Node v24.19.0 nsolid v6.3.6 release - #514
Merged
santigimeno merged 243 commits intoAug 12, 2026
Merged
Conversation
Replace the O(n) case-insensitive algorithm-name scan
with an O(1) SafeMap lookup. The map is pre-built at
module init alongside kSupportedAlgorithms.
Hoist the opts object literal used in normalizeAlgorithm
to module level to avoid allocating identical
{ prefix, context } objects on every call.
Pre-compute ObjectKeys() for simpleAlgorithmDictionaries
entries at module init to avoid allocating a new keys
array on every normalizeAlgorithm call.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs/node#62756
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Replace object spread in nested WebIDL conversion options with stable-shape ordinary objects. This keeps hot dictionary and sequence conversion paths from allocating null-prototype spread results. Apply the same pattern to Web Crypto converter wrappers that override allowResizable or enable [EnforceRange]. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#62756 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: Matteo Collina <matteo.collina@gmail.com> PR-URL: nodejs/node#62562 Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Nad Alaba <37968805+nadalaba@users.noreply.github.com> PR-URL: nodejs/node#63117 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: avivkeller <me@aviv.sh> PR-URL: nodejs/node#63493 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Rename WebCrypto operation parameters and local variables to match the spec terminology. Use operation, algorithm, and key names consistently between the docs and implementation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63518 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Drive the regression test from the WebCrypto algorithm registry so all supported algorithms and operations must add explicit coverage regardless of whether they are native-job backed or js-based. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63520 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Refs: nodejs/node#62761 Signed-off-by: StefanStojanovic <stefan.stojanovic@janeasystems.com> PR-URL: nodejs/node#63413 Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Signed-off-by: Mohamed Sayed <k@3zrv.com> PR-URL: nodejs/node#63529 Fixes: nodejs/node#63514 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63556 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Mert Can Altin <mertgold60@gmail.com> PR-URL: nodejs/node#63385 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Fix build warnings by casting the number literals to the size_t constants they are compared against. Signed-off-by: Maya Lekova <maya@igalia.com> PR-URL: nodejs/node#63490 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: nodejs/node#63668 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: nodejs/node#63669 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Mohamed Sayed <k@3zrv.com> PR-URL: nodejs/node#63601 Fixes: nodejs/node#63513 Reviewed-By: LiviaMedeiros <livia@cirno.name> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs/node#63293 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
This function call can fail with `Z_VERSION_ERROR` if the compiled
library vs loaded library mismatched in version number or in
stream structure size.
In those cases, zlib doesn't initialize the `strm_.msg` field to
null. Therefore, when a `CompressionError` object is created via
`ErrorForMessage()`, it can read a stale or uninitialized `strm_.msg`
pointer that will cause a crash.
Example ASAN report:
```
AddressSanitizer: SEGV on unknown address
#0 __strlen_avx2
string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1 strlen (/work/node/out/Debug/node+0x1a42ab7)
#2 v8::(anonymous namespace)::StringLength(char const*)
/work/node/out/../deps/v8/src/api/api.cc:7581:16
#3 v8::(anonymous namespace)::StringLength(unsigned char const*)
/work/node/out/../deps/v8/src/api/api.cc:7587:10
#4 v8::String::NewFromOneByte(v8::Isolate*,
unsigned char const*, v8::NewStringType, int)
/work/node/out/../deps/v8/src/api/api.cc:7677:3
#5 node::OneByteString(v8::Isolate*,
char const*, int, v8::NewStringType)
/work/node/out/../src/util-inl.h:166:10
#6 node::(anonymous namespace)::CompressionStream<
node::(anonymous namespace)::ZlibContext>
::EmitError(node::(anonymous namespace)
::CompressionError const&)
/work/node/out/../src/node_zlib.cc:565:7
#7 node::(anonymous namespace)::CompressionStream<
node::(anonymous namespace)::ZlibContext>
::CheckError()
/work/node/out/../src/node_zlib.cc:519:5
#8 node::(anonymous namespace)::CompressionStream<
node::(anonymous namespace)::ZlibContext>
::AfterThreadPoolWork(int)
/work/node/out/../src/node_zlib.cc:543:10
#9 node::ThreadPoolWork::ScheduleWork()
::'lambda'(uv_work_s*, int)
::operator()(uv_work_s*, int) const
/work/node/out/../src/threadpoolwork-inl.h:57:15
#10 node::ThreadPoolWork::ScheduleWork()
::'lambda'(uv_work_s*, int)
::__invoke(uv_work_s*, int)
/work/node/out/../src/threadpoolwork-inl.h:48:7
#11 uv__work_done /work/libuv-1.51.0/src/threadpool.c:330:5
#12 uv__async_io.part.0
/work/libuv-1.51.0/src/unix/async.c:208:5
```
Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: nodejs/node#63476
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: arbinger <alphaleadershipyt@protonmail.com> PR-URL: nodejs/node#63050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: nodejs/node#63670 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: nodejs/node#63545 Refs: nodejs/node#55794 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: nodejs/node#63644 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Update the setRawMode documentation to specify that raw mode disables special processing of input characters only. Output processing, such as newline translation on Unix terminals, is not affected. Fixes: nodejs/node#63059 Signed-off-by: zeeshan56656 <zeeshan130710@gmail.com> PR-URL: nodejs/node#63438 Reviewed-By: Anna Henningsen <anna@addaleax.net>
A recursively watched directory can be removed after a parent watcher observes it but before the non-native recursive watcher scans it. Ignore ENOENT from the directory scan so this deletion race does not emit an unhandled watcher error. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: nodejs/node#63686 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-06-01.md#jstest-failure Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Use common.nodeProcessAborted() for the intentional abort path so platform-specific abort signals such as SIGILL are accepted. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: nodejs/node#63687 Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-06-01.md#jstest-failure Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Herrtian <70463940+Herrtian@users.noreply.github.com> PR-URL: nodejs/node#63542 Fixes: nodejs/node#62774 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com> PR-URL: nodejs/node#63700 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: nodejs/node#63707 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Move KeyObject.prototype.toCryptoKey() onto the base KeyObject class and dispatch from the cached native key type. Both secret and asymmetric conversions now pass a KeyObjectHandle through the Web Crypto import paths. Expose KeyObjectHandle.prototype.getKeyType() so asymmetric importers can validate public/private usages without wrapping the handle back into a KeyObject. Secret importers likewise consume KeyObjectHandle directly. Use the shared asymmetric conversion helper to derive public CryptoKeys for SubtleCrypto.getPublicKey(), avoiding the temporary PrivateKeyObject/createPublicKey round trip while keeping usage validation in the import path. Update getPublicKey and KeyObject.toCryptoKey tests to be driven from the Web Crypto supported-algorithm registry so new algorithms require either coverage or an explicit skip. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63622 Backport-PR-URL: nodejs/node#64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs/node#63900 Backport-PR-URL: nodejs/node#64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Introduce prepareSubtleMethod() and convertSubtleArgument() for the common SubtleCrypto call prelude. Methods now reuse the same receiver check, required-argument check, error prefix construction, argument context selection, and WebIDL conversion path. Introduce WebCrypto key usage helpers for common usage validation and key pair usage splitting. Algorithm modules now define their allowed public, private, and key generation usages once, then call the shared helpers from generateKey() and importKey() paths. This removes repeated function-invocation setup in webcrypto.js and repeated key usage checks across the WebCrypto algorithm modules while preserving the existing validation behavior. Mark normalized-algorithm fallback branches as unreachable assertions. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63975 Backport-PR-URL: nodejs/node#64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Add shared bit-length helpers for WebCrypto operations that accept bit sequences whose length is not byte-aligned. Use the helpers for cSHAKE output, ECDH-derived bits, HMAC/KMAC key generation/import/derivation, and KMAC sign/verify output. Preserve the requested bit length in CryptoKey algorithm metadata while storing and exporting rounded-up byte material with unused low bits cleared. Keep byte-multiple validation for algorithms whose specs require it. Extend the lower-end of KMAC's key length support. Enable cSHAKE customization and functionName parameters. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#63988 Backport-PR-URL: nodejs/node#64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Return false for Ed25519 and Ed448 one-shot verification when the public key or signature R component is a known low-order point. This keeps key import behavior unchanged while making WebCrypto verification match WPT expectations across OpenSSL variants. Remove the stale WPT expected-failure entry and add focused regression coverage for both curves. Closes: nodejs/node#54572 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#64026 Backport-PR-URL: nodejs/node#64629 Fixes: nodejs/node#54572 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs/node#64033 Backport-PR-URL: nodejs/node#64629 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Original commit message:
optimize ascii fast path in WriteUtf8V2
Change-Id: If28168cb4395b953d0ec642ef4fc618ce963dbcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124103
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Erik Corry <erikcorry@chromium.org>
Reviewed-by: Erik Corry <erikcorry@chromium.org>
Cr-Commit-Position: refs/heads/main@{#103542}
Refs: v8/v8@64b36b4
PR-URL: nodejs/node#61712
Backport-PR-URL: nodejs/node#64630
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Add a samplePerIteration option to monitorEventLoopDelay that records event loop delay from libuv event loop iterations instead of the timer interval sampler. The default remains interval-based; existing uses of monitorEventLoopDelay() keep behaving the same unless the samplePerIteration option is passed through. Signed-off-by: Pablo Erhard <pablo.erhardhernandez@datadoghq.com> PR-URL: nodejs/node#62935 Backport-PR-URL: nodejs/node#64480 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net> PR-URL: nodejs/node#63626 Backport-PR-URL: nodejs/node#64632 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
With the introduction of always static target `node_base`, `node_aix_shared` is now redundant. Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net> PR-URL: nodejs/node#63747 Backport-PR-URL: nodejs/node#64632 Refs: nodejs/node#63626 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Original commit message:
[api] Add V8::GetWasmMemoryReservationSizeInBytes()
When the system does not have enough virtual memory for the wasm
cage, installing the trap handler would cause any code allocating
wasm memory to throw. Therefore it's useful for the embedder to
know when the system doesn't have enough virtual address space
to allocate enough wasm cages and in that case, skip the
trap handler installation so that wasm code can at least work
(even not at the maximal performance).
Node.js previously has a command line option
--disable-wasm-trap-handler to fully disable trap-based bound checks,
this new API would allow it to adapt automatically while keeping the
optimization in the happy path, since it's not always possible for
end users to opt-into disabling trap-based bound checks (for example,
when a VS Code Server is loaded in a remote server for debugging).
Refs: nodejs/node#62132
Refs: microsoft/vscode#251777
Change-Id: I345c076af2b2b47700e5716b49c3133fdf8a0981
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7638233
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#105702}
Refs: v8/v8@bef0d9c
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: nodejs/node#62132
Backport-PR-URL: nodejs/node#64338
Refs: microsoft/vscode#251777
Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7638233
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs/node#62132 Backport-PR-URL: nodejs/node#64338 Refs: microsoft/vscode#251777 Refs: https://chromium-review.googlesource.com/c/v8/v8/+/7638233 Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs/node#60798 Backport-PR-URL: nodejs/node#63659 Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs/node#60798 Backport-PR-URL: nodejs/node#63659 Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs/node#61610 Backport-PR-URL: nodejs/node#63659 Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Notable changes: buffer: * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) nodejs/node#64036 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) nodejs/node#62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) nodejs/node#63050 * mark `stream.compose` stable (Matteo Collina) nodejs/node#62562 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) nodejs/node#62300 fs: * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) nodejs/node#63634 http: * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) nodejs/node#61597 net: * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) nodejs/node#63825 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) nodejs/node#62935 src: * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) nodejs/node#61610 stream: * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) nodejs/node#64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) nodejs/node#64119 * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) nodejs/node#62217 PR-URL: nodejs/node#64654
2026-08-03 Node.js v24.19.0 Krypton (LTS) Release Git-EVTag-v0-SHA512: 9377f5861be8015b883f36e9141e3b7a2ad343b4bde8467b45a164c16a91df13c5ae09a3c590a038297d10e595b9e88a7af509904b5ed1d51c4a123770601378
Signed-off-by: Santiago Gimeno <santiago.gimeno@gmail.com>
Signed-off-by: Santiago Gimeno <santiago.gimeno@gmail.com>
Signed-off-by: Santiago Gimeno <santiago.gimeno@gmail.com>
|
Important Review skippedToo many files! This PR contains 972 files, which is 822 over the limit of 150. To get a review, reduce the PR to 150 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to Pro+ to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (38)
📒 Files selected for processing (972)
You can disable this status message by setting the Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
RafaelGSS
approved these changes
Aug 10, 2026
EHortua
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.