Skip to content

2026-06-19, Version 24.18.0 'Krypton' (LTS)#64001

Closed
github-actions[bot] wants to merge 122 commits into
v24.xfrom
v24.18.0-proposal
Closed

2026-06-19, Version 24.18.0 'Krypton' (LTS)#64001
github-actions[bot] wants to merge 122 commits into
v24.xfrom
v24.18.0-proposal

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

2026-06-19, Version 24.18.0 'Krypton' (LTS), @sxa

Notable Changes

  • [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
  • [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  • [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
  • [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079

Commits

  • [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
  • [9ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
  • [7c22ee23aa] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #63588
  • [2551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
  • [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  • [61826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
  • [16d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
  • [3b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
  • [141de35399] - debugger: add --help to node inspect and improve docs (Joyee Cheung) #63201
  • [b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #63602
  • [4ec142314c] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
  • [19e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #63463
  • [8a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
  • [50c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811
  • [6e56f01c4b] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136
  • [3ba813b242] - deps: cherry-pick libuv/libuv@a43e543 (Ali Hassan) #63222
  • [2390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
  • [52a1c18374] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
  • [3e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
  • [84d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
  • [7da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203
  • [3d79bd8b29] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
  • [4f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511
  • [388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #63512
  • [5258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
  • [43e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434
  • [f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410
  • [c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696
  • [398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734
  • [fd9e14c405] - doc: update http2's push and trailers events with rawHeaders param (YuSheng Chen) #63259
  • [b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329
  • [4b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247
  • [bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #63211
  • [32ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187
  • [4627bcfd82] - doc: run license-builder (github-actions[bot]) #63232
  • [28eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #62829
  • [2648efd438] - doc: remove unnecessary <!-- eslint- magic comments (Antoine du Hamel) #63200
  • [a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181
  • [aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #63131
  • [7d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121
  • [ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #63033
  • [27c1c1d842] - doc: remove list of versions in BUILDING.md (Antoine du Hamel) #63113
  • [e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152
  • [e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
  • [6d1f6048d2] - fs: make Date properties on Stats enumerable (LiviaMedeiros) #63328
  • [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
  • [39f61fb06c] - http2: emit session close before stream close (Matteo Collina) #63414
  • [8a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #62017
  • [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
  • [02f35d6dce] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
  • [12c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #63465
  • [9b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112
  • [a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #62823
  • [11734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #63017
  • [7cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
  • [a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591
  • [d56e8d2512] - meta: add vfs subsystem label (René) #62331
  • [6201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
  • [f095e2bd31] - meta: add additional gitignore entries (James M Snell) #63267
  • [1ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402
  • [b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63235
  • [7d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612
  • [a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
  • [69df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #62920
  • [75d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
  • [c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
  • [26a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
  • [0b534b5770] - quic: fixup linting issue after other changes (James M Snell) #63267
  • [4b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #63177
  • [2574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #62886
  • [30e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673
  • [92d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #63066
  • [8ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #63008
  • [85d1639495] - src: remove TOCTOU race condition when encoding SAB-backed Buffers (Antoine du Hamel) #63517
  • [9473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231
  • [f35c91ee68] - src: improve token return value check (James M Snell) #63483
  • [26f677c1c5] - src: expose node::RegisterContext to make a node managed context (Chengzhong Wu) #62322
  • [275cf909b6] - src,sqlite: only pass xFilter when user provided a callback (Antoine du Hamel) #63516
  • [287e02303f] - src,sqlite: remove dead code (Edy Silva) #63204
  • [58fa2ee189] - stream: switch to internal sleep binding (Antoine du Hamel) #63611
  • [f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593
  • [dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #61197
  • [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834
  • [cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #63030
  • [5a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #63405
  • [5e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469
  • [ee15380950] - test: update test426-fixtures to 9b9e225b5a63139e9a95cdd1bf874a8f0b9d131 (Node.js GitHub Bot) #63373
  • [9e063d9bea] - test: update WPT for url to e4a4672e9e (Node.js GitHub Bot) #63372
  • [503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396
  • [cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392
  • [c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390
  • [e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449
  • [362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807
  • [c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398
  • [214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #63395
  • [1d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #63386
  • [2004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384
  • [d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #63244
  • [0ff6bf853c] - test: reduce flakiness of different-registry-per-thread (Antoine du Hamel) #63244
  • [d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #63361
  • [6d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #63100
  • [9dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055
  • [989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060
  • [a072a25ee7] - test: move FFI tests to NATIVE_SUITES (Antoine du Hamel) #63165
  • [64efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #63076
  • [7dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432
  • [d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431
  • [288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429
  • [904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429
  • [df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704
  • [ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #63283
  • [94e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #63161
  • [2e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #63415
  • [4c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #63378
  • [67d0c490a8] - tools: fix skip of test-internet on forks (Antoine du Hamel) #63492
  • [02f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #63075
  • [5d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #63374
  • [55af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271
  • [d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
  • [c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612
  • [fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999

aduh95 and others added 30 commits June 18, 2026 00:15
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63113
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #63033
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: #63121
Refs: #62838
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62673
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
- For imported CJS, if it's not customized by asynchronous hooks,
  make sure it won't use the quirky re-invented require in all
  cases.
- When the imported CJS module is customized by synchronous hooks,
  in the synthetic module evalutation step, avoid calling the
  respective default step again.
- Make the branching of loadCJSModuleWithModuleLoad() and
  loadCJSModuleWithSpecialRequire() more explicit, and fold
  the tentative fs read in the 'commonjs' translator into the
  share createCJSModuleWrap() helper instead of checking it
  twice in the same path.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #62920
Fixes: #63060
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: #63076
Refs: #63052
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: #63152
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #63131
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Map BoringSSL's native renegotiation failure to
ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is
called. This avoids exposing an implementation-specific OpenSSL error
when the TLS backend does not support caller-initiated renegotiation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63161
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #63177
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
The Platform support section of the single-executable-applications doc
listed `macOS` without qualifying which architecture is supported.
SEA on x64 macOS is not supported and is skipped in CI; only arm64
macOS is exercised.

Refs: #62893
Signed-off-by: mokashang <64570909+mokashang@users.noreply.github.com>
PR-URL: #63181
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63200
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Ignore CLAUDE.md and AGENTS.md in .gitignore, and exclude
them from markdown and ESLint linting.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62612
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Follow WHATWG streams spec update: whatwg/streams#1367

ReadableStreamBYOBRequest.view is always constructed as a Uint8Array.

This changes the documented return type from ArrayBufferView to
Uint8Array per the updated spec.

Fixes: #62952

Signed-off-by: Jah-yee <166608075+Jah-yee@users.noreply.github.com>
PR-URL: #63017
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62829
Fixes: #62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63110
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
- Add `--help` / `-h` to `node inspect` covering both interactive and
  non-interactive probe modes. The help text is printed when
  `--help`/`-h` appears before any positional argument to avoid
  hijacking `--help` passed to a child script.
- Improve the documentation of probe mode and add examples, explain
  same-location probe coalescing, TDZ caveat for let/const bindings,
  basename matching and exit code behavior. Also move it to a
  section parallel to interactive mode. Remove recommendation of
  evaluating structured expressions as that is prone to missing
  info in JSON mode.

Drive-by: When probe mode exits due to invalid arguments, exit with
`kInvalidCommandLineArgument` (9) instead of `kGenericUserError` (1).

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #63201
Reviewed-By: Jan Martin <jan.krems@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Original commit message:

    unix: fix pedantic compiler warnings (#5052)

    Fixes: libuv/libuv#5051

Fixes: #63196
Refs: libuv/libuv#5052
Refs: libuv/libuv@a43e543
PR-URL: #63222
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: #63204
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Original commit message:

    [wasm] Update WebAssembly.Exception JS API

    WebIDL specifies the existence of a
    `WebAssembly.Exception.prototype.stack` getter.
    WebIDL also expects the constructor to have 2 parameters (plus an
    optional one).

    https://webassembly.github.io/spec/js-api/#exceptions

    Bug: 336347912, 42204334
    Change-Id: I128e976a84f942dcf9b93a157534b15fad0f9215
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7697976
    Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
    Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#106215}

Refs: v8/v8@435a2cd
PR-URL: #63136
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1) Fixed macOS default for missing kSecTrustSettingsResult

When kSecTrustSettingsResult is absent from a trust settings dictionary,
Apple specifies kSecTrustSettingsResultTrustRoot as the default value.

Previously, the trust result evaluation (deny check, self-issued check,
TrustAsRoot check) was inside the block that only executed when
kSecTrustSettingsResult was explicitly present. When the key was absent,
the function fell through to return UNSPECIFIED, incorrectly rejecting
self-signed certificates that should have been trusted via the default.

Move the trust result evaluation outside the conditional block so the
default value of kSecTrustSettingsResultTrustRoot flows through the
same code path as explicit values. This aligns with Chromium's
trust_store_mac.cc implementation.

2) Fix CFRelease leak in IsTrustDictionaryTrustedForPolicy: the
CFDictionaryRef returned by SecPolicyCopyProperties(policy_ref)
was not released when the policy OID matched kSecPolicyAppleSSL.

3) Deduplicate certificates: SecItemCopyMatching can return the same
certificate from multiple keychains.

4) Filter expired certificates.

Signed-off-by: deepak1556 <hop2deep@gmail.com>
PR-URL: #62576
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #63232
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #62823
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #63112
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Signed-off-by: umuoy1 <burningdian@gmail.com>
PR-URL: #62710
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com>
PR-URL: #63235
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: #63187
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
PR-URL: #63211
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63165
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Robin Malfait <malfait.robin@gmail.com>
PR-URL: #63247
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
RafaelGSS and others added 21 commits June 18, 2026 21:12
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #63583
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Since the ESM loader is captured in the snapshot now, there's
no need to lazy load the helpers. Load them eagerly to capture
them into the snapshot. This also reduces the noise coming out
of --print-bytecode since we no longer compile the helper
functions at run time.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #63550
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63586
Refs: nodejs/node-core-utils#1043
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: #63588
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
PR-URL: #63591
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Forward Node.js tail stream data through a pipe-style data listener
instead of manually draining readable events. This keeps compose closer
to the stream pipe hot path while preserving backpressure with pause
and resume.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: #63593
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
The 8 KiB default has been unchanged since 2015. With the threshold
check `size < (Buffer.poolSize >>> 1)`, this means allocations of 4 KiB
or larger bypass the pool entirely — including 4 KiB itself, a common
page and HTTP-frame size.

Raising the default to 64 KiB extends pool coverage to ~32 KiB
allocations, capturing common sizes used by HTTP parsers, stream
chunks, and small file reads.

Throughput improvements on workers-k=8 fs.readFileSync benchmarks
(Linux/glibc) at the affected sizes, with no regressions elsewhere:

  file size  |  8 KiB pool  |  64 KiB pool  |  delta
  -----------+--------------+---------------+-------
   4 KiB     |  326k ops/s  |  360k ops/s   |  +10%
   8 KiB     |  202k ops/s  |  254k ops/s   |  +26%
  16 KiB     |  148k ops/s  |  181k ops/s   |  +23%
  64 KiB     |   86k ops/s  |   87k ops/s   |   ~
   1 MiB     |   12k ops/s  |   13k ops/s   |   ~

Cost: +56 KiB RSS per realm at startup.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #63597
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <Divyanshu88999@gmail.com>
PR-URL: #63491
Fixes: #63473
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
PR-URL: #62999
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: #63602
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63609
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63611
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63612
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #63621
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63517
Refs: https://hackerone.com/reports/3752489
Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #63650
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: Paolo Insogna <paolo@cowtech.it>
PR-URL: #62755
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: #62761
Refs: #61964
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Signed-off-by: Stewart X Addison <sxa@ibm.com>
Signed-off-by: ishabi <ilyasshabi94@gmail.com>
PR-URL: #63008
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: Stewart X Addison <sxa@ibm.com>
Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
PR-URL: #63066
Refs: #62273
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Signed-off-by: Stewart X Addison <sxa@ibm.com>
Notable changes:

buffer:
  * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
http:
  * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079

PR-URL: #64001
@github-actions github-actions Bot added release Issues and PRs related to Node.js releases. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Jun 19, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/build
  • @nodejs/gyp
  • @nodejs/performance
  • @nodejs/security-wg
  • @nodejs/tsc

@panva

panva commented Jun 19, 2026

Copy link
Copy Markdown
Member

#63563 this should be included

@sxa

sxa commented Jun 19, 2026

Copy link
Copy Markdown
Member

I'm going to close this and regenerate the proposal for Monday once 63563 has passed a new CI.
We're also experiencing an outage on all the s390x linux systems at the moment so today is no longer an option regardless.

@sxa sxa closed this Jun 19, 2026
@panva panva deleted the v24.18.0-proposal branch June 19, 2026 13:08
@panva panva restored the v24.18.0-proposal branch June 19, 2026 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Issues and PRs related to Node.js releases. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.