BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
44,821 Commits 266 Branches 972 Tags
v22.22.2
Commit Graph
44821 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Antoine du Hamel 2645dc7372 2026-03-24, Version 22.22.2 'Jod' (LTS) 
This is a security release.

Notable changes:

build,test,deps:
  * (CVE-2026-21717) test array index hash collision
crypto:
  * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC
http:
  * (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
  * (CVE-2026-21716) include permission check on lib/fs/promises
  * (CVE-2026-21715) add permission check to realpath.native
src:
  * (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
tls:
  * (CVE-2026-21637) wrap SNICallback invocation in try/catch

PR-URL: https://github.com/nodejs-private/node-private/pull/844
v22.22.2 		2026-03-23 20:13:40 +01:00
Joyee Cheung 30a3ab11e2 deps: V8: cherry-pick aac14dd95e5b 
Original commit message:

    [string] add 3rd round to seeded array index hash

    Since we already have 3 derived secrets, and arithmetics are
    relatively cheap, add a 3rd round to the xorshift-multiply
    seeding scheme. This brings the bias from ~3.4 to ~0.4.

    Bug: 477515021
    Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117
    Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105824}

Refs: https://github.com/v8/v8/commit/aac14dd95e5be0d487eba6bcdaf9cef4f8bd806c
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-23 20:06:35 +01:00
Joyee Cheung 6f14ee5101 build,test: test array index hash collision 
This enables v8_enable_seeded_array_index_hash and add a test for it.

Fixes: https://hackerone.com/reports/3511792
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-23 20:06:35 +01:00
Joyee CheungandJoyee Cheung e3f4d6a42e deps: V8: backport 1361b2a49d02 
Original commit message:

    [strings] improve array index hash distribution

    Previously, the hashes stored in a Name's raw_hash_field for decimal
    numeric strings (potential array indices) consist of the literal
    integer value along with the length of the string. This means
    consecutive numeric strings can have consecutive hash values, which
    can lead to O(n^2) probing for insertion in the worst case when e.g.
    a non-numeric string happen to land in the these buckets.

    This patch adds a build-time flag v8_enable_seeded_array_index_hash that
    scrambles the 24-bit array-index value stored in a Name's raw_hash_field
    to improve the distribution.

    x ^= x >> kShift; x = (x * m1) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m2) & kMask;    // round 2
    x ^= x >> kShift;                          // finalize

    To decode, apply the same steps with the modular inverses of m1 and m2
    in reverse order.

    x ^= x >> kShift; x = (x * m2_inv) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m1_inv) & kMask;    // round 2
    x ^= x >> kShift;                              // finalize

    where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask,
    m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv,
    m2_inv (modular inverses) are precomputed modular inverse of m1 and m2.
    The pre-computed values are appended to the hash_seed ByteArray in
    ReadOnlyRoots and accessed in generated code to reduce overhead.
    In call sites that don't already have access to the seeds, we read them
    from the current isolate group/isolate's read only roots.

    To consolidate the code that encode/decode these hashes, this patch
    adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA
    that perform seeding/unseeding if enabled, and updates places where
    encoding/decoding of array index is needed to use them.

    Bug: 477515021
    Change-Id: I350afe511951a54c4378396538152cc56565fd55
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105596}

Refs: https://github.com/v8/v8/commit/1361b2a49d020a718dc5495713eae0fa67d697b9
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-22 17:04:57 +01:00
Joyee CheungandJoyee Cheung 7dc00fa5f4 deps: V8: backport 185f0fe09b72 
Original commit message:

    [numbers] Refactor HashSeed as a lightweight view over ByteArray

    Instead of copying the seed and secrets into a struct with value
    fields, HashSeed now stores a pointer pointing either into the
    read-only ByteArray, or the static default seed for off-heap
    HashSeed::Default() calls. The underlying storage is always
    8-byte aligned so we can cast it directly into a struct.

    Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105531}

Refs: https://github.com/v8/v8/commit/185f0fe09b72fb869fdcf9a89f40ff2295436bca
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-22 17:04:56 +01:00
snekandJoyee Cheung 076acd052d deps: V8: backport 0a8b1cdcc8b2 
Original commit message:

    implement rapidhash secret generation

    Bug: 409717082
    Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: snek <snek@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#101499}

Refs: https://github.com/v8/v8/commit/0a8b1cdcc8b243c62cf045fa8beb50600e11758a
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/833
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/809
CVE-ID: CVE-2026-21717
 2026-03-22 17:04:56 +01:00
RafaelGSS 06fc3436f6 permission: include permission check on lib/fs/promises 
PR-URL: https://github.com/nodejs-private/node-private/pull/795
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-21716
 2026-03-22 17:04:56 +01:00
RafaelGSS db48d9c675 permission: add permission check to realpath.native 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/794
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-21715
 2026-03-22 17:04:56 +01:00
RafaelGSS 2a6105a63b src: handle NGHTTP2_ERR_FLOW_CONTROL error code 
Refs: https://hackerone.com/reports/3531737
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/832
CVE-ID: CVE-2026-21714
 2026-03-22 17:04:56 +01:00
Filip Skokan 52a52ef619 crypto: use timing-safe comparison in Web Cryptography HMAC 
Use `CRYPTO_memcmp` instead of `memcmp` in `HMAC`
Web Cryptography algorithm implementations.

Ref: https://hackerone.com/reports/3533945
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/830
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/822
CVE-ID: CVE-2026-21713
 2026-03-22 17:04:56 +01:00
Matteo Collina 91b970886f tls: wrap SNICallback invocation in try/catch 
Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().

Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.

Fixes: https://hackerone.com/reports/3556769
Refs: https://hackerone.com/reports/3473882
CVE-ID: CVE-2026-21637

PR-URL: https://github.com/nodejs-private/node-private/pull/819
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21637
 2026-03-22 17:04:52 +01:00
Matteo Collina a2fe9fd81a http: use null prototype for headersDistinct/trailersDistinct 
Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.

A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.

Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710
 2026-03-22 16:28:36 +01:00
Richard Lau 963c60a951 deps: V8: override depot_tools version 
For compatibility with Python >= 3.12 we need a newer version of
`depot_tools` than is used for the older versions of V8.

PR-URL: https://github.com/nodejs/node/pull/62344
Refs: https://github.com/nodejs/build/pull/4278
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-03-22 13:05:19 +01:00
npm CLI robot a688117d5d deps: upgrade npm to 10.9.7 
PR-URL: https://github.com/nodejs/node/pull/62330
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-03-20 18:27:07 +01:00
Matteo Collina 859c8c761b deps: update undici to v6.24.1 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/62285
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-03-18 13:22:28 +01:00
npm CLI robot d5ed384a2f deps: upgrade npm to 10.9.6 
PR-URL: https://github.com/nodejs/node/pull/62215
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
 2026-03-16 20:46:59 +01:00
Dario PiotrowiczAntoine du HamelMichaël Zasso
 		73deff77c1 lib: backport _tls_common and _tls_wrap refactors 
This is the same as the original change, minus the `process.emitWarning`
calls and unit tests that expect the deprecation warnings.

Original commit message:
    lib: deprecate _tls_common and _tls_wrap

    runtime deprecate the _tls_common and _tls_wrap
    modules, users should use nust node:tls insteal
    and internally internal/tls/commond and
    internal/tls/wrap should be used instead

PR-URL: https://github.com/nodejs/node/pull/57643
Backport-PR-URL: https://github.com/nodejs/node/pull/62231
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
 2026-03-16 17:29:52 +01:00
Marco Ippolito bb73c10b32 Working on v22.22.2 
PR-URL: https://github.com/nodejs/node/pull/61947
 2026-03-05 15:08:44 +01:00
Antoine du Hamel b4acf0c939 2026-03-05, Version 22.22.1 'Jod' (LTS) 
build:
  * test on Python 3.14 (Christian Clauss) https://github.com/nodejs/node/pull/59983
cli:
  * mark `--heapsnapshot-near-heap-limit` as stable (Joyee Cheung) https://github.com/nodejs/node/pull/60956
crypto:
  * update root certificates to NSS 3.119 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/61419
  * update root certificates to NSS 3.117 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/60741
doc:
  * add avivkeller to collaborators (Aviv Keller) https://github.com/nodejs/node/pull/61115
  * add gurgunday to collaborators (Gürgün Dayıoğlu) https://github.com/nodejs/node/pull/61094
meta:
  * add Renegade334 to collaborators (Renegade334) https://github.com/nodejs/node/pull/60714

PR-URL: https://github.com/nodejs/node/pull/61947
v22.22.1 		2026-03-04 10:24:57 +01:00
Node.js GitHub Bot bfc2b55c5a deps: update minimatch to 10.2.4 
PR-URL: https://github.com/nodejs/node/pull/62016
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-03-04 10:19:21 +01:00
Node.js GitHub Bot 7d318a0ba8 deps: update minimatch to 10.2.2 
PR-URL: https://github.com/nodejs/node/pull/61830
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-03-04 10:19:11 +01:00
Node.js GitHub Bot 87351a42b5 deps: update minimatch to 10.1.2 
PR-URL: https://github.com/nodejs/node/pull/61732
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
 2026-03-04 10:18:52 +01:00
Richard Lau 46d12d826f test: skip strace test with shared openssl 
`parallel/test-strace-openat-openssl` was added to check explicitly
for a list of known files that would be opened for a set workload
(`require("crypto")`). This is not reliable when Node.js is linked
to an external/shared OpenSSL library (e.g. it might be configured
to load configuration files from a different default location and/or
load more than one configuration file) so skip this test when Node.js
is built in that way.

PR-URL: https://github.com/nodejs/node/pull/61987
Fixes: https://github.com/nodejs/node/issues/61966
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-02-28 12:17:18 +01:00
Vivian Wangandkxxt 0781bd3764 deps: V8: backport 6a0a25abaed3 
Original commit message:

    [riscv] Fix sp handling in MacroAssembler::LeaveFrame

    Keep sp <= fp to ensure that data right above fp doesn't get clobbered
    by an inopportune signal and its handler.

    Such clobbering can happen in e.g. Node.js when JIT-compiled code is
    interrupted by a SIGCHLD handler.

    Bug: None
    Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
    Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
    Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
    Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105069}

Refs: https://github.com/v8/v8/commit/6a0a25abaed397f83eb0d92e4b33a5e18204f8bc
Co-authored-by: kxxt <rsworktech@outlook.com>
PR-URL: https://github.com/nodejs/node/pull/61688
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-02-24 08:39:04 +01:00
Rebroad 35a12fb996 src: replace ranges::sort for libc++13 compatibility on armhf 
PR-URL: https://github.com/nodejs/node/pull/61789
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:04 +01:00
Mike McCready 642f518198 doc: supported toolchain with Visual Studio 2022 only 
PR-URL: https://github.com/nodejs/node/pull/61451
Refs: https://github.com/nodejs/node/issues/60869
Refs: https://github.com/nodejs/node/issues/61449
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
 2026-02-24 08:39:04 +01:00
Antoine du Hamel 52e6b01a44 test: mark test-strace-openat-openssl as flaky 
PR-URL: https://github.com/nodejs/node/pull/61921
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-02-24 08:39:03 +01:00
Antoine du Hamel a253b7b6dc tools: switch to ARM runners on GHA jobs 
PR-URL: https://github.com/nodejs/node/pull/61903
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-02-24 08:39:03 +01:00
Antoine du Hamel 8862c41494 tools: avoid building twice in coverage jobs 
PR-URL: https://github.com/nodejs/node/pull/61899
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:03 +01:00
Antoine du Hamel 7d11a22802 tools: use ubuntu-slim runner in GHA 
PR-URL: https://github.com/nodejs/node/pull/61759
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:03 +01:00
Antoine du Hamel d0e7d6cb89 tools: use ubuntu-slim runner in GHA 
PR-URL: https://github.com/nodejs/node/pull/61734
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-02-24 08:39:03 +01:00
Antoine du Hamel cf5ddd1811 tools: use ubuntu-latest runner in notify-on-push workflow 
PR-URL: https://github.com/nodejs/node/pull/61742
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-02-24 08:39:03 +01:00
Tierney Cyren 18bcf8e260 tools: use ubuntu-slim runner in meta GitHub Actions 
Signed-off-by: Tierney Cyren <hello@bnb.im>
PR-URL: https://github.com/nodejs/node/pull/61663
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-02-24 08:39:02 +01:00
Joyee Cheung f6fad231e9 build: skip sscache action on non-main branches 
To reduce cache thrashing.

PR-URL: https://github.com/nodejs/node/pull/61790
Refs: https://github.com/nodejs/node/issues/61436
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-02-24 08:39:02 +01:00
Node.js GitHub Bot db76733b55 tools: update gyp-next to 0.21.1 
PR-URL: https://github.com/nodejs/node/pull/61528
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:02 +01:00
Joyee Cheung 4d7468d0e0 test: skip --build-sea tests on platforms where SEA is flaky 
They were missing from the skip pattern due to different naming.

PR-URL: https://github.com/nodejs/node/pull/61504
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:02 +01:00
Ryuhei Shima f604b7ae67 test: fix flaky debugger test 
PR-URL: https://github.com/nodejs/node/pull/58324
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
 2026-02-24 08:39:02 +01:00
sangwook fc2dc4024b test: ensure removeListener event fires for once() listeners 
Adds test coverage for the removeListener event being emitted
when a once() listener is automatically removed after execution.
This verifies that streams and other EventEmitters correctly
emit removeListener events when once() wrappers clean up.

PR-URL: https://github.com/nodejs/node/pull/60137
Fixes: https://github.com/nodejs/node/issues/59977
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
 2026-02-24 08:39:02 +01:00
Luigi Pinca 5fba382816 test: delay writing the files only on macOS 
Refs: https://github.com/nodejs/node/pull/60060
PR-URL: https://github.com/nodejs/node/pull/61532
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
 2026-02-24 08:39:02 +01:00
Rafael Gonzaga 625f674487 doc: move Security-Team from TSC to SECURITY 
PR-URL: https://github.com/nodejs/node/pull/61495
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2026-02-24 08:39:01 +01:00
ikeyanandLuigi Pinca 029e32f8ba doc: added requestOCSP option to tls.connect 
Fixes #61042

Put a period at the end of the line

Co-authored-by: Luigi Pinca <luigipinca@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61064
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:01 +01:00
Nikita Skovoroda 68e33dfa89 doc: restore @ChALkeR to collaborators 
PR-URL: https://github.com/nodejs/node/pull/61553
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-02-24 08:39:01 +01:00
Beth Griggs e016770d62 doc: update IBM/Red Hat volunteers with dedicated project time 
Update the README to reflect current IBM and Red Hat volunteers
who have dedicated time allocated to the project.

Signed-off-by: Beth Griggs <bethanyngriggs@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61588
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:01 +01:00
Hamza Kargin ec63954657 doc: mention constructor comparison in assert.deepStrictEqual 
PR-URL: https://github.com/nodejs/node/pull/60253
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
 2026-02-24 08:39:01 +01:00
Antoine du Hamel 6f39ad190b meta: do not fast-track npm updates 
PR-URL: https://github.com/nodejs/node/pull/61475
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
 2026-02-24 08:39:01 +01:00
Guilherme Araújo 096095b127 benchmark: add SQLite benchmarks 
PR-URL: https://github.com/nodejs/node/pull/61401
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-02-24 08:39:00 +01:00
Rafael Gonzaga c8e1563a98 doc: add CVE delay mention 
PR-URL: https://github.com/nodejs/node/pull/61465
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2026-02-24 08:39:00 +01:00
Stewart X Addison 6689775023 gyp: aix: change gcc version detection so CXX="ccache g++" works 
Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/61464
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2026-02-24 08:39:00 +01:00
Max Harari 5c4f4db663 http: fix rawHeaders exceeding maxHeadersCount limit 
Fixes: https://github.com/nodejs/node/issues/61284
PR-URL: https://github.com/nodejs/node/pull/61285
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
 2026-02-24 08:39:00 +01:00
Rafael Gonzaga 4b00cf2b54 doc: include OpenJSF handle for security stewards 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/61454
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-02-24 08:39:00 +01:00