chore(deps): update node.js to v24#285
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughTwo 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #285 +/- ##
===========================
===========================
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
2 times, most recently
from
5f1f9fe to
580252b
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.nvmrc:
- Line 1: The Node.js version was bumped to 24.12.0 which is a major jump with
breaking changes; run the full test suite under Node 24, rebuild native modules
(npm rebuild / yarn rebuild), and verify package.json for native dependencies
(node-gyp, sqlite3, bcrypt, etc.), then test crypto/TLS paths and API
usage—search code for deprecated/removed APIs such as url.parse, SlowBuffer,
fs.truncate(fd), tls.createSecurePair and update to supported alternatives;
ensure any native addon is rebuilt and CI uses Node 24 before merging.
📜 Review details
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.nvmrcsrc/test/vscode-notebook-perf/.nvmrc
🔇 Additional comments (1)
src/test/vscode-notebook-perf/.nvmrc (1)
1-1: Consistent with root.nvmrc.Both files updated together—ensures test environment matches project runtime.
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
3 times, most recently
from
6709a85 to
fe87eca
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.nvmrc:
- Line 1: Replace the invalid Node version in .nvmrc from "24.13.0" to the
actual latest "24.12.0", then update package.json to ensure @types/node aligns
(change any pinned or careted node types version to ^22.15.1 if you want Node 24
compatibility) and edit CONTRIBUTING.md to replace any references to "22.15.1"
so all files (.nvmrc, package.json, CONTRIBUTING.md) consistently reference the
corrected versions; update the version strings exactly where they appear (look
for the literal "24.13.0" in .nvmrc, "@types/node" dependency entry in
package.json, and the node version mention in CONTRIBUTING.md).
📜 Review details
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.nvmrcsrc/test/vscode-notebook-perf/.nvmrc
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build & Test
🔇 Additional comments (1)
src/test/vscode-notebook-perf/.nvmrc (1)
1-1: Consistent with root.nvmrcupdate.Test environment matches the root configuration. Ensure this version is validated (see root
.nvmrcverification).
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
2 times, most recently
from
ccc075e to
a492c6c
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.nvmrc:
- Line 1: Update the `@types/node` versions to match Node.js 24: change the root
package.json dependency "@types/node" from "^22.15.1" to "^24.x" and update the
test package's "@types/node" from "^18.15.0" to "^24.x"; run npm install (or
yarn) and then rebuild/typecheck to ensure no type errors, and update any
lockfile (package-lock.json / yarn.lock) accordingly.
📜 Review details
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.nvmrcsrc/test/vscode-notebook-perf/.nvmrc
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Audit - Production
- GitHub Check: Build & Test
🔇 Additional comments (1)
src/test/vscode-notebook-perf/.nvmrc (1)
1-1: Consistent with root.nvmrc.Test fixture aligned correctly.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
from
a492c6c to
2537816
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@src/test/vscode-notebook-perf/.nvmrc`:
- Line 1: The .nvmrc bump to "24.13.0" requires validating the test environment:
switch to Node 24 (per .nvmrc), run a clean install (npm ci or yarn install
--frozen-lockfile), rebuild native modules (npm rebuild --update-binary or
rebuild node-gyp modules) and recompile any native addons, then run the full
test suite (npm test / yarn test) and CI pipeline to catch OpenSSL/V8-related
breakages; if tests fail due to weak keys or OpenSSL errors, update or
regenerate TLS keys/certs and adjust any native module build flags or dependency
versions accordingly.
♻️ Duplicate comments (1)
.nvmrc (1)
1-1: Past migration concerns still apply.The version bump is correct, but the breaking changes, native module rebuilds, and
@types/nodeversion mismatch flagged in earlier reviews remain unaddressed. Verify these before merging.
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
6 times, most recently
from
4ff660e to
fd507b7
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
6 times, most recently
from
4f95b23 to
12f9535
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.nvmrc:
- Line 1: Update TypeScript Node type definitions to match the Node version in
.nvmrc: bump the root package.json dependency "@types/node" from ^22.15.1 to a
^24.x range, and also update the test environment dependency in
src/test/vscode-notebook-perf/package.json from ^18.15.0 to a compatible ^24.x
version; run npm/yarn install and adjust any type-specific code or tsconfig
settings if type errors appear after upgrading.
12f9535 to
8d81d2d
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
6 times, most recently
from
fdb4432 to
989c2d6
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
6 times, most recently
from
dd3cbb5 to
1d75b96
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
5 times, most recently
from
1818781 to
89f586e
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
4 times, most recently
from
9a431c3 to
ad3a484
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
3 times, most recently
from
b01a5fb to
d68e1a6
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
2 times, most recently
from
0175bcc to
03ae6b2
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
2 times, most recently
from
8f75290 to
ed8cb6a
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
from
ed8cb6a to
b28f1c1
Compare
This PR contains the following updates:
22.21.1→24.16.0Release Notes
nodejs/node (node)
v24.16.0: 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b267f6bca3] - (SEMVER-MINOR) crypto: implementrandomUUIDv7()(nabeel378) #62553ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #627139705f628d9] - (SEMVER-MINOR) fs: add signal option tofs.stat()(Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: exposefrsizefield instatfs(Jinho Jang) #62277d7188af5c9] - (SEMVER-MINOR) http: hardenClientRequestoptions merge (Matteo Collina) #63082aa1d8a9afc] - (SEMVER-MINOR) http: addreq.signaltoIncomingMessage(Akshat) #625416f37f7e240] - (SEMVER-MINOR) stream: propagate destruction induplexPair(Ahmed Elhor) #61098d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #6282001a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support forAbortSignal.timeout(DeveloperViraj) #6075100705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556Commits
dd72df060d] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509add94f4bc3] - build: track PDL files as inputs in inspector GN build (Robo) #628881b1eb9e334] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #626678752b604ec] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902341947e7fd] - crypto: reject unintended raw key format string input (Filip Skokan) #6297428a78747fc] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #6286316e8c2b54d] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839eeae754a87] - crypto: reject inherited key type names (Jonathan Lopes) #628759dd5540325] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #625537597d204c1] - crypto: add support forEd25519context parameter (Filip Skokan) #624744bf85845da] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #6271383e98f77b7] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375ec8c6b939a] - deps: V8: cherry-pick657d8de(Guy Bedford) #62784722c0c3274] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #611875304db93d3] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046e073b3811d] - deps: update nghttp3 to 1.11.0 (James M Snell) #592491d00313fb2] - deps: update ngtcp2 to 1.14.0 (James M Snell) #592498b3a4fc18f] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #6309062fe0cfcd1] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045137e09c8e9] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #6281014a4cb8fbc] - deps: update timezone to 2026b (Node.js GitHub Bot) #629623e1036583a] - deps: upgrade npm to 11.13.0 (npm team) #6289801dfe5961c] - deps: cherry-pick libuv/libuv@439a54b(skooch) #628816cd368b10c] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699f218a4f553] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698b47688524a] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629d202e2d343] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #626292faba66341] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594fa46c90c5d] - deps: update googletest tod72f9c8(Node.js GitHub Bot) #62593099ded5713] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #625927ce95afe96] - deps: libuv: cherry-pickaabb765(Santiago Gimeno) #6256157ef845623] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324493ac40e12] - deps: update libuv to 1.52.1 (Node.js GitHub Bot) #61829b39508b368] - deps: update undici to 7.25.0 (Node.js GitHub Bot) #63011cb67a925e9] - deps: use npm undici@seven tag inupdate-undici.sh(Matteo Collina) #62739aa1e0bc28b] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828f2a1735ed9] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917b6378e215c] - doc: fix node-config-schema (Сковорода Никита Андреевич) #61596233894a9ce] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #630935d97919f8f] - doc: correct diagnostics_channel built-in channel names (Bryan English) #629952a9ccc927e] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884ef413b5358] - doc: fix typo in test.md (Rich Trott) #6296076f21c5070] - doc: correct typo in PR contribution instructions (Mike McCready) #62738ca02af1f7d] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #6291746c99ed526] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #629171a60851734] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882169b5ea2ed] - doc: fix Argon2 parameter bounds (Tobias Nießen) #628689a3a190f4e] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #622050fba9e87d6] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #628419c700f3446] - doc: clarify dns.lookup() callback signature when all is true (eungi) #628006b7280bc17] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753ce47ea31c9] - doc: clarify process._debugProcess() in Permission Model (Fahad Khan) #62537ba01633757] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #6268770b4d5839b] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #626688126d1c3eb] - doc: update WPT test runner README.md (Filip Skokan) #62680978afea4b5] - doc: fix spelling in release announcement guidance (Rohan Santhosh Kumar) #626631684ab8ff8] - doc: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) #6260086d4f07930] - doc: update bug bounty program (Rafael Gonzaga) #62590736ed8a08f] - doc: document TransformStream transformer.cancel option (Tom Pereira) #62566938af9be01] - doc: mention test runner retry attemp is zero based (Moshe Atlow) #6250494433e450f] - doc,src,test: fix dead inspector help URL (semimikoh) #62745ddf1f01659] - esm: addERR_REQUIRE_ESM_RACE_CONDITION(Antoine du Hamel) #624624a506acd16] - fs: add followSymlinks option to glob (Matteo Collina) #62695f4ea495f9b] - fs: restore fs patchability in ESM loader (Joyee Cheung) #6283563c111cd60] - fs: validate position argument before length === 0 early return (Edy Silva) #626749705f628d9] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277717476a24e] - http: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) #62936d7188af5c9] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #6308264f15c274a] - http: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) #628725c4798d799] - http: fix no_proxy leading-dot suffix matching (Daijiro Wachi) #623339f3bc70ae5] - http: cleanup pipeline queue (Robert Nagy) #62534aa1d8a9afc] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541900dc758ff] - http2: expose writable stream state on compat response (T) #63003b3bfe35912] - inspector: coerce key and value to string in webstorage events (Ali Hassan) #626163dc3fb6ad8] - inspector: return errors when CDP protocol event emission fails (Ryuhei Shima) #621624f3f21bd7c] - inspector: auto collect webstorage data (Ryuhei Shima) #6214536cc04189d] - inspector: initial support storage inspection (Ryuhei Shima) #611391718bc3b9b] - inspector: fix absolute URLs in network http (bugyaluwang) #6295597e32c7a74] - lib: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) #6291425d2e999de] - lib: harden kKeyOps lookup with null prototype (Filip Skokan) #6287737d3913c8f] - lib: short-circuit WebIDL BufferSource SAB check (Filip Skokan) #62833430c69d25f] - lib: use js-only implementation ofisDataView()(René) #627803ba0add6a0] - lib: fix lint in internal/webstreams/util.js (Filip Skokan) #628069b95c41398] - lib: fix sequence argument handling in Blob constructor (Ms2ger) #62179314dacdbee] - lib: improve Web Cryptography key validation ordering (Filip Skokan) #627493d18162430] - lib: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) #62632ada3ce879d] - lib: defer AbortSignal.any() following (sangwook) #62367b2981ec7eb] - meta: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot[bot]) #625497cd20667b5] - meta: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot[bot]) #6307491a07cfe9f] - meta: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot[bot]) #6307309e17fe47c] - meta: add automation policy (Chengzhong Wu) #6287159e7fb7986] - meta: move VoltrexKeyva to emeritus (Matteo Collina) #628951e2915cfa6] - meta: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot[bot]) #628450253c6e2be] - meta: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot[bot]) #62844f503675b86] - meta: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot[bot]) #628425e14e4d26e] - meta: broaden stale bot (Aviv Keller) #62658795db76f87] - meta: pass release version to release worker (flakey5) #62777ef384fe39f] - meta: add QUIC to CODEOWNERS (Tim Perry) #6265267e0ac568d] - meta: move Michael to emeritus (Michael Dawson) #625365dad616393] - meta: populate apt list for slim runner in update-openssl workflow (René) #62628a869d25d8a] - meta: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot[bot]) #62550769efc0403] - meta: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot[bot]) #6254873fcc2b055] - meta: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot[bot]) #625476c001246fe] - meta: bump codecov/codecov-action from 5.5.2 to 6.0.0 (dependabot[bot]) #625455ee40d6a03] - meta: bump actions/cache from 5.0.3 to 5.0.4 (dependabot[bot]) #62543ca16ad8a05] - meta: require DCO signoff in commit message guidelines (James M Snell) #62510db9497fc41] - meta: expand memory leak DoS criteria to all DoS (Joyee Cheung) #6250513b7d08b8d] - module: remove duplicated checks from_resolveFilename(Antoine du Hamel) #627296b53efb53a] - module,win: fix long subpath import (Stefan Stojanovic) #62101841dfbf6fc] - node-api: update libuv ABI stability note (Chengzhong Wu) #6278901090f2aa1] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #6262387443b4355] - node-api: execute tsfn finalizer after queue drains when aborted (Kevin Eady) #61956e95570c054] - process: handle rejections only when needed (Gürgün Dayıoğlu) #6291937d49f3219] - process: optimize asyncHandledRejections by using FixedQueue (Gürgün Dayıoğlu) #60854f697c55e38] - quic: add QuicEndpoint.listening & QuicStream.destroy() and tests (Tim Perry) #62648c128942b69] - quic: fixup token verification to handle zero expiration (James M Snell) #62620abb881ec92] - quic: support multiple ALPN negotiation (James M Snell) #62620476926c2ad] - quic: apply multiple TLS context improvements and SNI support (James M Snell) #6262076d9c24b95] - quic: implement rapidhash for hashing improvements (James M Snell) #6262008726cd43d] - quic: move quic behind compile time flag (Matteo Collina) #61444ea4f19aaa7] - quic: use arena allocation for packets (James M Snell) #6258921e9239e2a] - quic: fixup linting/formatting issues (James M Snell) #62387edeed4303b] - quic: update http3 impl details (James M Snell) #623877f3a85e6aa] - quic: fix a handful of bugs and missing functionality (James M Snell) #6238745c1ebddf8] - quic: copy options.certs buffer instead of detaching (Chengzhong Wu) #61403a31a8ee680] - quic: reduce boilerplate and other minor cleanups (James M Snell) #593423be70ff43a] - quic: multiple fixups and updates (James M Snell) #59342b91a93444c] - quic: update more of the quic to the new compile guard (James M Snell) #59342ca0080c164] - quic: few additional small comment edits in cid.h (James M Snell) #593426553202d83] - quic: fixup NO_ERROR macro conflict on windows (James M Snell) #593816df1508ac2] - quic: fixup windows coverage compile error (James M Snell) #59381b2b0bf8b04] - quic: update the guard to check openssl version (James M Snell) #592495556b154bd] - quic: start re-enabling quic with openssl 3.5 (James M Snell) #592492ca42c8263] - repl: keep reference count forprocess.on('newListener')(Anna Henningsen) #618952f37f9177f] - sqlite: use OneByte for ASCII text and internalize col names (Ali Hassan) #619543c96ae1b2f] - sqlite: add serialize() and deserialize() (Ali Hassan) #62579be4d2f3a4c] - sqlite: enable Percentile extension (Jurj Andrei George) #61295dafed453b2] - src: clean up experimental flag variables (Antoine du Hamel) #62759dca1e6aeea] - src: expose help texts into node-config-schema.json (Pietro Marchini) #5868028c4f44eb1] - src: add permission support to config file (Marco Ippolito) #60746f49175b220] - src: fix small compile warning in quic/streams.cc (James M Snell) #60118c9d4a446d8] - src: cleanup quic TransportParams class (James M Snell) #5988499bb02fd9e] - src: swap dotenv and config file parsing order (Marco Ippolito) #63035ecb4d49b7b] - src: add missing <cstdlib> for abort() declaration (Charles Kerr) #63001b6219b6362] - src: fix crash in GetErrorSource() for invalid using syntax (semimikoh) #62770b5ca5ad4c5] - src: simplifyTCPWrap::Connectsignature (Anna Henningsen) #62929ef7ffce7cf] - src: use DCHECK in AsyncWrap::MakeCallback instead emiting a warning (Gerhard Stöbich) #62795cd9890a5ab] - src: fix MaybeStackBuffer char_traits deprecation warning (om-ghante) #62507c70ff44aee] - src: use context-free V8 message column getters (René) #6277806c405f1d7] - src: coercespawnSyncargs to string once (Antoine du Hamel) #626336151999ad6] - src: use stack allocation for small string encoding (Ali Hassan) #62431a71a4ac7a3] - src: add contextify interceptor debug logs (Chengzhong Wu) #62460ad9a2909c2] - src: workaround AIX libc++ std::filesystem bug (Richard Lau) #627887792f1ae47] - stream: copyeditwebstreams/adapter.js(Antoine du Hamel) #630341397d8ce5c] - stream: remove duplicated utility (Antoine du Hamel) #63031ff86b1d64f] - stream: simplifysetPromiseHandledutility (Antoine du Hamel) #6303224a078149a] - stream: validate ReadableStream.from iterator objects (Daeyeon Jeong) #62911cfb1fa9680] - stream: reject duplicate nested transferables (Daeyeon Jeong) #62831d0c913758a] - stream: ensuring cross-destruction in _duplexify to prevent leaks (Daijiro Wachi) #62824978f5c15d7] - stream: simplifyreadableStreamFromIterable(Antoine du Hamel) #626513527646ba5] - stream: fix nested compose error propagation (Matteo Collina) #62556dfb9edef4f] - stream: allow shared array buffer sources in writable webstream adapter (René) #62163f00cdab627] - stream: simplifycreatePromiseCallback(Antoine du Hamel) #626503ed783535f] - stream: fix writev unhandled rejection in fromWeb (sangwook) #6229729b196694c] - stream: noop pause/resume on destroyed streams (Robert Nagy) #62557d73dbb9fc8] - stream: refactor duplexify to be less suceptible to prototype pollution (Antoine du Hamel) #625596f37f7e240] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098b8816580e9] - test: generatelocalstorage.dbin a temp dir (Chengzhong Wu) #6266031a863fd29] - test: update WPT for url to258f285(Node.js GitHub Bot) #63087d0d19bd8e3] - test: update WPT for streams tof8f26a3(Node.js GitHub Bot) #62864f50ac5bc78] - test: improve config-file permission test coverage (Rafael Gonzaga) #60929a0f90000f4] - test: export isRiscv64 from common module (Jamie Magee) #62609da4dd8646f] - test: normalize known inspector crash as completion (Joyee Cheung) #62851b7fdd94a4c] - test: account for RFC 7919 FFDHE negotiation in OpenSSL 4.0 (Filip Skokan) #62805375a993aaf] - test: skip tls-deprecated secp256k1 on OpenSSL 4.0 (Filip Skokan) #62805698d8287d1] - test: use an always invalid cipher and cover OpenSSL 4.0 behaviours (Filip Skokan) #62805036bc6f300] - test: use valid DER OCSP responses (Filip Skokan) #628053aa9938da8] - test: skip test-tls-error-stack when engines are unsupported (Filip Skokan) #62805947f1ae246] - test: accept renamed OpenSSL 4.0 error code and reason (Filip Skokan) #62805afdd355622] - test: update test/addons/openssl-binding for OpenSSL 4.0 (Filip Skokan) #628058637524a99] - test: mark test-snapshot-reproducible flaky (Filip Skokan) #62808c22d34134b] - test: check contextify contextual store behavior in strict mode (René) #625710b4e0d3c94] - test: update tls junk data error expectations (Filip Skokan) #6262985d83c2cdb] - test: ensure WPT report is in out/wpt (Filip Skokan) #626379e21711c60] - test: improve WPT runner summary (Filip Skokan) #62636e04e2c9ac1] - test: skip url WPT subtests instead of modifying test script (Filip Skokan) #626357b1211f88c] - test: capture negative utimes mtime at call time (Yuya Inoue) #62490f1a6e9fcc7] - test: allow skipping individual WPT subtests (Filip Skokan) #6251723f927542e] - test: use on-disk fixture for test-npm-install (Joyee Cheung) #625844739c45879] - test: update WPT for url to7a3645b(Node.js GitHub Bot) #62591f68189b839] - test_runner: addtestIdto test events (Moshe Atlow) #627725c2770446e] - test_runner: publish to TracingChannel for OTel instrumentation (Moshe Atlow) #62502d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #617473f74a58979] - test_runner: update node-config-schema (Pietro Marchini) #5868060c83f6199] - test_runner: fix failing suite hooks when marked withtodo(Moshe Atlow) #63097d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #628203e72065ed6] - test_runner: fix suite rerun edge case (Moshe Atlow) #6286001a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751dd43efffa6] - test_runner: add passed, attempt, and diagnostic to SuiteContext (Moshe Atlow) #62504a12dc445cc] - tools: add a check for clean git tree after tests (Antoine du Hamel) #626615b49178375] - tools: use LTS Node.js in notify-on-push workflow (Nenad Spasenic) #630845a93bde5bb] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065b133019d19] - tools: simplifyupdate-undici.sh(Antoine du Hamel) #6304404d3538074] - tools: do not runtest-linuxon unrelated tools changes (Antoine du Hamel) #630374d396ac4a5] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #628489354bf40e7] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961c23db1ca85] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #629936e097ee3f1] - tools: consolidate and simplify .editorconfig deps section (Daijiro Wachi) #62887a47ea6d6ea] - tools: set bot as author of tools-deps-update PRs (Antoine du Hamel) #6285600e86f0471] - tools: bump brace-expansion from 5.0.4 to 5.0.5 in /tools/eslint (dependabot[bot]) #62458cd7e262e75] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #62467bfc1319bc8] - tools: exclude @node-core/doc-kit from dependabot cooldown (Levi Zim) #62775a932fbd10b] - tools: re-enable undici WPTs in daily wpt.fyi job (Filip Skokan) #62677f7bd9e3055] - tools: update gyp-next to 0.22.0 (Node.js GitHub Bot) #62697c400d46d87] - tools: improve backport review script (Antoine du Hamel) #62573be23b75814] - tools: improve output for unexpected passes in WTP tests (Antoine du Hamel) #62587609c013ece] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #6262781bac1ebfd] - tools: bump the eslint group in /tools/eslint with 2 updates (dependabot[bot]) #625521fee26522d] - tools: allow triagers to queue a PR for CI until it's reviewed (Antoine du Hamel) #62524332088f929] - tools: do not runcommit-linton release proposals (Antoine du Hamel) #625239a25fc8a4d] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #625747bd08ff60a] - url: optimize URLSearchParams set/delete duplicate handling (Gürgün Dayıoğlu) #622662d636388fa] - url: align default argument handling for URLPattern with webidl (Filip Skokan) #6271900705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #615560e2adb3e45] - watch: track worker entry files in watch mode (SudhansuBandha) #62368c58fe38211] - watch: fix --env-file-if-exists crashing on linux if the file is missing (Efe) #61870v24.15.0Compare Source
v24.14.1Compare Source
v24.14.0Compare Source
v24.13.1Compare Source
v24.13.0: 2026-01-13, Version 24.13.0 'Krypton' (LTS), @marco-ippolitoCompare Source
This is a security release.
Notable Changes
lib:
lib,permission:
src:
src,lib:
tls:
Commits
2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #609973e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #612834ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#79789adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#7487302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.