Skip to content

doc: add large pull requests contributing guide#62829

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
mcollina:doc/large-pull-requests
May 11, 2026
Merged

doc: add large pull requests contributing guide#62829
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
mcollina:doc/large-pull-requests

Conversation

@mcollina

@mcollina mcollina commented Apr 19, 2026

Copy link
Copy Markdown
Member

Fixes: #62752

Adds a contributing guide for large pull requests (5000+ lines), covering:

  • Threshold definition and applicability
  • Restriction to collaborators only
  • Design document and review guide requirements
  • Two TSC approvals (same as semver-major)
  • Dependency change separation
  • Feature fork workflow in separate repositories
  • Reviewer guidance

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/tsc

@nodejs-github-bot nodejs-github-bot added the doc Issues and PRs related to the documentations. label Apr 19, 2026

@panva panva left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • We should link to it from CONTRIBUTING.md, pull-requests.md, collaborator-guide.md (or some subset of those)
  • We should exclude routine dependency/wpt/test bot-issued PRs, this can either be excluded explicitly with additional rules or by changing the classification put forth by the Overview or What qualifies as a large pull request sections
  • dependency changes in a separate commit is at odds with having each commit self-contained, this is fine when the commits get squashed but the first commit's message is used for the squash so the first commit would be the non-deps changes? seems odd and counter-intuitive
  • Design document - I 100% discourage linking outside documents, a detailed PR description should also suffice, 3000 can easily be hit with just thorough test coverage for an otherwise trivial change, how would a design document help such PRs?
  • Both Separating test additions from implementation changes. and Splitting documentation into its own pull request. strategies to avoiding large PRs are contrary to what we usually request of contributions. Those strategies only work when the contribution isn't "done" or "shipped" and is excluded from builds.

@mcollina mcollina force-pushed the doc/large-pull-requests branch from e9d9a4c to 7552c50 Compare April 20, 2026 10:28

@RafaelGSS RafaelGSS left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I love it. LGTM

Comment thread doc/contributing/large-pull-requests.md
@joyeecheung

Copy link
Copy Markdown
Member

The specification here doesn't seem very clear:

  1. What are 3000 line of changes: deletion and addition combined? Or just one of them? Splitting a flaky test monolith to avoid hiding regressions for example can easily pass the threshold even though there's not really an interesting architecture to explain and 2 TSC review seems like overkill
  2. What happens when a PR initially isn't big but grows to be bigger as more tests/docs are added?

@mcollina

Copy link
Copy Markdown
Member Author

The specification here doesn't seem very clear:

  1. What are 3000 line of changes: deletion and addition combined? Or just one of them? Splitting a flaky test monolith to avoid hiding regressions for example can easily pass the threshold even though there's not really an interesting architecture to explain and 2 TSC review seems like overkill

We have to draw a line, and this is as good as any. I proposed 5k but I was asked to lower it.
We need this to be "easy" to check from the GitHub interface.

I would be happier with a 3k of non-test/non-doc changes, but that would require better tooling, which I'd prefer to avoid creating now.

What would work for you?

  1. What happens when a PR initially isn't big but grows to be bigger as more tests/docs are added?

The number that matters is at landing time.

@ShogunPanda

Copy link
Copy Markdown
Contributor

The specification here doesn't seem very clear:

  1. What are 3000 line of changes: deletion and addition combined? Or just one of them? Splitting a flaky test monolith to avoid hiding regressions for example can easily pass the threshold even though there's not really an interesting architecture to explain and 2 TSC review seems like overkill

In the document it says: A pull request is considered large when it exceeds **3000 lines** of combined additions and deletions..

So ADD + (- DEL) > 3000

  1. What happens when a PR initially isn't big but grows to be bigger as more tests/docs are added?

I would say as soon as it reaches the threshold the new rules apply. This also means that if with further commits the PR shrinks, rules do not apply anymore.
I guess the commit-queue bot must have a rule to ultimately enforce this.

@jasnell

jasnell commented Apr 22, 2026

Copy link
Copy Markdown
Member

FYI, I've added the new large-pr label that we can use to explicitly marge large PRs that would fall under this policy

@jasnell

jasnell commented Apr 22, 2026

Copy link
Copy Markdown
Member

ADD + ( -DEL) > 3000 is more complicated than I think it needs to be. I'd prefer just to look at additions but happy to go with consensus if others agree with the proposed alternative.

@jasnell

jasnell commented Apr 22, 2026

Copy link
Copy Markdown
Member

@nodejs/tsc ... we could use some more TSC scrutiny on this policy change.

Comment thread doc/contributing/large-pull-requests.md
@mcollina mcollina force-pushed the doc/large-pull-requests branch 2 times, most recently from 57506d2 to 104bc61 Compare April 23, 2026 09:06
@ShogunPanda

Copy link
Copy Markdown
Contributor

ADD + ( -DEL) > 3000 is more complicated than I think it needs to be. I'd prefer just to look at additions but happy to go with consensus if others agree with the proposed alternative.

To be honest I don't have strong opinions on this. I just wrote out how I interpreted the rule to make sure we're on the same page.

Thinking about it, my formula above probably would easily trigger this limit. Just making out an example, if I have a JS function which body is 100 lines long and I wrap the entire body inside a if (horrible, but...why not? :)), it already is 2 pure additions and then 100 removed, 100 lines added (because of indentation). We're already at 202. With something like this you often reach 3000.

So either we only count additions or we raised the combined limit.

@mcollina

Copy link
Copy Markdown
Member Author

I've updated it to to be ADDED - DELETED > LIMIT

Comment thread doc/contributing/large-pull-requests.md Outdated
@mcollina mcollina force-pushed the doc/large-pull-requests branch from 407ac3f to 2d0bc1d Compare April 29, 2026 11:01

@marco-ippolito marco-ippolito left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread doc/contributing/large-pull-requests.md Outdated
Comment thread doc/contributing/large-pull-requests.md Outdated
Comment thread doc/contributing/large-pull-requests.md Outdated
Comment thread doc/contributing/large-pull-requests.md Outdated
Comment thread doc/contributing/large-pull-requests.md Outdated
Comment thread doc/contributing/large-pull-requests.md Outdated
Comment thread doc/contributing/large-pull-requests.md
Comment thread doc/contributing/collaborator-guide.md
@mcollina mcollina added the commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. label May 10, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels May 10, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/62829
✔  Done loading data for nodejs/node/pull/62829
----------------------------------- PR info ------------------------------------
Title      doc: add large pull requests contributing guide (#62829)
Author     Matteo Collina <matteo.collina@gmail.com> (@mcollina)
Branch     mcollina:doc/large-pull-requests -> nodejs:main
Labels     doc, commit-queue-squash
Commits    13
 - doc: add large pull requests contributing guide
 - doc: address review feedback on large pull requests guide
 - doc: add large pull requests contributing guide
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Update doc/contributing/large-pull-requests.md
 - Apply suggestions from code review
 - Merge remote-tracking branch 'origin/doc/large-pull-requests' into do…
Committers 2
 - Matteo Collina <hello@matteocollina.com>
 - GitHub <noreply@github.com>
PR-URL: https://github.com/nodejs/node/pull/62829
Fixes: https://github.com/nodejs/node/issues/62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/62829
Fixes: https://github.com/nodejs/node/issues/62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sun, 19 Apr 2026 10:35:59 GMT
   ✔  Approvals: 9
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4252771875
   ✔  - Trivikram Kamat (@trivikr): https://github.com/nodejs/node/pull/62829#pullrequestreview-4255972855
   ✔  - Rafael Gonzaga (@RafaelGSS) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4142929050
   ✔  - Yagiz Nizipli (@anonrig) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4158756701
   ✔  - Chengzhong Wu (@legendecas) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4173059266
   ✔  - Paolo Insogna (@ShogunPanda) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4241055149
   ✔  - Marco Ippolito (@marco-ippolito) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4196309267
   ✔  - Gürgün Dayıoğlu (@gurgunday): https://github.com/nodejs/node/pull/62829#pullrequestreview-4252659143
   ✔  - Ruy Adorno (@ruyadorno) (TSC): https://github.com/nodejs/node/pull/62829#pullrequestreview-4255541403
   ✔  Last GitHub CI successful
   ℹ  Green GitHub CI is sufficient
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 62829
From https://github.com/nodejs/node
 * branch                  refs/pull/62829/merge -> FETCH_HEAD
✔  Fetched commits as e15f90559bc6..dc1a57087b4e
--------------------------------------------------------------------------------
[main 101365c922] doc: add large pull requests contributing guide
 Author: Matteo Collina <hello@matteocollina.com>
 Date: Sun Apr 19 12:35:40 2026 +0200
 1 file changed, 140 insertions(+)
 create mode 100644 doc/contributing/large-pull-requests.md
Auto-merging CONTRIBUTING.md
Auto-merging doc/contributing/pull-requests.md
[main 5d388bd498] doc: address review feedback on large pull requests guide
 Author: Matteo Collina <hello@matteocollina.com>
 Date: Sun Apr 19 15:35:13 2026 +0200
 4 files changed, 40 insertions(+), 13 deletions(-)
Auto-merging CONTRIBUTING.md
Auto-merging doc/contributing/collaborator-guide.md
CONFLICT (content): Merge conflict in doc/contributing/collaborator-guide.md
Auto-merging doc/contributing/large-pull-requests.md
CONFLICT (add/add): Merge conflict in doc/contributing/large-pull-requests.md
Auto-merging doc/contributing/pull-requests.md
CONFLICT (content): Merge conflict in doc/contributing/pull-requests.md
error: could not apply 2d0bc1d9df... doc: add large pull requests contributing guide
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
   ✘  Failed to apply patches
https://github.com/nodejs/node/actions/runs/25625476444

@mcollina mcollina force-pushed the doc/large-pull-requests branch from dc1a570 to a15a5dc Compare May 10, 2026 18:30
@jasnell jasnell added commit-queue Add this label to land a pull request using GitHub Actions. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. commit-queue Add this label to land a pull request using GitHub Actions. labels May 10, 2026
@jasnell

jasnell commented May 10, 2026

Copy link
Copy Markdown
Member

Unfortunately, looks like there are linting issues preventing landing.

@jasnell jasnell force-pushed the doc/large-pull-requests branch from 5a85620 to de1e47e Compare May 10, 2026 22:41
@jasnell

jasnell commented May 10, 2026

Copy link
Copy Markdown
Member

@mcollina ... Tried multiple attempts at landing this with the 13 separate commits and it kept failing with merge conflicts and odd lint errors. I ended up having to extract a patch file and applying it manually locally then squashing carefully down to a single commit. One thing that's missing here, however, is your Signed-off-by attestation. If you can add that, we should be able to get this landed now.

- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
@mcollina mcollina force-pushed the doc/large-pull-requests branch from de1e47e to 6dd921f Compare May 11, 2026 06:46
@mcollina

Copy link
Copy Markdown
Member Author

@jasnell, thanks and done

@mcollina mcollina added the commit-queue Add this label to land a pull request using GitHub Actions. label May 11, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 11, 2026
@nodejs-github-bot nodejs-github-bot merged commit 20e6a54 into nodejs:main May 11, 2026
19 checks passed
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Landed in 20e6a54

aduh95 pushed a commit that referenced this pull request May 19, 2026
- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62829
Fixes: #62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
aduh95 pushed a commit that referenced this pull request May 19, 2026
- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62829
Fixes: #62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
aduh95 pushed a commit that referenced this pull request May 23, 2026
- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62829
Fixes: #62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#62829
Fixes: nodejs#62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
aduh95 pushed a commit that referenced this pull request Jun 18, 2026
- Exclude routine dependency/WPT/bot PRs from the policy
- Replace design document requirement with detailed PR description
- Clarify dependency commit ordering for squash landing
- Remove splitting strategies that contradict self-contained PRs
- Add links from CONTRIBUTING.md, pull-requests.md,
  collaborator-guide.md

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62829
Fixes: #62752
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
mwalbeck pushed a commit to mwalbeck/docker-cyberchef that referenced this pull request Jul 11, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [node](https://github.com/nodejs/node) | stage | minor | `24.16.0-trixie` → `24.18.0-trixie` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.18.0`](https://github.com/nodejs/node/releases/tag/v24.18.0): 2026-06-23, Version 24.18.0 'Krypton' (LTS), @&#8203;richardlau prepared by @&#8203;sxa

[Compare Source](nodejs/node@v24.17.0...v24.18.0)

##### Notable Changes

- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)

##### Commits

- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`9ff36e40f0`](nodejs/node@9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#&#8203;62755](nodejs/node#62755)
- \[[`7c22ee23aa`](nodejs/node@7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#&#8203;63588](nodejs/node#63588)
- \[[`2551abdb4a`](nodejs/node@2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#&#8203;62761](nodejs/node#62761)
- \[[`e8a55ce9b1`](nodejs/node@e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#&#8203;62763](nodejs/node#62763)
- \[[`ae61cd68f3`](nodejs/node@ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`3d05a1d396`](nodejs/node@3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`f9d10a3f6b`](nodejs/node@f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`e431d93e9e`](nodejs/node@e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`56e2505e48`](nodejs/node@56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`3bac77f2a8`](nodejs/node@3bac77f2a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`1bff901b09`](nodejs/node@1bff901b09)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`4433fca3df`](nodejs/node@4433fca3df)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`b5cf01217a`](nodejs/node@b5cf01217a)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`ce84aef37d`](nodejs/node@ce84aef37d)] - **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan) [#&#8203;62883](nodejs/node#62883)
- \[[`26781689b0`](nodejs/node@26781689b0)] - **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) [#&#8203;62905](nodejs/node#62905)
- \[[`aeea8f4970`](nodejs/node@aeea8f4970)] - **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) [#&#8203;62706](nodejs/node#62706)
- \[[`407cf91656`](nodejs/node@407cf91656)] - **crypto**: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) [#&#8203;62626](nodejs/node#62626)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b46d52b283`](nodejs/node@b46d52b283)] - **crypto**: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) [#&#8203;62499](nodejs/node#62499)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`61826df455`](nodejs/node@61826df455)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#&#8203;63531](nodejs/node#63531)
- \[[`16d2fd3c07`](nodejs/node@16d2fd3c07)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#&#8203;63280](nodejs/node#63280)
- \[[`3b8330deda`](nodejs/node@3b8330deda)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#&#8203;62576](nodejs/node#62576)
- \[[`141de35399`](nodejs/node@141de35399)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#&#8203;63201](nodejs/node#63201)
- \[[`b76bfcd4fa`](nodejs/node@b76bfcd4fa)] - **deps**: upgrade npm to 11.16.0 (npm team) [#&#8203;63602](nodejs/node#63602)
- \[[`4ec142314c`](nodejs/node@4ec142314c)] - **deps**: SQLite: cherry-pick [`b869ed6`](nodejs/node@b869ed6) (Junsu Han) [#&#8203;63525](nodejs/node#63525)
- \[[`19e8ce1c36`](nodejs/node@19e8ce1c36)] - **deps**: upgrade npm to 11.15.0 (npm team) [#&#8203;63463](nodejs/node#63463)
- \[[`8a264260e2`](nodejs/node@8a264260e2)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#&#8203;63217](nodejs/node#63217)
- \[[`50c8ff3f94`](nodejs/node@50c8ff3f94)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#&#8203;62811](nodejs/node#62811)
- \[[`6e56f01c4b`](nodejs/node@6e56f01c4b)] - **deps**: V8: cherry-pick [`435a2cd`](nodejs/node@435a2cdf664c) (Matthias Liedtke) [#&#8203;63136](nodejs/node#63136)
- \[[`3ba813b242`](nodejs/node@3ba813b242)] - **deps**: cherry-pick [libuv/libuv@`a43e543`](libuv/libuv@a43e543) (Ali Hassan) [#&#8203;63222](nodejs/node#63222)
- \[[`2390e3a5ac`](nodejs/node@2390e3a5ac)] - **doc**: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) [#&#8203;63650](nodejs/node#63650)
- \[[`52a1c18374`](nodejs/node@52a1c18374)] - **doc**: update `git node land` instructions for security releases (Antoine du Hamel) [#&#8203;63586](nodejs/node#63586)
- \[[`3e6b4da037`](nodejs/node@3e6b4da037)] - **doc**: drop --experimental from --permission (Rafael Gonzaga) [#&#8203;63583](nodejs/node#63583)
- \[[`84d05163b9`](nodejs/node@84d05163b9)] - **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga) [#&#8203;63479](nodejs/node#63479)
- \[[`7da2a4450e`](nodejs/node@7da2a4450e)] - **doc**: fix URL postMessage example in worker\_threads (Kit Dallege) [#&#8203;62203](nodejs/node#62203)
- \[[`3d79bd8b29`](nodejs/node@3d79bd8b29)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#&#8203;63515](nodejs/node#63515)
- \[[`4f4174aace`](nodejs/node@4f4174aace)] - **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) [#&#8203;63511](nodejs/node#63511)
- \[[`388323ca4b`](nodejs/node@388323ca4b)] - **doc**: fix double space in modules.md (Daijiro Wachi) [#&#8203;63512](nodejs/node#63512)
- \[[`5258ccc058`](nodejs/node@5258ccc058)] - **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi) [#&#8203;63453](nodejs/node#63453)
- \[[`43e83e6507`](nodejs/node@43e83e6507)] - **doc**: fix typo in deprecations (Daijiro Wachi) [#&#8203;63434](nodejs/node#63434)
- \[[`f05a61d54c`](nodejs/node@f05a61d54c)] - **doc**: remove unsupported template type from v8.md (René) [#&#8203;63410](nodejs/node#63410)
- \[[`c39d5fc820`](nodejs/node@c39d5fc820)] - **doc**: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) [#&#8203;62696](nodejs/node#62696)
- \[[`398261f911`](nodejs/node@398261f911)] - **doc**: remove the bi-monthly contributor spotlight section (Claudio Wunder) [#&#8203;62734](nodejs/node#62734)
- \[[`fd9e14c405`](nodejs/node@fd9e14c405)] - **doc**: update http2's `push` and `trailers` events with `rawHeaders` param (YuSheng Chen) [#&#8203;63259](nodejs/node#63259)
- \[[`b943ce6933`](nodejs/node@b943ce6933)] - **doc**: remove inactive members from Triagers list (Antoine du Hamel) [#&#8203;63329](nodejs/node#63329)
- \[[`4b9cdfc022`](nodejs/node@4b9cdfc022)] - **doc**: reference correct function in Module docs (Robin Malfait) [#&#8203;63247](nodejs/node#63247)
- \[[`bed84b6df2`](nodejs/node@bed84b6df2)] - **doc**: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) [#&#8203;63211](nodejs/node#63211)
- \[[`32ea70569b`](nodejs/node@32ea70569b)] - **doc**: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) [#&#8203;63187](nodejs/node#63187)
- \[[`4627bcfd82`](nodejs/node@4627bcfd82)] - **doc**: run license-builder (github-actions\[bot]) [#&#8203;63232](nodejs/node#63232)
- \[[`28eba71845`](nodejs/node@28eba71845)] - **doc**: add large pull requests contributing guide (Matteo Collina) [#&#8203;62829](nodejs/node#62829)
- \[[`2648efd438`](nodejs/node@2648efd438)] - **doc**: remove unnecessary `<!-- eslint-` magic comments (Antoine du Hamel) [#&#8203;63200](nodejs/node#63200)
- \[[`a95fc1f8fc`](nodejs/node@a95fc1f8fc)] - **doc**: clarify SEA platform support excludes darwin-x64 (MJSHANG) [#&#8203;63181](nodejs/node#63181)
- \[[`aaef29e2e1`](nodejs/node@aaef29e2e1)] - **doc**: update release steps when post-release fails (Rafael Gonzaga) [#&#8203;63131](nodejs/node#63131)
- \[[`7d81419cf2`](nodejs/node@7d81419cf2)] - **doc**: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) [#&#8203;63121](nodejs/node#63121)
- \[[`ececd80d81`](nodejs/node@ececd80d81)] - **doc**: document the latest-vX.x schema (Marco Ippolito) [#&#8203;63033](nodejs/node#63033)
- \[[`27c1c1d842`](nodejs/node@27c1c1d842)] - **doc**: remove list of versions in `BUILDING.md` (Antoine du Hamel) [#&#8203;63113](nodejs/node#63113)
- \[[`e369886a65`](nodejs/node@e369886a65)] - **doc,sqlite**: document entryPoint argument for loadExtension (Edy Silva) [#&#8203;63152](nodejs/node#63152)
- \[[`e4e5137cbd`](nodejs/node@e4e5137cbd)] - **errors**: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) [#&#8203;63491](nodejs/node#63491)
- \[[`6d1f6048d2`](nodejs/node@6d1f6048d2)] - **fs**: make `Date` properties on `Stats` enumerable (LiviaMedeiros) [#&#8203;63328](nodejs/node#63328)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`39f61fb06c`](nodejs/node@39f61fb06c)] - **http2**: emit session close before stream close (Matteo Collina) [#&#8203;63414](nodejs/node#63414)
- \[[`8a8f2127d1`](nodejs/node@8a8f2127d1)] - **http2**: validate non-link headers in writeEarlyHints (Matteo Collina) [#&#8203;62017](nodejs/node#62017)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`c05f38229b`](nodejs/node@c05f38229b)] - **lib**: cleanup stateless diffiehellman key handling (Filip Skokan) [#&#8203;62645](nodejs/node#62645)
- \[[`1c16b45d35`](nodejs/node@1c16b45d35)] - **lib**: refactor internal webidl converters (Filip Skokan) [#&#8203;62979](nodejs/node#62979)
- \[[`02f35d6dce`](nodejs/node@02f35d6dce)] - **lib**: define `kEnumerableProperty` atomically (Antoine du Hamel) [#&#8203;63609](nodejs/node#63609)
- \[[`12c51547ba`](nodejs/node@12c51547ba)] - **lib**: fix typos in esm loader comments (RonGamzu) [#&#8203;63465](nodejs/node#63465)
- \[[`9b03b84262`](nodejs/node@9b03b84262)] - **lib**: fix typo idenity => identity (Daijiro Wachi) [#&#8203;63112](nodejs/node#63112)
- \[[`a84e6b0567`](nodejs/node@a84e6b0567)] - **lib**: fixes validator message (Daijiro Wachi) [#&#8203;62823](nodejs/node#62823)
- \[[`11734166a8`](nodejs/node@11734166a8)] - **lib**: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) [#&#8203;63017](nodejs/node#63017)
- \[[`7cead61d21`](nodejs/node@7cead61d21)] - **meta**: flip mcollina emails in .mailmap (Matteo Collina) [#&#8203;63621](nodejs/node#63621)
- \[[`a08cfcfd35`](nodejs/node@a08cfcfd35)] - **meta**: label "source maps" PRs (Chengzhong Wu) [#&#8203;63591](nodejs/node#63591)
- \[[`d56e8d2512`](nodejs/node@d56e8d2512)] - **meta**: add `vfs` subsystem label (René) [#&#8203;62331](nodejs/node#62331)
- \[[`6201cfe488`](nodejs/node@6201cfe488)] - **meta**: skip scheduled workflows on forks (Jamie Magee) [#&#8203;63565](nodejs/node#63565)
- \[[`f095e2bd31`](nodejs/node@f095e2bd31)] - **meta**: add additional gitignore entries (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`1ea52c444c`](nodejs/node@1ea52c444c)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63402](nodejs/node#63402)
- \[[`b1b2327611`](nodejs/node@b1b2327611)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63235](nodejs/node#63235)
- \[[`7d88e130a9`](nodejs/node@7d88e130a9)] - **meta**: ignore AI assistants files (Matteo Collina) [#&#8203;62612](nodejs/node#62612)
- \[[`a53b51df38`](nodejs/node@a53b51df38)] - **module**: load ESM helpers eagerly in the snapshot (Joyee Cheung) [#&#8203;63550](nodejs/node#63550)
- \[[`69df688fff`](nodejs/node@69df688fff)] - **module**: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) [#&#8203;62920](nodejs/node#62920)
- \[[`75d9a4ed47`](nodejs/node@75d9a4ed47)] - **node-api**: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) [#&#8203;62710](nodejs/node#62710)
- \[[`c20aa4c47b`](nodejs/node@c20aa4c47b)] - **quic**: add reusePort option to QuicEndpoint (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`26a30d8a7f`](nodejs/node@26a30d8a7f)] - **quic**: implement rate limiting for version nego and immediate close (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`0b534b5770`](nodejs/node@0b534b5770)] - **quic**: fixup linting issue after other changes (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`4b367cbe09`](nodejs/node@4b367cbe09)] - **quic**: remove unused binding variable in session.cc (James M Snell) [#&#8203;63177](nodejs/node#63177)
- \[[`2574bef5a6`](nodejs/node@2574bef5a6)] - **repl**: fix dedup comparing normalized line against raw history (Daijiro Wachi) [#&#8203;62886](nodejs/node#62886)
- \[[`30e71c7e49`](nodejs/node@30e71c7e49)] - **sqlite**: keep source database alive during backup (Matteo Collina) [#&#8203;62673](nodejs/node#62673)
- \[[`677ca7e76c`](nodejs/node@677ca7e76c)] - **src**: simplify OpenSSL feature gates (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`c863c75c39`](nodejs/node@c863c75c39)] - **src**: add BoringSSL EVP enumeration fallback (Filip Skokan) [#&#8203;63206](nodejs/node#63206)
- \[[`f6b2466921`](nodejs/node@f6b2466921)] - **src**: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) [#&#8203;62924](nodejs/node#62924)
- \[[`92d4f07dd2`](nodejs/node@92d4f07dd2)] - **src**: remove license headers for new node\_profiling files (Chengzhong Wu) [#&#8203;63066](nodejs/node#63066)
- \[[`8ac5d771c8`](nodejs/node@8ac5d771c8)] - **src**: split profiling helpers from util (Ilyas Shabi) [#&#8203;63008](nodejs/node#63008)
- \[[`85d1639495`](nodejs/node@85d1639495)] - **src**: remove TOCTOU race condition when encoding SAB-backed `Buffer`s (Antoine du Hamel) [#&#8203;63517](nodejs/node#63517)
- \[[`9473c5f05c`](nodejs/node@9473c5f05c)] - **src**: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) [#&#8203;63231](nodejs/node#63231)
- \[[`f35c91ee68`](nodejs/node@f35c91ee68)] - **src**: improve token return value check (James M Snell) [#&#8203;63483](nodejs/node#63483)
- \[[`26f677c1c5`](nodejs/node@26f677c1c5)] - **src**: expose `node::RegisterContext` to make a node managed context (Chengzhong Wu) [#&#8203;62322](nodejs/node#62322)
- \[[`275cf909b6`](nodejs/node@275cf909b6)] - **src,sqlite**: only pass `xFilter` when user provided a callback (Antoine du Hamel) [#&#8203;63516](nodejs/node#63516)
- \[[`287e02303f`](nodejs/node@287e02303f)] - **src,sqlite**: remove dead code (Edy Silva) [#&#8203;63204](nodejs/node#63204)
- \[[`58fa2ee189`](nodejs/node@58fa2ee189)] - **stream**: switch to internal `sleep` binding (Antoine du Hamel) [#&#8203;63611](nodejs/node#63611)
- \[[`f954ab3f1a`](nodejs/node@f954ab3f1a)] - **stream**: use data listener for compose forwarding (Trivikram Kamat) [#&#8203;63593](nodejs/node#63593)
- \[[`dc57173003`](nodejs/node@dc57173003)] - **stream**: fix Writable.toWeb() hang on synchronous drain (sangwook) [#&#8203;61197](nodejs/node#61197)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)
- \[[`cee279c5d6`](nodejs/node@cee279c5d6)] - **stream**: remove unnecessary check (Antoine du Hamel) [#&#8203;63030](nodejs/node#63030)
- \[[`61b20f60a3`](nodejs/node@61b20f60a3)] - **test**: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`a835363808`](nodejs/node@a835363808)] - **test**: update WPT for WebCryptoAPI to [`97bbc72`](nodejs/node@97bbc7247a) (Node.js GitHub Bot) [#&#8203;63417](nodejs/node#63417)
- \[[`a00297480b`](nodejs/node@a00297480b)] - **test**: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) [#&#8203;62389](nodejs/node#62389)
- \[[`5a95a2b055`](nodejs/node@5a95a2b055)] - **test**: shorten path in net pipe connect errors (Matteo Collina) [#&#8203;63405](nodejs/node#63405)
- \[[`5e8ff22d8f`](nodejs/node@5e8ff22d8f)] - **test**: remove test-node-output-v8-warning (Joyee Cheung) [#&#8203;63469](nodejs/node#63469)
- \[[`ee15380950`](nodejs/node@ee15380950)] - **test**: update test426-fixtures to [`9b9e225`](nodejs/node@9b9e225) (Node.js GitHub Bot) [#&#8203;63373](nodejs/node#63373)
- \[[`9e063d9bea`](nodejs/node@9e063d9bea)] - **test**: update WPT for url to [`e4a4672`](nodejs/node@e4a4672e9e) (Node.js GitHub Bot) [#&#8203;63372](nodejs/node#63372)
- \[[`503bee4b43`](nodejs/node@503bee4b43)] - **test**: deflake async-hooks statwatcher test (Trivikram Kamat) [#&#8203;63396](nodejs/node#63396)
- \[[`cccc7c32d8`](nodejs/node@cccc7c32d8)] - **test**: avoid test\_runner watch restart in spec snapshot (Trivikram Kamat) [#&#8203;63392](nodejs/node#63392)
- \[[`c89489258c`](nodejs/node@c89489258c)] - **test**: reduce watch mode restart flakiness (Trivikram Kamat) [#&#8203;63390](nodejs/node#63390)
- \[[`e4d5e2578e`](nodejs/node@e4d5e2578e)] - **test**: isolate rerun-failures state file under tmpdir (Chemi Atlow) [#&#8203;63449](nodejs/node#63449)
- \[[`362644a9ba`](nodejs/node@362644a9ba)] - **test**: wait for ok before initial break after restart (Yuya Inoue) [#&#8203;62807](nodejs/node#62807)
- \[[`c4058d0e05`](nodejs/node@c4058d0e05)] - **test**: disable Maglev in near-heap-limit worker test (Trivikram Kamat) [#&#8203;63398](nodejs/node#63398)
- \[[`214da630a7`](nodejs/node@214da630a7)] - **test**: deflake connection refused proxy tests (Trivikram Kamat) [#&#8203;63395](nodejs/node#63395)
- \[[`1d61a29876`](nodejs/node@1d61a29876)] - **test**: avoid repeated writes in watch helper (Trivikram Kamat) [#&#8203;63386](nodejs/node#63386)
- \[[`2004e25387`](nodejs/node@2004e25387)] - **test**: deflake watch mode worker test (Trivikram Kamat) [#&#8203;63384](nodejs/node#63384)
- \[[`d691cccfc1`](nodejs/node@d691cccfc1)] - **test**: relax test-memory-usage arrayBuffers check (inoway46) [#&#8203;63244](nodejs/node#63244)
- \[[`0ff6bf853c`](nodejs/node@0ff6bf853c)] - **test**: reduce flakiness of `different-registry-per-thread` (Antoine du Hamel) [#&#8203;63244](nodejs/node#63244)
- \[[`d9f4e8e503`](nodejs/node@d9f4e8e503)] - **test**: fix flaky test-watch-mode-inspect timeout (Matteo Collina) [#&#8203;63361](nodejs/node#63361)
- \[[`6d7cd50328`](nodejs/node@6d7cd50328)] - **test**: relax min assertion in test-performance-eventloopdelay (Marco) [#&#8203;63100](nodejs/node#63100)
- \[[`9dafe1d2d8`](nodejs/node@9dafe1d2d8)] - **test**: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) [#&#8203;62055](nodejs/node#62055)
- \[[`989b2de973`](nodejs/node@989b2de973)] - **test**: avoid initial-break wait in restart-message (inoway46) [#&#8203;62060](nodejs/node#62060)
- \[[`a072a25ee7`](nodejs/node@a072a25ee7)] - **test**: move FFI tests to `NATIVE_SUITES` (Antoine du Hamel) [#&#8203;63165](nodejs/node#63165)
- \[[`64efbfd878`](nodejs/node@64efbfd878)] - **test**: use ERM to destroy sqlite database handles after tests (René) [#&#8203;63076](nodejs/node#63076)
- \[[`7dee66cd94`](nodejs/node@7dee66cd94)] - **test\_runner**: dont buffer unordered events in process isolation mode (Moshe Atlow) [#&#8203;63432](nodejs/node#63432)
- \[[`d257eec1e3`](nodejs/node@d257eec1e3)] - **test\_runner**: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) [#&#8203;63431](nodejs/node#63431)
- \[[`288c320e2f`](nodejs/node@288c320e2f)] - **test\_runner**: show replayed-from-attempt hint in spec reporter (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`904bdf5bb4`](nodejs/node@904bdf5bb4)] - **test\_runner**: preserve run duration when using test-rerun (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`df183d7bfa`](nodejs/node@df183d7bfa)] - **test\_runner**: avoid hanging on incomplete v8 frames (Ali Hassan) [#&#8203;62704](nodejs/node#62704)
- \[[`ec86c69726`](nodejs/node@ec86c69726)] - **test\_runner**: fix diagnostics channel context tracking (Moshe Atlow) [#&#8203;63283](nodejs/node#63283)
- \[[`94e5f63b83`](nodejs/node@94e5f63b83)] - **tls**: add unsupported renegotiation error (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`06d308fb61`](nodejs/node@06d308fb61)] - **tools**: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`2e4a0d0c91`](nodejs/node@2e4a0d0c91)] - **tools**: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot\[bot]) [#&#8203;63415](nodejs/node#63415)
- \[[`4c9666b366`](nodejs/node@4c9666b366)] - **tools**: skip commit-lint on backport pull requests (Marco) [#&#8203;63378](nodejs/node#63378)
- \[[`67d0c490a8`](nodejs/node@67d0c490a8)] - **tools**: fix skip of `test-internet` on forks (Antoine du Hamel) [#&#8203;63492](nodejs/node#63492)
- \[[`02f73c7cac`](nodejs/node@02f73c7cac)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#&#8203;63075](nodejs/node#63075)
- \[[`5d016d3241`](nodejs/node@5d016d3241)] - **tools**: update gyp-next to 0.22.2 (Node.js GitHub Bot) [#&#8203;63374](nodejs/node#63374)
- \[[`55af0f0edb`](nodejs/node@55af0f0edb)] - **tools**: fix test426 updater (Antoine du Hamel) [#&#8203;63271](nodejs/node#63271)
- \[[`d8475e167a`](nodejs/node@d8475e167a)] - **tools**: use different branch for tool updates on staging branches (Antoine du Hamel) [#&#8203;63110](nodejs/node#63110)
- \[[`c605df9e50`](nodejs/node@c605df9e50)] - **util**: remove unused functions (Antoine du Hamel) [#&#8203;63612](nodejs/node#63612)
- \[[`fe4540ebdb`](nodejs/node@fe4540ebdb)] - **util**: create hex style cache and fast path (Guilherme Araújo) [#&#8203;62999](nodejs/node#62999)

### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.16.0...v24.17.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

##### Commits

- \[[`9e4dfc7bba`](nodejs/node@9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
- \[[`cb2aed980c`](nodejs/node@cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
- \[[`a8a0d12875`](nodejs/node@a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#&#8203;62891](nodejs/node#62891)
- \[[`66e6203c1c`](nodejs/node@66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#&#8203;62891](nodejs/node#62891)
- \[[`dd627ced27`](nodejs/node@dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`684bae568f`](nodejs/node@684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`3a631e7f83`](nodejs/node@3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#&#8203;62656](nodejs/node#62656)
- \[[`cf44df3996`](nodejs/node@cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#&#8203;63703](nodejs/node#63703)
- \[[`138c70294b`](nodejs/node@138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
- \[[`be7e719c3f`](nodejs/node@be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
- \[[`cc7c11b4d1`](nodejs/node@cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
- \[[`9224427b92`](nodejs/node@9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
- \[[`cf85d54839`](nodejs/node@cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
- \[[`a1bbc24f96`](nodejs/node@a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
- \[[`e3723ff2d6`](nodejs/node@e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`a77af4867b`](nodejs/node@a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`31beb4f707`](nodejs/node@31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
- \[[`8e75c73f91`](nodejs/node@8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/488
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. doc Issues and PRs related to the documentations.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

"Authoring a large PR" contribution guide