin Mauroy) #602432473ca77f6] - doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny() (Jimmy Leung) #5889939ddd8522e] - doc: useanyforworker_threads.Worker'error' event argumenterr(Jonas Geiler) #60300eaa825fd97] - doc: update decorator documentation to reflect actual policy (Muhammad Salman Aziz) #60288a744e42282] - doc: document wildcard supported by tools/test.py (Joyee Cheung) #60265ec0d5beb09] - doc: add --heap-snapshot-on-oom to useful v8 flag (jakecastelli) #6026013da0df12a] - doc: fixblob.bytes()heading level (XTY) #602528e771632b7] - doc: fix not working code example in vm docs (Artur Gawlik) #6022470c2080bff] - doc: improve code snippet alternative of url.parse() using WHATWG URL (Steven) #60209beadcf176e] - doc:createSQLTagStore->createTagStore(Aviv Keller) #60182b0da3b9c6a] - doc: use markdown when branch-diff major release (Rafael Gonzaga) #60179688115aa6b] - doc: update teams in collaborator-guide.md and add links (Bart Louwers) #60065923082a064] - doc: disambiguate top-levelworker_threadsmodule exports (René) #598907be4330870] - doc: add known issue to v24.11.0 release notes (Richard Lau) #604674d8f62aeaf] - doc, module: change async customization hooks to experimental (Gerhard Stöbich) #60302d86a118bbd] - http: lazy allocate cookies array (Robert Nagy) #597348c256d4139] - http: fix http client leaky with double response (theanarkh) #60062265e9d59fa] - http2: rename variable to additionalPseudoHeaders (Tobias Nießen) #6020865bec037e2] - http2: do not crash on mismatched ping buffer length (René) #601359b83ef53b7] - inspector: add network payload buffer size limits (Chengzhong Wu) #6023603ac05c458] - inspector: support handshake response for websocket inspection (Shima Ryuhei) #60225aa04f06190] - lib: fix typo in createBlobReaderStream (SeokHun) #601325aea1a429e] - lib: fix constructor in _errnoException stack tree (SeokHun) #601564f7745acc7] - lib: fix typo in QuicSessionStats (SeokHun) #60155f8725861ea] - lib: remove redundant destroyHook checks (Gürgün Dayıoğlu) #60120696c20bf3f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #6032590434ff99a] - meta: loop userland-migrations in deprecations (Chengzhong Wu) #60299ffbc0ae60a] - module: refactor and clarify async loader hook customizations (Joyee Cheung) #602786ed6062f7d] - module: handle null source from async loader hooks in sync hooks (Joyee Cheung) #59929a2871baed2] - msi: fix WiX warnings (Stefan Stojanovic) #602516199541d67] - src: fix timing of snapshot serialize callback (Joyee Cheung) #6043413b687959a] - src: add COUNT_GENERIC_USAGE utility for tests (Joyee Cheung) #60434a587623b4f] - src: conditionally disable source phase imports by default (Shelley Vohr) #60364e483267995] - src: use cached primordials_string (Sohyeon Kim) #602554c9a64fbaf] - src: replace Environment::GetCurrent with args.GetIsolate (Sohyeon Kim) #60256eb8a0493d1] - src: initial enablement of IsolateGroups (James M Snell) #60254463c6450cf] - src: useUtf8ValueandTwoByteValueinstead of V8 helpers (Anna Henningsen) #60244b370e02789] - src: add a default branch for module phase (Chengzhong Wu) #602614e1c5c5601] - src: make additional cleanups in node locks impl (James M Snell) #60061f00d4c10fc] - src: update locks to use DictionaryTemplate (James M Snell) #600611c8716e97c] - test: increase debugger waitFor timeout on macOS (Chengzhong Wu) #6036717b4f38e9c] - test: put helper in test-runner-output into common (Joyee Cheung) #6033043b9ea8389] - test: fix small compile warning in test_network_requests_buffer.cc (xiaocainiao633) #6028138a62980ad] - test: split test-runner-watch-mode-kill-signal (Joyee Cheung) #6029834e4c8c84f] - test: fix incorrect calculation in test-perf-hooks.js (Joyee Cheung) #602714481feb17b] - test: parallelize test-without-async-context-frame correctly (Joyee Cheung) #6027391ea9b06e0] - test: skip sea tests on x64 macOS (Joyee Cheung) #60250cedba09e60] - test: move sea tests into test/sea (Joyee Cheung) #60250635af55e12] - Revert "test: ensure message event fires in worker message port test" (Luigi Pinca) #6012668f678028e] - test: skip tests that cause timeouts on IBM i (SRAVANI GUNDEPALLI) #60148cc3a70598c] - test: deflake test-fs-promises-watch-iterator (Luigi Pinca) #600603d784dd766] - test: prepare junit file attribute normalization (sangwook) #5943284974d97ad] - test: skip failing test on macOS 15.7+ (Antoine du Hamel) #60419fabf8e4975] - test,crypto: fix conditional SHA3-* skip on BoringSSL (Filip Skokan) #603798faa494bf2] - test,crypto: sha3 algorithms aren't supported with BoringSSL (Shelley Vohr) #60374538a00c0f6] - test,doc: skip --max-old-space-size-percentage on 32-bit platforms (Asaf Federman) #601449ac5dbb694] - test_runner: use module.registerHooks in module mocks (Joyee Cheung) #60326f6ff6e7166] - test_runner: fix suite timeout (Moshe Atlow) #59853455bfeb52d] - test_runner: add junit file attribute support (sangwook) #59432223c5e105d] - tools: update gyp-next to 0.20.5 (Node.js GitHub Bot) #603132949408fc1] - tools: limit inspector protocol PR title length (Chengzhong Wu) #60324b36a898650] - tools: fix inspector_protocol updater (Chengzhong Wu) #60277d60f002b62] - tools: optimize wildcard execution in tools/test.py (Joyee Cheung) #602669d4e422419] - tools: add inspector_protocol updater (Chengzhong Wu) #602452f93a9894f] - tools: use cooldown property correctly (Rafael Gonzaga) #601349468ade95d] - typings: add missing properties and method in Worker (Woohyun Sung) #60257f611ec0a9e] - typings: add missing properties in HTTPParser (Woohyun Sung) #60257301c1347a1] - typings: delete undefined property in ConfigBinding (Woohyun Sung) #6025780fdb3d39b] - typings: add buffer internalBinding typing (방진혁) #601638cb3b77039] - util: use more defensive code when inspecting error objects (Antoine du Hamel) #60139748d4f6430] - util: mark special properties when inspecting them (Ruben Bridgewater) #601316183a759d7] - vm: make vm.Module.evaluate() conditionally synchronous (Joyee Cheung) #602054b8506628f] - win: upgrade Visual Studio workload from 2019 to 2022 (Jiawen Geng) #60318v24.11.0: 2025-10-28, Version 24.11.0 'Krypton' (LTS), @richardlauCompare Source
Notable Changes
This release marks the transition of Node.js 24.x into Long Term Support (LTS)
with the codename 'Krypton'. It will continue to receive updates through to
the end of April 2028.
Other than updating metadata, such as the
process.releaseobject, to reflectthat the release is LTS, no further changes from Node.js 24.10.0 are included.
Known issue
An issue has been identified in the Node.js 24.x line with
Buffer.allocUnsafeunintentionally returning zero-filled buffers. This API is
documented to return uninitialized memory.
The documented behavior will be restored in the next Node.js 24.x LTS release to bring
it back in line with previous releases. For more information, see
#60423.
v24.10.0: 2025-10-08, Version 24.10.0 (Current), @RafaelGSSCompare Source
Notable Changes
31bb476895] - (SEMVER-MINOR) console: allow per-streaminspectOptionsoption (Anna Henningsen) #600823b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #5998018c79d9e1c] - (SEMVER-MINOR) sqlite: create authorization api (Guilherme Araújo) #59928Commits
e8cff3d51e] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #5987203294252ab] - benchmark: update count to n in permission startup (Bruno Rodrigues) #598723c8a609d9b] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #598727b2032b13e] - benchmark: adjust dgram offset-length len values (Bruno Rodrigues) #59708552d887aee] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #5970831bb476895] - (SEMVER-MINOR) console: allow per-streaminspectOptionsoption (Anna Henningsen) #600820bf022d4c0] - console,util: improve array inspection performance (Ruben Bridgewater) #6003704d568e591] - deps: V8: cherry-pickf93055f(Olivier Flückiger) #60105621058b3bf] - deps: update archs files for openssl-3.5.4 (Node.js GitHub Bot) #6010181b3009fe6] - deps: upgrade openssl sources to openssl-3.5.4 (Node.js GitHub Bot) #60101dc44c9f349] - deps: upgrade npm to 11.6.1 (npm team) #60012ec0f137198] - deps: update ada to 3.3.0 (Node.js GitHub Bot) #60045f490f91874] - deps: update amaro to 1.1.4 (pmarchini) #60044de7a7cd0d7] - deps: update ada to 3.2.9 (Node.js GitHub Bot) #59987a533e5b5db] - doc: add automated migration info to deprecations (Augustin Mauroy) #600227fb8fe4875] - doc: fix typo on child_process.md (Angelo Gazzola) #6011424c1ef9846] - doc: remove optional title prefixes (Aviv Keller) #6008708b9eb8e19] - doc: mark.envfiles support as stable (Santeri Hiltunen) #5992566d90b8063] - doc: mention reverse proxy and include simple example (Steven) #5973614aa1119cb] - doc: provide alternative tourl.parse()using WHATWG URL (Steven) #59736f9412324f6] - doc: fix typo of built-in module specifier in worker_threads (Deokjin Kim) #5999264e738a342] - doc,crypto: reorder ML-KEM in the asymmetric key types table (Filip Skokan) #600671b25008b41] - http: improve writeEarlyHints by avoiding for-of loop (Haram Jeong) #5995835f9b6b28f] - inspector: improve batch diagnostic channel subscriptions (Chengzhong Wu) #600093b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #59980c495e1fe57] - lib: optimize priority queue (Gürgün Dayıoğlu) #600396be31fb9f3] - lib: implement passive listener behavior per spec (BCD1me) #59995c5e4aa763b] - meta: bump actions/setup-python from 5.6.0 to 6.0.0 (dependabot[bot]) #6009050fa1f4a76] - meta: bump ossf/scorecard-action from 2.4.2 to 2.4.3 (dependabot[bot]) #60096def4ce976c] - meta: bump actions/cache from 4.2.4 to 4.3.0 (dependabot[bot]) #6009524b5abc0e9] - meta: bump step-security/harden-runner from 2.12.2 to 2.13.1 (dependabot[bot]) #600948ccf2b0b34] - meta: bump actions/setup-node from 4.4.0 to 5.0.0 (dependabot[bot]) #6009378580147ef] - meta: bump actions/stale from 9.1.0 to 10.0.0 (dependabot[bot]) #60092705686b5c4] - meta: bump codecov/codecov-action from 5.5.0 to 5.5.1 (dependabot[bot]) #60091423a6bc744] - meta: bump github/codeql-action from 3.30.0 to 3.30.5 (dependabot[bot]) #600899d9bd0fb4f] - meta: move Michael to emeritus (Michael Dawson) #60070dbeee55824] - module: use sync cjs when importing cts (Marco Ippolito) #60072a722f677ac] - perf_hooks: fix histogram fast call signatures (Renegade334) #59600b3295b8353] - process: fix wrong asyncContext under unhandled-rejections=strict (Shima Ryuhei) #60103cff4a7608a] - process: fix defaultenvforprocess.execve(Richard Lau) #60029cd034e927f] - process: fix hrtime fast call signatures (Renegade334) #5960018c79d9e1c] - (SEMVER-MINOR) sqlite: create authorization api (Guilherme Araújo) #59928d949222043] - sqlite: replaceToLocalCheckedand improve filter error handling (Edy Silva) #600286417dc879e] - src: bring permissions macros in line with general C/C++ standards (Anna Henningsen) #60053e273c2020c] - src: update contextify to use DictionaryTemplate (James M Snell) #600595f9ff60664] - src: removeAnalyzeTemporaryDtorsoption from .clang-tidy (iknoom) #600089db54adccc] - src: update cares_wrap to use DictionaryTemplates (James M Snell) #60033fc0ceb7b82] - src: correct the error handling in StatementExecutionHelper (James M Snell) #600403e8fdc1d8d] - src: remove unused variables from report (Moonki Choi) #60047d744324d8e] - src: avoid unnecessary string allocations in SPrintF impl (Anna Henningsen) #60052de65a5c719] - src: make ToLower/ToUpper input args more flexible (Anna Henningsen) #60052354026df5a] - src: allowstd::string_viewarguments toSPrintF()and friends (Anna Henningsen) #6005842f7d7cb20] - src: remove unnecessarystd::stringerror messages (Anna Henningsen) #6005730c2c0fedd] - src: remove unnecessary shadowed functions on Utf8Value & BufferValue (Anna Henningsen) #60056eb99eec09b] - src: avoid unnecessary string ->char*-> string round trips (Anna Henningsen) #60055c1f1dbdce2] - src: remove useless dereferencing inTHROW_...(Anna Henningsen) #60054ea0f5e575d] - src: filloptions_args,options_envafter vectors are finalized (iknoom) #59945415fff217a] - src: use RAII for uv_process_options_t (iknoom) #59945982b03ecbd] - test: marktest-runner-run-watchflaky on macOS (Richard Lau) #60115831a0d3d28] - test: ensure that the message event is fired (Luigi Pinca) #599525538cfc1e8] - test: replace diagnostics_channel stackframe in output snapshots (Chengzhong Wu) #6002477ec400d90] - test: mark test-web-locks skip on IBM i (SRAVANI GUNDEPALLI) #599961aaadb9e31] - test: ensure message event fires in worker message port test (Jarred Sumner) #598851d5cc5e57a] - test: mark sea tests flaky on macOS x64 (Richard Lau) #60068c412b1855d] - test: expand tls-check-server-identity coverage (Diango Gavidia) #60002ad87975029] - test: fix typo of test-benchmark-readline.js (Deokjin Kim) #59993bad4b9b878] - test: add newstartNewREPLSevertesting utility (Dario Piotrowicz) #59964ef90b0f456] - test: verify tracing channel doesn't swallow unhandledRejection (Gerhard Stöbich) #59974d7285459fe] - timers: fix binding fast call signatures (Renegade334) #596006529ae9b0c] - tools: add message on auto-fixing js lint issues in gh workflow (Dario Piotrowicz) #591281ca116a6ea] - tools: verify signatures when updating nghttp* (Antoine du Hamel) #6011320d10a2398] - tools: use dependabot cooldown and move tools/doc (Rafael Gonzaga) #59978275c07064c] - typings: update 'types' binding (René) #596928c21c4b286] - wasi: fix WasiFunction fast call signature (Renegade334) #59600b865074641] - win,tools: add description to signature (Martin Costello) #59877v24.9.0: 2025-09-25, Version 24.9.0 (Current), @targosCompare Source
Notable Changes
9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #583785563361d22] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #5874804013ee933] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #59846Commits
cbec4fd6de] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #596969a4bbdc3c5] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #598360b284d86e8] - build: add the missing macro definitions for OpenHarmony (hqzing) #5980443e6e54d66] - build: do not include custom ESLint rules testing in tarball (Antoine du Hamel) #59809039ac19154] - crypto: expose signatureAlgorithm on X509Certificate (Patrick Costa) #59235647c332704] - crypto: usereturn awaitwhen returning Promises from async functions (Renegade334) #598418ed4587cf0] - crypto: use async functions for non-stub Promise-returning functions (Renegade334) #59841bb051c56ef] - crypto: avoid calls topromise.catch()(Renegade334) #5984105e560dd25] - deps: update googletest to50b8600(Node.js GitHub Bot) #59955fa40d3a785] - deps: update archs files for openssl-3.5.3 (Node.js GitHub Bot) #599018c85570d18] - deps: upgrade openssl sources to openssl-3.5.3 (Node.js GitHub Bot) #59901b71125664e] - deps: update undici to 7.16.0 (Node.js GitHub Bot) #59830dea5dd7077] - dgram: restore buffer optimization in fixBufferList (Yoo) #59934b0c1e67532] - diagnostics_channel: fix race condition with diagnostics_channel and GC (Ugaitz Urien) #599100b37b594c3] - doc: use "WebAssembly" instead of "Web Assembly" (Tobias Nießen) #599541e723f9c6b] - doc: fix typo in section on microtask order (Tobias Nießen) #59932a28962a85c] - doc: update V8 fast API guidance (René) #58999bd767c5d1b] - doc: add security escalation policy (Ulises Gascón) #598069df91e59e1] - doc: type improvement of filehttp.md(yusheng chen) #58189e4f571680b] - doc: deprecate closingfs.Diron garbage collection (Livia Medeiros) #59839e9cb986fa5] - doc: rephrase dynamic import() description (Nam Yooseong) #59224026d4e33f7] - doc,crypto: update subtle.generateKey and subtle.importKey (Filip Skokan) #598512b2591db52] - esm: make hasAsyncGraph non-enumerable (Joyee Cheung) #59905993f05d323] - fs,win: do not add a second trailing slash in readdir (Gerhard Stöbich) #598477aec53b607] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #5982483ae6102e7] - http: optimize checkIsHttpToken for short strings (방진혁) #598326695067636] - http,https: handle IPv6 with proxies (Joyee Cheung) #59894c5d910a0a9] - http2: fix allowHttp1+Upgrade, broken by shouldUpgradeCallback (Tim Perry) #59924acada1fb82] - inspector: ensure adequate memory allocation forBinary::toBase64(René) #59870396cc8ec65] - lib: update inspect output format for subclasses (Miguel Marcondes Filho) #59687fed1dac8de] - lib: update isDeepStrictEqual to support options (Miguel Marcondes Filho) #59762d785929fd7] - lib: add source map support for assert messages (Chengzhong Wu) #59751ff13d1d61e] - lib,src: cache ModuleWrap.hasAsyncGraph (Chengzhong Wu) #59703b200cd8470] - lib,src: refactor assert to load error source from memory (Chengzhong Wu) #59751e94c57301b] - meta: add .npmrc with ignore-scripts=true (Joyee Cheung) #59914728472a57b] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874be48760b93] - node-api: added SharedArrayBuffer api (Mert Can Altin) #59071f006a14522] - node-api: make napi_delete_reference use node_api_basic_env (Jeetu Suthar) #596840f46c1c3b0] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #598573eeb7b47ea] - sqlite: fix crash session extension callbacks with workers (Bart Louwers) #598480fe53375ec] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #583789a3e58a007] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #58748f14ed5ab7b] - src: simplify watchdog instantiations viastd::optional(Anna Henningsen) #59960e330f03f84] - src: update crypto objects to use DictionaryTemplate (James M Snell) #5994269b5607cf4] - src: simplify is_callable by making it a concept (Tobias Nießen) #5816986150f3401] - src: rename private fields to follow naming convention (Moonki Choi) #59923d17f299539] - src: use DictionaryTemplate more in URLPattern (James M Snell) #59892ac784912ac] - src: reduce the nearest parent package JSON cache size (Michael Smith) #59888abecdcb536] - src: replace FIXED_ONE_BYTE_STRING with Environment-cached strings (Moonki Choi) #598912bb152500b] - src: create strings inFIXED_ONE_BYTE_STRINGas internalized (Anna Henningsen) #5982603116a7cd8] - src: removestd::arrayoverload ofFIXED_ONE_BYTE_STRING(Anna Henningsen) #598268a5325d6e3] - src: ensurev8::Eternalis empty before setting it (Anna Henningsen) #59825f0c20ccd81] - src: remove unnecessaryEnvironment::GetCurrent()calls (Moonki Choi) #59814213188e491] - stream: use new AsyncResource instead of bind (Matteo Collina) #59867ce8435b003] - test: testcase demonstrating issue 59541 (Eric Rannaud) #598018f32746142] - test: guard write to proxy client if proxy connection is ended (Joyee Cheung) #597426790093fcb] - tls: load bundled and extra certificates off-thread (Joyee Cheung) #59856f5d3f919d8] - tls: only do off-thread certificate loading on loading tls (Joyee Cheung) #5985687bbaa23a0] - tools: fixtools/make-v8.shfor clang (Richard Lau) #598930d23fd525b] - tools: skip test-internet workflow for draft PRs (Michaël Zasso) #59817e17c73731a] - tools: copyeditbuild-tarball.yml(Antoine du Hamel) #5980897c4e1bac9] - typings: remove unused imports (Nam Yooseong) #598808b29bbca76] - url: replaced slice with at (Mikhail) #591816458867a6b] - url: add type checking to urlToHttpOptions() (simon-id) #597533c62b3886f] - util: inspect objects with throwing Symbol.toStringTag (Ruben Bridgewater) #598606133a82875] - util: fix debuglog.enabled not being present with callback logger (Ruben Bridgewater) #598589347ddddf4] - vm: explain how to share promises between contexts w/ afterEvaluate (Eric Rannaud) #5980144ce971619] - vm: "afterEvaluate", evaluate() return a promise from the outer context (Eric Rannaud) #598016e586a1409] - vm: expose hasTopLevelAwait on SourceTextModule (Chengzhong Wu) #5986549747a58a3] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #59846b970c0bbc2] - zlib: reduce code duplication (jhofstee) #578109782ca2b1b] - zlib: implement fast path for crc32 (Gürgün Dayıoğlu) #59813v24.8.0: 2025-09-10, Version 24.8.0 (Current), @targosCompare Source
Notable Changes
HTTP/2 Network Inspection Support in Node.js
Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js.
Usage
Write a
test.jsscript that makes HTTP/2 requests.Run it with these options:
Open
about:inspecton Google Chrome and click onOpen dedicated DevTools for Node.The
Networktab will let you track your HTTP/2 calls.Contributed by Darshan Sen in #59611.
Other Notable Changes
7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #595704b631be0b0](https://redirecConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.