BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
47,759 Commits 266 Branches 972 Tags
330f7b550372f45ede4543ea96bb9e70e166ccbd
Commit Graph
728 Commits
Author SHA1 Message Date
Antoine du Hamel 3f2fc8aaef 2026-08-05, Version 26.7.0 (Current) 
Notable changes:

crypto:
  * (SEMVER-MINOR) support loading private keys through STORE loaders (Filip Skokan) https://github.com/nodejs/node/pull/63949
  * update root certificates to NSS 3.125 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/64746
lib:
  * (SEMVER-MINOR) add perfetto support (Chengzhong Wu) https://github.com/nodejs/node/pull/64565
module:
  * (SEMVER-MINOR) implement `Symbol.dispose` in ModuleHooks (Remco Haszing) https://github.com/nodejs/node/pull/63928
test_runner:
  * (SEMVER-MINOR) add support for `--test-coverage-include-all` (avivkeller) https://github.com/nodejs/node/pull/64830

PR-URL: https://github.com/nodejs/node/pull/65027
 2026-08-05 18:21:40 +02:00
Antoine du Hamel a24bd2769f 2026-08-03, Version 26.6.0 (Current) 
Notable changes:

doc:
  * add MikeMcC399 as collaborator (Mike McCready) https://github.com/nodejs/node/pull/64656
ffi:
  * (SEMVER-MINOR) add `getCurrentEventLoop` (Paolo Insogna) https://github.com/nodejs/node/pull/64323
test_runner:
  * (SEMVER-MINOR) add `context.log()` and `test:log` event (Moshe Atlow) https://github.com/nodejs/node/pull/64389
  * (SEMVER-MINOR) report `entryFile` in `TestStream` events (Moshe Atlow) https://github.com/nodejs/node/pull/64309

PR-URL: https://github.com/nodejs/node/pull/64655
 2026-08-03 15:30:47 +02:00
Antoine du Hamel 401ea64c3e 2026-08-03, Version 24.19.0 'Krypton' (LTS) 
Notable changes:

buffer:
  * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) https://github.com/nodejs/node/pull/64036
deps:
  * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) https://github.com/nodejs/node/pull/62217
doc:
  * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) https://github.com/nodejs/node/pull/63050
  * mark `stream.compose` stable (Matteo Collina) https://github.com/nodejs/node/pull/62562
esm:
  * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) https://github.com/nodejs/node/pull/62300
fs:
  * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) https://github.com/nodejs/node/pull/63634
http:
  * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) https://github.com/nodejs/node/pull/61597
net:
  * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) https://github.com/nodejs/node/pull/63825
perf_hooks:
  * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) https://github.com/nodejs/node/pull/62935
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) https://github.com/nodejs/node/pull/61610
stream:
  * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) https://github.com/nodejs/node/pull/64195
tls:
  * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) https://github.com/nodejs/node/pull/64119
  * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) https://github.com/nodejs/node/pull/62217

PR-URL: https://github.com/nodejs/node/pull/64654
 2026-08-03 15:30:35 +02:00
RafaelGSS 012ecf51d3 2026-07-29, Version 24.18.1 'Krypton' (LTS) 
This is a security release.

Notable changes:

* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 7.29.0 (Node.js GitHub Bot)

PR-URL: https://github.com/nodejs-private/node-private/pull/937
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
 2026-07-29 10:58:06 -03:00
RafaelGSS a0cf4d5611 2026-07-29, Version 26.5.1 (Current) 
This is a security release.

Notable changes:

deps:
  * update llhttp to 9.4.3
  * update undici to 8.9.0
dns:
  * (CVE-2026-58042) handle large resolveAny address replies
http:
  * (CVE-2026-58044) reject requests exceeding max header count
http2:
  * (CVE-2026-56848) defer rst stream while in scope
https:
  * (CVE-2026-58040) bind identity checks to session reuse
  * (CVE-2026-56850) distinguish PFX object-array agent keys
permission:
  * (CVE-2026-58043) avoid granting radix split nodes
  * (CVE-2026-58039) check final report output path
  * (CVE-2026-56847) enforce fs write permission for trace events
sqlite:
  * (CVE-2026-58041) invalidate tag store iterators on statement reset
zlib:
  * (CVE-2026-58045) throw on out-of-bounds write buffers

PR-URL: https://github.com/nodejs-private/node-private/pull/936
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
 2026-07-29 10:39:32 -03:00
RafaelGSS 0b5c397f25 2026-07-29, Version 22.23.2 'Jod' (LTS) 
This is a security release.

Notable changes:

* (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 6.28.0 (Node.js GitHub Bot)

PR-URL: https://github.com/nodejs-private/node-private/pull/938
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
 2026-07-29 15:34:20 +02:00
Node.js GitHub Bot 9051e5e7eb 2026-07-08, Version 26.5.0 (Current) 
Notable changes:

buffer:
  * (SEMVER-MINOR) implement blob.textStream() (Matthew Aitken) https://github.com/nodejs/node/pull/64036
esm:
  * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) https://github.com/nodejs/node/pull/62300
perf_hooks:
  * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) https://github.com/nodejs/node/pull/62935
stream:
  * (SEMVER-MINOR) expose ReadableStreamTee (Matteo Collina) https://github.com/nodejs/node/pull/64195
tls:
  * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) https://github.com/nodejs/node/pull/64119

PR-URL: https://github.com/nodejs/node/pull/64329
Signed-off-by: Richard Lau <richard.lau@ibm.com>
 2026-07-08 11:48:20 +00:00
Antoine du Hamel cc37ad592f 2026-06-24, Version 26.4.0 (Current) 
Notable changes:

deps:
  * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) https://github.com/nodejs/node/pull/62217
doc:
  * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) https://github.com/nodejs/node/pull/63050
fs:
  * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) https://github.com/nodejs/node/pull/63634
http:
  * (SEMVER-MINOR) close pre-request sockets in `closeIdleConnections` (semimikoh) https://github.com/nodejs/node/pull/63470
loader:
  * (SEMVER-MINOR) implement package maps (Maël Nison) https://github.com/nodejs/node/pull/62239
net:
  * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) https://github.com/nodejs/node/pull/63825
tls:
  * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) https://github.com/nodejs/node/pull/62217
vfs:
  * (SEMVER-MINOR) dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) https://github.com/nodejs/node/pull/63537
  * (SEMVER-MINOR) add minimal `node:vfs` subsystem (Matteo Collina) https://github.com/nodejs/node/pull/63115

PR-URL: https://github.com/nodejs/node/pull/64058
 2026-06-25 01:20:15 +02:00
Stewart X Addison 9f23e70866 2026-06-23, Version 24.18.0 'Krypton' (LTS) 
Notable changes:

buffer:
  * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) https://github.com/nodejs/node/pull/63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/63527
  * (SEMVER-MINOR)  align key argument names in docs and error messages (Filip Skokan) https://github.com/nodejs/node/pull/62527
  * (SEMVER-MINOR)  accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) https://github.com/nodejs/node/pull/62527
  * (SEMVER-MINOR)  add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) https://github.com/nodejs/node/pull/62183
http:
  * http: avoid stream listeners on idle agent sockets (Matteo Collina) https://github.com/nodejs/node/pull/64004
  * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) https://github.com/nodejs/node/pull/63155
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) https://github.com/nodejs/node/pull/63079
stream:
  * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) https://github.com/nodejs/node/pull/63834

PR-URL: https://github.com/nodejs/node/pull/64062
 2026-06-23 22:59:09 +00:00
Node.js GitHub Bot 152c492453 2026-06-23, Version 22.23.1 'Jod' (LTS) 
PR-URL: https://github.com/nodejs/node/pull/64067
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
 2026-06-23 13:38:32 -03:00
Antoine du Hamel d001e26f40 2026-06-18, Version 26.3.1 (Current) 
This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

PR-URL: https://github.com/nodejs-private/node-private/pull/897
 2026-06-18 06:29:25 +02:00
Antoine du Hamel 4547bca84f 2026-06-18, Version 24.17.0 'Krypton' (LTS) 
This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

PR-URL: https://github.com/nodejs-private/node-private/pull/899
 2026-06-18 06:29:24 +02:00
Antoine du Hamel 26badaa6e1 2026-06-18, Version 22.23.0 'Jod' (LTS) 
This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

PR-URL: https://github.com/nodejs-private/node-private/pull/898
 2026-06-18 06:29:24 +02:00
Antoine du Hamel 6d02b36f30 2026-06-01, Version 26.3.0 (Current) 
Notable changes:

buffer:
  * (SEMVER-MINOR) increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) https://github.com/nodejs/node/pull/63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/63527
doc:
  * downgrade macOS x64 support to Tier 2 (Antoine du Hamel) https://github.com/nodejs/node/pull/63055
http:
  * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) https://github.com/nodejs/node/pull/61597
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) https://github.com/nodejs/node/pull/63079
lib,permission:
  * (SEMVER-MINOR) add `permission.drop` (Rafael Gonzaga) https://github.com/nodejs/node/pull/62672

PR-URL: https://github.com/nodejs/node/pull/63664
 2026-06-01 15:01:03 +02:00
Node.js GitHub Bot 0d6541aca0 2026-05-21, Version 24.16.0 'Krypton' (LTS) 
Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63263
 2026-05-21 15:17:18 +02:00
Antoine du Hamel d9558968d9 2026-05-20, Version 26.2.0 (Current) 
Notable changes:

doc:
  * mark `stream.compose` stable (Matteo Collina) https://github.com/nodejs/node/pull/62562
fs:
  * (SEMVER-MINOR) add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) https://github.com/nodejs/node/pull/60789
http:
  * (SEMVER-MINOR) add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) https://github.com/nodejs/node/pull/63155

PR-URL: https://github.com/nodejs/node/pull/63440
 2026-05-20 15:00:12 +02:00
Marco Ippolito bf7e79c264 2026-05-13, Version 22.22.3 'Jod' (LTS) 
PR-URL: https://github.com/nodejs/node/pull/63250
 2026-05-13 20:37:10 +02:00
Antoine du Hamel a9b98b21bd doc: fix deprecation list in 26.0.0 changelog 
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63147
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
 2026-05-08 08:23:08 +00:00
Antoine du Hamel a725fe1389 2026-05-07, Version 26.1.0 (Current) 
Notable changes:

buffer:
  * (SEMVER-MINOR) add `end` parameter (Robert Nagy) https://github.com/nodejs/node/pull/62390
crypto:
  * (SEMVER-MINOR) accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) https://github.com/nodejs/node/pull/62527
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
lib,src,test,doc:
  * (SEMVER-MINOR) add `node:ffi` module (Colin Ihrig) https://github.com/nodejs/node/pull/62072
process:
  * (SEMVER-MINOR) throw on `execve(2)` failure instead of aborting (Bryan English) https://github.com/nodejs/node/pull/62878
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) https://github.com/nodejs/node/pull/61610
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63137
 2026-05-07 12:01:50 +02:00
Rafael Gonzaga 2b112e70fe doc: fix changelog for chromium numbering 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/63133
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2026-05-05 21:05:27 +00:00
RafaelGSS 9e633f94ce 2026-05-05, Version 26.0.0 (Current) 
assert:
  * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) https://github.com/nodejs/node/pull/58849
build:
  * (SEMVER-MAJOR) bump GCC requirement to 13.2 (Michaël Zasso) https://github.com/nodejs/node/pull/62555
  * (SEMVER-MAJOR) enable Temporal by default (Richard Lau) https://github.com/nodejs/node/pull/61806
  * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) https://github.com/nodejs/node/pull/62296
  * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) https://github.com/nodejs/node/pull/61177
  * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) https://github.com/nodejs/node/pull/60863
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) https://github.com/nodejs/node/pull/60111
build,test:
  * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) https://github.com/nodejs/node/pull/61898
build,win:
  * (SEMVER-MAJOR) fix Temporal build (StefanStojanovic) https://github.com/nodejs/node/pull/61806
crypto:
  * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) https://github.com/nodejs/node/pull/62499
  * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) https://github.com/nodejs/node/pull/62453
  * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) https://github.com/nodejs/node/pull/62348
  * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) https://github.com/nodejs/node/pull/62178
  * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) https://github.com/nodejs/node/pull/61084
  * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) https://github.com/nodejs/node/pull/60830
deps:
  * (SEMVER-MAJOR) V8: cherry-pick 0f024d4e66e0 (ishabi) https://github.com/nodejs/node/pull/62408
  * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/62384
  * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) https://github.com/nodejs/node/pull/59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) https://github.com/nodejs/node/pull/54077
  * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) https://github.com/nodejs/node/pull/60111
  * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) https://github.com/nodejs/node/pull/60111
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) https://github.com/nodejs/node/pull/59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) https://github.com/nodejs/node/pull/58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) https://github.com/nodejs/node/pull/54077
  * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) https://github.com/nodejs/node/pull/60111
diagnostics_channel:
  * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) https://github.com/nodejs/node/pull/61766
doc:
  * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) https://github.com/nodejs/node/pull/62176
  * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) https://github.com/nodejs/node/pull/61973
  * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) https://github.com/nodejs/node/pull/61005
http:
  * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) https://github.com/nodejs/node/pull/60635
  * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) https://github.com/nodejs/node/pull/60016
lib:
  * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) https://github.com/nodejs/node/pull/61333
lib,src:
  * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) https://github.com/nodejs/node/pull/62293
module:
  * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) https://github.com/nodejs/node/pull/62401
  * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) https://github.com/nodejs/node/pull/61803
src:
  * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) https://github.com/nodejs/node/pull/60488
  * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) https://github.com/nodejs/node/pull/60496
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) https://github.com/nodejs/node/pull/60111
stream:
  * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) https://github.com/nodejs/node/pull/62173
  * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) https://github.com/nodejs/node/pull/60657
  * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) https://github.com/nodejs/node/pull/60441
  * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) https://github.com/nodejs/node/pull/59873
test:
  * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) https://github.com/nodejs/node/pull/60488
tools:
  * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) https://github.com/nodejs/node/pull/61898
util:
  * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) https://github.com/nodejs/node/pull/61029
  * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) https://github.com/nodejs/node/pull/60339

PR-URL: https://github.com/nodejs/node/pull/62526
 2026-05-05 11:17:12 -03:00
Node.js GitHub Bot 0dceddde2c 2026-04-15, Version 24.15.0 'Krypton' (LTS) 
Notable changes:

cli:
  * (SEMVER-MINOR) add --max-heap-size option (tannal) https://github.com/nodejs/node/pull/58708
  * add --require-module/--no-require-module (Joyee Cheung) https://github.com/nodejs/node/pull/60959
crypto:
  * (SEMVER-MINOR) add raw key formats support to the KeyObject APIs (Filip Skokan) https://github.com/nodejs/node/pull/62240
fs:
  * (SEMVER-MINOR) add `throwIfNoEntry` option for fs.stat and fs.promises.stat (Juan José) https://github.com/nodejs/node/pull/61178
http2:
  * (SEMVER-MINOR) add http1Options for HTTP/1 fallback configuration (Amol Yadav) https://github.com/nodejs/node/pull/61713
module:
  * mark require(esm) as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60959
  * mark module compile cache as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60971
net:
  * (SEMVER-MINOR) add `setTOS` and `getTOS` to `Socket` (Amol Yadav) https://github.com/nodejs/node/pull/61503
sqlite:
  * (SEMVER-MINOR) add limits property to DatabaseSync (Mert Can Altin) https://github.com/nodejs/node/pull/61298
  * mark as release candidate (Matteo Collina) https://github.com/nodejs/node/pull/61262
src:
  * (SEMVER-MINOR) add C++ support for diagnostics channels (RafaelGSS) https://github.com/nodejs/node/pull/61869
stream:
  * (SEMVER-MINOR) rename `Duplex.toWeb()` type option to `readableType` (René) https://github.com/nodejs/node/pull/61632
test_runner:
  * add exports option for module mocks (sangwook) https://github.com/nodejs/node/pull/61727
  * (SEMVER-MINOR) expose worker ID for concurrent test execution (Ali Hassan) https://github.com/nodejs/node/pull/61394
  * (SEMVER-MINOR) show interrupted test on SIGINT (Matteo Collina) https://github.com/nodejs/node/pull/61676

PR-URL: https://github.com/nodejs/node/pull/62681
 2026-04-15 18:59:05 +02:00
Antoine du Hamel 86282b56d2 2026-04-01, Version 25.9.0 (Current) 
Notable changes:

async_hooks:
  * (SEMVER-MINOR) add using scopes to `AsyncLocalStorage` (Stephen Belanger) https://github.com/nodejs/node/pull/61674
cli:
  * (SEMVER-MINOR) add `--max-heap-size` option (tannal) https://github.com/nodejs/node/pull/58708
crypto:
  * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) https://github.com/nodejs/node/pull/62183
repl:
  * (SEMVER-MINOR) add customizable error handling (Anna Henningsen) https://github.com/nodejs/node/pull/62188
  * (SEMVER-MINOR) remove dependency on `node:domain` (Matteo Collina) https://github.com/nodejs/node/pull/61227
sea:
  * (SEMVER-MINOR) support code cache for ESM entrypoint in SEA (Joyee Cheung) https://github.com/nodejs/node/pull/62158
stream:
  * (SEMVER-MINOR) add stream/iter Implementation (James M Snell) https://github.com/nodejs/node/pull/62066
test_runner:
  * add exports option for module mocks (sangwook) https://github.com/nodejs/node/pull/61727

PR-URL: https://github.com/nodejs/node/pull/62522
 2026-04-01 16:41:20 +02:00
Marco Ippolito 7be0e28b68 2026-03-24, Version 20.20.2 'Iron' (LTS) 
This is a security release.

Notable changes:

crypto:
  * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC
deps:
  * update undici to v6.24.1
  * (CVE-2026-21717) fix array index hash collision
http:
  * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
  * (CVE-2026-21716) include permission check on lib/fs/promises
  * (CVE-2026-21715) add permission check to realpath.native
src:
  * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
tls:
  * (CVE-2026-21637) wrap SNICallback invocation in try/catch

PR-URL: https://github.com/nodejs-private/node-private/pull/842
 2026-03-24 21:31:23 +01:00
RafaelGSS d88a46aa28 2026-03-24, Version 25.8.2 (Current) 
This is a security release.

Notable changes:

build,deps,test:
  * (CVE-2026-21717) test array index hash collision
crypto:
  * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC
http:
  * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
  * (CVE-2026-21711) include permission check to pipe_wrap.cc
  * (CVE-2026-21716) include permission check on lib/fs/promises
  * (CVE-2026-21715) add permission check to realpath.native
src:
  * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
  * (CVE-2026-21712) handle url crash on different url formats
tls:
  * (CVE-2026-21637) wrap SNICallback invocation in try/catch

PR-URL: https://github.com/nodejs-private/node-private/pull/843
 2026-03-24 17:14:25 -03:00
Juan José Arboleda 141d9f15b2 2026-03-24, Version 24.14.1 'Krypton' (LTS) 
This is a security release.

Notable changes:

build,deps,test:
  * (CVE-2026-21717) test array index hash collision
crypto:
  * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC
http:
  * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
  * (CVE-2026-21716) include permission check on lib/fs/promises
  * (CVE-2026-21715) add permission check to realpath.native
src:
  * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
  * (CVE-2026-21712) handle url crash on different url formats
tls:
  * (CVE-2026-21637) wrap SNICallback invocation in try/catch

PR-URL: https://github.com/nodejs-private/node-private/pull/837
 2026-03-24 17:12:08 -03:00
Antoine du Hamel d2be89c081 2026-03-24, Version 22.22.2 'Jod' (LTS) 
This is a security release.

Notable changes:

build,test,deps:
  * (CVE-2026-21717) test array index hash collision
crypto:
  * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC
http:
  * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
  * (CVE-2026-21716) include permission check on lib/fs/promises
  * (CVE-2026-21715) add permission check to realpath.native
src:
  * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
tls:
  * (CVE-2026-21637) wrap SNICallback invocation in try/catch

PR-URL: https://github.com/nodejs-private/node-private/pull/844
 2026-03-24 17:09:57 -03:00
Node.js GitHub Bot 3bbed1634a 2026-03-11, Version 25.8.1 (Current) 
PR-URL: https://github.com/nodejs/node/pull/62184
 2026-03-11 09:58:25 +01:00
Antoine du Hamel 4431abc01e 2026-03-05, Version 22.22.1 'Jod' (LTS) 
build:
  * test on Python 3.14 (Christian Clauss) https://github.com/nodejs/node/pull/59983
cli:
  * mark `--heapsnapshot-near-heap-limit` as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60956
crypto:
  * update root certificates to NSS 3.119 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/61419
  * update root certificates to NSS 3.117 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/60741
doc:
  * add avivkeller to collaborators (Aviv Keller) https://github.com/nodejs/node/pull/61115
  * add gurgunday to collaborators (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/61094
meta:
  * add Renegade334 to collaborators (Renegade334) https://github.com/nodejs/node/pull/60714

PR-URL: https://github.com/nodejs/node/pull/61947
 2026-03-05 15:09:33 +01:00
Marco Ippolito 0c07822256 2026-03-05, Version 20.20.1 'Iron' (LTS) 
Notable changes:

build:
  * test on Python 3.14 (Christian Clauss) https://github.com/nodejs/node/pull/59983
crypto:
  * update root certificates to NSS 3.119 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/61419
  * update root certificates to NSS 3.117 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/60741

PR-URL: https://github.com/nodejs/node/pull/62088
 2026-03-05 15:00:41 +01:00
Node.js GitHub Bot 3b9fe896c3 2026-03-03, Version 25.8.0 (Current) 
Notable changes:

build, doc:
  * use new api doc tooling (flakey5) https://github.com/nodejs/node/pull/57343
sqlite:
  * (SEMVER-MINOR) add limits property to DatabaseSync (Mert Can Altin) https://github.com/nodejs/node/pull/61298
src:
  * (SEMVER-MINOR) add C++ support for diagnostics channels (RafaelGSS) https://github.com/nodejs/node/pull/61869
src,permission:
  * (SEMVER-MINOR) add --permission-audit (RafaelGSS) https://github.com/nodejs/node/pull/61869
test_runner:
  * (SEMVER-MINOR) expose worker ID for concurrent test execution (Ali Hassan) https://github.com/nodejs/node/pull/61394

PR-URL: https://github.com/nodejs/node/pull/62073
 2026-03-03 15:50:38 +00:00
Antoine du Hamel 7427866935 2026-02-24, Version 25.7.0 (Current) 
Notable changes:

http2:
  * (SEMVER-MINOR) add http1Options for HTTP/1 fallback configuration (Amol Yadav) https://github.com/nodejs/node/pull/61713
sea:
  * (SEMVER-MINOR) support ESM entry point in SEA (Joyee Cheung) https://github.com/nodejs/node/pull/61813
sqlite:
  * mark as release candidate (Matteo Collina) https://github.com/nodejs/node/pull/61262
stream:
  * (SEMVER-MINOR) rename `Duplex.toWeb()` type option to `readableType` (René) https://github.com/nodejs/node/pull/61632
test_runner:
  * (SEMVER-MINOR) show interrupted test on SIGINT (Matteo Collina) https://github.com/nodejs/node/pull/61676

PR-URL: https://github.com/nodejs/node/pull/61922
 2026-02-24 10:24:26 -05:00
Antoine du Hamel 001d5d4b77 2026-02-24, Version 24.14.0 'Krypton' (LTS) 
Notable changes:

async_hooks:
  * (SEMVER-MINOR) add `trackPromises` option to `createHook()` (Joyee Cheung) https://github.com/nodejs/node/pull/61415
build,deps:
  * replace cjs-module-lexer with merve (Yagiz Nizipli) https://github.com/nodejs/node/pull/61456
deps:
  * (SEMVER-MINOR) add LIEF as a dependency (Joyee Cheung) https://github.com/nodejs/node/pull/61167
events:
  * (SEMVER-MINOR) repurpose `events.listenerCount()` to accept `EventTarget`s (René) https://github.com/nodejs/node/pull/60214
fs:
  * (SEMVER-MINOR) add `ignore` option to `fs.watch` (Matteo Collina) https://github.com/nodejs/node/pull/61433
http:
  * (SEMVER-MINOR) add `http.setGlobalProxyFromEnv()` (Joyee Cheung) https://github.com/nodejs/node/pull/60953
module:
  * (SEMVER-MINOR) allow subpath imports that start with `#/` (Jan Martin) https://github.com/nodejs/node/pull/60864
process:
  * (SEMVER-MINOR) preserve `AsyncLocalStorage` in `queueMicrotask` only when needed (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/60913
sea:
  * (SEMVER-MINOR) split sea binary manipulation code (Joyee Cheung) https://github.com/nodejs/node/pull/61167
sqlite:
  * (SEMVER-MINOR) enable defensive mode by default (Bart Louwers) https://github.com/nodejs/node/pull/61266
  * (SEMVER-MINOR) add sqlite prepare options args (Guilherme Araújo) https://github.com/nodejs/node/pull/61311
src:
  * (SEMVER-MINOR) add initial support for ESM in embedder API (Joyee Cheung) https://github.com/nodejs/node/pull/61548
stream:
  * (SEMVER-MINOR) add `bytes()` method to `node:stream/consumers` (wantaek) https://github.com/nodejs/node/pull/60426
  * (SEMVER-MINOR) do not pass `readable.compose()` output via `Readable.from()` (René) https://github.com/nodejs/node/pull/60907
test:
  * (SEMVER-MINOR) use fixture directories for sea tests (Joyee Cheung) https://github.com/nodejs/node/pull/61167
test_runner:
  * (SEMVER-MINOR) add `env` option to `run` function (Ethan Arrowood) https://github.com/nodejs/node/pull/61367
  * (SEMVER-MINOR) support expecting a test-case to fail (Jacob Smith) https://github.com/nodejs/node/pull/60669
util:
  * (SEMVER-MINOR) add `convertProcessSignalToExitCode` utility (Erick Wendel) https://github.com/nodejs/node/pull/60963

PR-URL: https://github.com/nodejs/node/pull/61924
 2026-02-24 10:20:06 -05:00
Antoine du Hamel 44289fdd0e 2026-02-10, Version 25.6.1 (Current) 
Notable changes:

build,deps:
  * replace `cjs-module-lexer` with `merve` (Yagiz Nizipli) https://github.com/nodejs/node/pull/61456

PR-URL: https://github.com/nodejs/node/pull/61739
 2026-02-10 14:16:58 +01:00
Antoine du Hamel beb7fd9d10 2026-02-10, Version 24.13.1 'Krypton' (LTS) 
Notable changes:

build:
  * add support for Python 3.14 (Christian Clauss) https://github.com/nodejs/node/pull/59983
cli:
  * mark `--heapsnapshot-near-heap-limit` as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60956
crypto:
  * update root certificates to NSS 3.119 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/61419
doc:
  * mark `--build-snapshot` and `--build-snapshot-config` as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60954
meta:
  * add avivkeller to collaborators (Aviv Keller) https://github.com/nodejs/node/pull/61115
  * add gurgunday to collaborators (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/61094
  * add Renegade334 to collaborators (Renegade334) https://github.com/nodejs/node/pull/60714
url:
  * update ada to v3.4.2 and support unicode 17 (Yagiz Nizipli) https://github.com/nodejs/node/pull/61593
v8:
  * mark `v8.queryObjects()` as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60957

PR-URL: https://github.com/nodejs/node/pull/61661
 2026-02-10 14:16:51 +01:00
Antoine du Hamel 1818bb7e81 2026-02-03, Version 25.6.0 (Current) 
Notable changes:

async_hooks:
  * (SEMVER-MINOR) add `trackPromises` option to `createHook()` (Joyee Cheung) https://github.com/nodejs/node/pull/61415
net:
  * (SEMVER-MINOR) add `setTOS` and `getTOS` to `Socket` (Amol Yadav) https://github.com/nodejs/node/pull/61503
src:
  * (SEMVER-MINOR) add initial support for ESM in embedder API (Joyee Cheung) https://github.com/nodejs/node/pull/61548
  * improve `TextEncoder` encode performance with `simdutf` (Mert Can Altin) https://github.com/nodejs/node/pull/61496
stream:
  * (SEMVER-MINOR) add `bytes()` method to `node:stream/consumers` (wantaek) https://github.com/nodejs/node/pull/60426
test_runner:
  * (SEMVER-MINOR) add `env` option to `run` function (Ethan Arrowood) https://github.com/nodejs/node/pull/61367
url:
  * update Ada to v3.4.2 and support Unicode 17 (Yagiz Nizipli) https://github.com/nodejs/node/pull/61593

PR-URL: https://github.com/nodejs/node/pull/61635
 2026-02-03 12:37:44 +01:00
Antoine du Hamel 6beb65e00e 2026-01-26, Version 25.5.0 (Current) 
Notable changes:

crypto:
  * update root certificates to NSS 3.119 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/61419
deps:
  * (SEMVER-MINOR) add LIEF as a dependency (Joyee Cheung) https://github.com/nodejs/node/pull/61167
  * (SEMVER-MINOR) add tools and scripts to pull LIEF as a dependency (Joyee Cheung) https://github.com/nodejs/node/pull/61167
fs:
  * (SEMVER-MINOR) add ignore option to fs.watch (Matteo Collina) https://github.com/nodejs/node/pull/61433
sea:
  * (SEMVER-MINOR) add `--build-sea` to generate SEA directly with Node.js binary (Joyee Cheung) https://github.com/nodejs/node/pull/61167
  * (SEMVER-MINOR) split sea binary manipulation code (Joyee Cheung) https://github.com/nodejs/node/pull/61167
sqlite:
  * (SEMVER-MINOR) enable defensive mode by default (Bart Louwers) https://github.com/nodejs/node/pull/61266
  * (SEMVER-MINOR) add sqlite prepare options args (Guilherme Araújo) https://github.com/nodejs/node/pull/61311
src:
  * use node- prefix on thread names (Stewart X Addison) https://github.com/nodejs/node/pull/61307
test:
  * (SEMVER-MINOR) migrate to `--build-sea` in existing SEA tests (Joyee Cheung) https://github.com/nodejs/node/pull/61167
  * (SEMVER-MINOR) use fixture directories for sea tests (Joyee Cheung) https://github.com/nodejs/node/pull/61167
test_runner:
  * (SEMVER-MINOR) support expecting a test-case to fail (Jacob Smith) https://github.com/nodejs/node/pull/60669

PR-URL: https://github.com/nodejs/node/pull/61519
 2026-01-26 21:30:03 +01:00
Node.js GitHub Bot 973e119d22 2026-01-19, Version 25.4.0 (Current) 
Notable changes:

cli:
  * add --require-module/--no-require-module (Joyee Cheung) https://github.com/nodejs/node/pull/60959
  * mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60956
crypto:
  * update root certificates to NSS 3.117 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/60741
doc:
  * add @avivkeller to collaborators (Aviv Keller) https://github.com/nodejs/node/pull/61115
  * add gurgunday to collaborators (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/61094
  * mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60954
events:
  * (SEMVER-MINOR) repurpose `events.listenerCount()` to accept EventTargets (René) https://github.com/nodejs/node/pull/60214
http:
  * (SEMVER-MINOR) add http.setGlobalProxyFromEnv() (Joyee Cheung) https://github.com/nodejs/node/pull/60953
meta:
  * add Renegade334 to collaborators (Renegade334) https://github.com/nodejs/node/pull/60714
module:
  * mark require(esm) as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60959
  * mark module compile cache as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60971
  * (SEMVER-MINOR) allow subpath imports that start with `#/` (Jan Martin) https://github.com/nodejs/node/pull/60864
process:
  * (SEMVER-MINOR) preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/60913
stream:
  * (SEMVER-MINOR) do not pass `readable.compose()` output via `Readable.from()` (René) https://github.com/nodejs/node/pull/60907
util:
  * (SEMVER-MINOR) add convertProcessSignalToExitCode utility (Erick Wendel) https://github.com/nodejs/node/pull/60963
v8:
  * mark v8.queryObjects() as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60957

PR-URL: https://github.com/nodejs/node/pull/61400
 2026-01-19 14:00:39 -03:00
Marco Ippolito b1ac7e49a4 doc: fix v25 changelog after security release 
PR-URL: https://github.com/nodejs/node/pull/61371
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2026-01-14 10:39:26 +00:00
Marco Ippolito d4cc54b8c8 doc: fix v24 changelog after security release 
PR-URL: https://github.com/nodejs/node/pull/61371
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2026-01-14 10:39:25 +00:00
Marco Ippolito 659fd01b3e doc: fix v22 changelog after security release 
PR-URL: https://github.com/nodejs/node/pull/61371
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2026-01-14 10:39:24 +00:00
Marco Ippolito 6c96a63891 doc: fix v20 changelog after security release 
PR-URL: https://github.com/nodejs/node/pull/61371
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2026-01-14 10:39:24 +00:00
RafaelGSS 6ea77ad552 2026-01-13, Version 25.3.0 (Current) 
This is a security release.

Notable changes:

lib:
  * (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750
permission:
  * (CVE-2026-21636) add network check on pipe_wrap connect (RafaelGSS) https://github.com/nodejs-private/node-private/pull/784
  * (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
  * (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748
src:
  * (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:
  * (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:
  * (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/790

PR-URL: https://github.com/nodejs-private/node-private/pull/793
 2026-01-13 14:45:46 +01:00
Marco Ippolito 64022d9fcc 2026-01-13, Version 24.13.0 'Krypton' (LTS) 
This is a security release.

Notable changes:

lib:
  * (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/797>
  * (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/748>
lib,permission:
  * (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) <https://github.com/nodejs-private/node-private/pull/760>
src:
  * (CVE-2025-59466) rethrow stack overflow exceptions in async\_hooks (Matteo Collina) <https://github.com/nodejs-private/node-private/pull/773>
src,lib:
  * (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) <https://github.com/nodejs-private/node-private/pull/759>
tls:
  * (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) <https://github.com/nodejs-private/node-private/pull/796>

PR-URL: https://github.com/nodejs-private/node-private/pull/800
 2026-01-13 14:42:29 +01:00
Marco Ippolito 1f49cd1d86 2026-01-13, Version 22.22.0 'Jod' (LTS) 
This is a security release.

Notable changes:

lib:
  * (CVE-2025-59465) add TLSSocket default error handler
  * (CVE-2025-55132) disable futimes when permission model is enabled
lib,permission:
  * (CVE-2025-55130) require full read and write to symlink APIs
src:
  * (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks
src,lib:
  * (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle
tls:
  * (CVE-2026-21637) route callback exceptions through error handlers

PR-URL: https://github.com/nodejs-private/node-private/pull/801
 2026-01-13 14:41:59 +01:00
Marco Ippolito 4443a11bef 2026-01-13, Version 20.20.0 'Iron' (LTS) 
This is a security release.

Notable changes:

lib:
  * (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/802
  * (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/797
lib,permission:
  * (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
src:
  * (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:
  * (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/799
tls:
  * (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/796

PR-URL: https://github.com/nodejs-private/node-private/pull/804
 2026-01-13 14:41:08 +01:00
Node.js GitHub Bot 47d8b88868 2025-12-10, Version 24.12.0 'Krypton' (LTS) 
Notable changes:

http:
  * (SEMVER-MINOR) add optimizeEmptyRequests server option (Rafael Gonzaga) https://github.com/nodejs/node/pull/59778
lib:
  * (SEMVER-MINOR) add options to util.deprecate (Rafael Gonzaga) https://github.com/nodejs/node/pull/59982
module:
  * (SEMVER-MINOR) mark type stripping as stable (Marco Ippolito) https://github.com/nodejs/node/pull/60600
node-api:
  * (SEMVER-MINOR) add napi_create_object_with_properties (Miguel Marcondes Filho) https://github.com/nodejs/node/pull/59953
sqlite:
  * (SEMVER-MINOR) allow setting defensive flag (Bart Louwers) https://github.com/nodejs/node/pull/60217
src:
  * (SEMVER-MINOR) add watch config namespace (Marco Ippolito) https://github.com/nodejs/node/pull/60178
  * (SEMVER-MINOR) add an option to make compile cache portable (Aditi) https://github.com/nodejs/node/pull/58797
src,permission:
  * (SEMVER-MINOR) add --allow-inspector ability (Rafael Gonzaga) https://github.com/nodejs/node/pull/59711
v8:
  * (SEMVER-MINOR) add cpu profile (theanarkh) https://github.com/nodejs/node/pull/59807

PR-URL: https://github.com/nodejs/node/pull/61001
 2025-12-10 17:40:34 +01:00
Rich Trott 01d5a38a60 doc: fix typos in changelogs 
I know we can't fix the parts that are commit messages, but I believe
the rest of the text is editable. Am I misremembering?

PR-URL: https://github.com/nodejs/node/pull/60855
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2025-11-28 04:24:42 +00:00
Marco Ippolito ae62b36d44 2025-11-25, Version 20.19.6 'Iron' (LTS) 
Notable changes:

crypto:
  * update root certificates to NSS 3.114 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/59571
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) https://github.com/nodejs/node/pull/59113
  * deprecate HTTP/2 priority signaling (Matteo Collina) https://github.com/nodejs/node/pull/58313

PR-URL: https://github.com/nodejs/node/pull/60784
 2025-11-25 13:25:23 +01:00
Node.js GitHub Bot 420b6277bd 2025-11-17, Version 25.2.1 (Current) 
Notable changes:

PR-URL: https://github.com/nodejs/node/pull/60752
 2025-11-17 10:36:42 +01:00