`stream.isDestroyed()` has been exported since v19.9.0 but was never
documented, while its siblings `isErrored()`, `isReadable()` and
`isWritable()` all have entries in `doc/api/stream.md`.
Unlike those, `isDestroyed()` rejects Web streams: it returns `null`
for anything that is not a Node.js stream. The accepted types are
therefore documented as `Readable|Writable|Duplex` rather than also
listing `ReadableStream`/`WritableStream`.
Refs: https://github.com/nodejs/node/pull/45671
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: YspritanHyzygy <yspritan@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64789
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Promote DEP0195 from documentation-only to a runtime deprecation.
Calling node:http constructors without `new` now emits DEP0195 via
deprecateInstantiation. This covers Agent, Server, OutgoingMessage,
IncomingMessage, ServerResponse, and ClientRequest.
Update in-tree tests that called Server/Agent without `new` to use
the keyword, and add a dedicated DEP0195 coverage test.
Refs: https://github.com/nodejs/node/pull/58518
Assisted-by: Grok
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: https://github.com/nodejs/node/pull/64853
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Add ZIP archive support to the node:zlib module through three classes
and a set of helpers:
- ZipEntry: a single archive member, with buffered reads (content()),
bounded-memory streaming reads (contentIterator()), and
create()/createStream() for building members.
- ZipFile: random access to an archive backed by a file descriptor,
reading members lazily without retaining their content and writing
new members in place; opened with open()/openSync().
- ZipBuffer: a zero-copy, in-memory view over an archive already held
in a Buffer.
createZipArchive() serializes a sequence of entries into an archive
byte stream, and setMaxZipContentSize() bounds the default in-memory
decompression size. Every operation has both an asynchronous and a
synchronous form.
Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: https://github.com/nodejs/node/pull/64339
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Expand the documentation for the --permission-audit flag, which was
fixed in 51c09eae6c to no longer throw ERR_ACCESS_DENIED on denied
operations. The previous docs only had a two-sentence description in
cli.md and no mention in the permissions guide or process.permission
API docs.
- permissions.md: add enforce vs audit mode overview, a new
"Audit Mode" subsection listing the diagnostics channel names
(node:permission-model:*) and the { permission, resource } message
shape, and a usage example. Update the Runtime API section to
mention both --permission and --permission-audit.
- cli.md: expand the --permission-audit section to clarify that
--permission is not required, --allow-* flags are not needed,
errors are not thrown, and --permission takes precedence when both
are set. Add a cross-reference from --permission to
--permission-audit.
- process.md: note that process.permission is available under both
flags, and clarify permission.has() and permission.drop() behavior
in audit mode.
- node.1: regenerated via `make node.1`.
Refs: https://github.com/nodejs/node/pull/64426
Signed-off-by: Adrian Estrada <edsadr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64791
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
The peer certificate is not verified again when a connection resumes a
TLS session. When the original handshake included a client certificate,
authorized and authorizationError carry the verification result stored
with the session; on TLS 1.3, a client that sent no certificate can
resume a session and report authorized as true. Document this and point
manual-authorization servers at isSessionReused() and
getPeerCertificate().
Fixes: https://github.com/nodejs/node/issues/35317
Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64584
Reviewed-By: Tim Perry <pimterry@gmail.com>
IncomingMessage 'close' is emitted when request handling completes, not
only when the underlying connection is closed. Using that event to abort
IncomingMessage.signal makes the signal abort after a request body is
read normally.
Track the underlying socket close instead, and detach the listener when
the request or response completes normally. This keeps the signal from
being aborted by normal stream completion or later keep-alive socket
closure, while still aborting it when the connection closes during the
active request lifecycle.
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64392
Fixes: https://github.com/nodejs/node/issues/64390
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Add an experimental `net/promises` namespace, accessible via
`require('node:net/promises')` or `net.promises`, mirroring the existing
`fs/promises` and `dns/promises` modules.
It provides promise-based variants of net's one-shot lifecycle
operations:
- `connect()` returns a promise that fulfills with a connected Socket
once the 'connect' event fires, and rejects on connection failure or
when an optional AbortSignal is aborted, destroying the socket.
- `listen()` creates a server, begins listening, and returns a promise
that fulfills with the listening Server once the 'listening' event
fires. It rejects if the server fails to bind or an optional
AbortSignal is aborted, closing the server.
The functions are named for the actions they await, forming a parallel
`connect()`/`listen()` pair. This is intentionally not the callback
API's factory taxonomy: there `createConnection()` is canonical because
it both creates a socket and initiates connecting, whereas
`createServer()` is a pure factory that does not listen. A
`createConnection`/`createServer` pairing would be inconsistent here
because `createServer` has no completion to await, so no
`createConnection` alias is provided.
Refs: https://github.com/nodejs/node/issues/21482
Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: https://github.com/nodejs/node/pull/63965
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
dns.reverse() is documented with dns.resolve*() as always performing DNS
queries without using hosts file configuration. However, c-ares
ares_gethostbyaddr() honors the channel lookup order, which can include
the files source and cause reverse lookups to return entries from
/etc/hosts.
Configure c-ares resolver channels with ARES_OPT_LOOKUPS set to "b" so
getHostByAddr uses DNS/PTR lookups only. This keeps dns.reverse()
aligned with dns.resolve*() and preserves the distinction from
system-resolution APIs such as dns.lookup() and dns.lookupService().
This is preferable to documenting the current behavior because hosts-
file reverse lookup results are platform-dependent and expose hostent
alias semantics rather than DNS PTR record semantics.
Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64268
Fixes: https://github.com/nodejs/node/issues/64257
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This ensures we don't fire session events for totally invalid TLS
handshakes - fundamental errors, bad SNI/ALPN values, or anything else
that our TLS config would reject. Instead, it means servers can access
servername & alpnProtocol synchronously as soon as the event is fired -
all key session data is available and it's immediately usable.
We don't want to defer further to handshake completed, since that'd be
an extra RT, and defeat 0RTT benefits entirely. ClientHello processed
without errors is sufficient for now.
This isn't a security mechanism. Existing structures will defer
actually sending & receiving anything that's not marked explicitly as
early data until the handshake completes anyway.
Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/64132
Reviewed-By: James M Snell <jasnell@gmail.com>
The import.meta example for new vm.SourceTextModule() in vm.md does not
run as written. It fails in two separate ways.
First, the constructor is missing the context: contextifiedObject
option, so the module evaluates in the top context where secret is not
defined, and the snippet throws ReferenceError: secret is not defined.
Second, the trailing note suggests replacing meta.prop = {} with
vm.runInContext('{}', contextifiedObject), but '{}' is parsed as an
empty block and evaluates to undefined. That makes the following
Object.getPrototypeOf(import.meta.prop) throw TypeError. Wrapping it as
'({})' returns an object, which is what the note intends.
This adds the context option and corrects the suggested replacement to
'({})' in both the mjs and cjs variants.
Fixes: https://github.com/nodejs/node/issues/64076
Signed-off-by: Muhammad Zeeshan <61280174+zeeshan56656@users.noreply.github.com>
PR-URL: https://github.com/nodejs/node/pull/64112
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Soul Lee