Skip to content

Fix REPL crash when V8 emits warnings during preview mode (Issue #63473)#63491

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
DivyanshuX9:fix/issue-63473-repl-asm-warning
May 29, 2026
Merged

Fix REPL crash when V8 emits warnings during preview mode (Issue #63473)#63491
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
DivyanshuX9:fix/issue-63473-repl-asm-warning

Conversation

@DivyanshuX9

@DivyanshuX9 DivyanshuX9 commented May 22, 2026

Copy link
Copy Markdown
Contributor

Fix: Handle V8 Warnings in DisallowJavascriptExecutionScope


The Problem

When the Node.js REPL runs with preview mode enabled, certain code (such as
asm.js modules) causes V8 to emit deprecation warnings inside a
DisallowJavascriptExecutionScope : a V8 context where JavaScript execution
is temporarily forbidden.

Node's warning handler (PerIsolateMessageListener) was unconditionally
calling ProcessEmitWarningGeneric, which invokes process.emit() -> a JS
call which is inside this forbidden scope, causing a fatal crash:

Fatal error in , line 0

Invoke in DisallowJavascriptExecutionScope


What Changed

Modified PerIsolateMessageListener in src/node_errors.cc to check
can_call_into_js() before attempting to emit warnings.

When JavaScript cannot be called (i.e. we are inside a forbidden scope),
the warning is deferred via env->SetImmediate() until after the scope
exits at which point it is safe to call JavaScript again.

Files changed:

  • src/node_errors.cc -> added can_call_into_js() guard with deferred emission
  • test/parallel/test-repl-asm-warning-no-crash.js : new regression test

What Is Preserved

The fix does not degrade warning quality in any case:

Property Status
Full (node:PID) [DEPXXXX] DeprecationWarning: format Preserved
--redirect-warnings file routing Preserved
All existing warning behaviour in normal (non-forbidden) scopes Unchanged
No new allocations or memory leak risk Lambda captures string by value

Approach

Instead of falling back to raw fprintf(stderr, ...) (which loses structured
formatting and --redirect-warnings support), this fix uses env->SetImmediate()
to queue the warning for the next safe event loop iteration.

This is an established Node.js pattern for deferring work that requires
JavaScript execution. The lambda captures the warning string by value,
ensuring it remains valid until the callback fires.

// Before (crashes inside DisallowJavascriptExecutionScope)
ProcessEmitWarningGeneric(env, message, ...);

// After (defers safely when JS is forbidden)
if (!env->can_call_into_js()) {
  std::string deferred_msg = message;
  env->SetImmediate([deferred_msg](Environment* env) {
    ProcessEmitWarningGeneric(env, deferred_msg, ...);
  });
  return;
}
ProcessEmitWarningGeneric(env, message, ...);

How to Test

Run the regression test in isolation:

node test/parallel/test-repl-asm-warning-no-crash.js

Or as part of the test suite:

npm test -- test/parallel/test-repl-asm-warning-no-crash.js

Regression Test

test/parallel/test-repl-asm-warning-no-crash.js reproduces the issue by:

  1. Starting a Node.js REPL with usePreview: true (triggers the inspector path)
  2. Sending the asm.js reproduction case from V8 warnings crash process within DisallowJavascriptExecutionScopeΒ #63473
  3. Asserting the process exits cleanly with exit code 0
  4. Asserting no FATAL ERROR appears in stderr

Checklist

  • Regression test added
  • No breaking changes to existing behaviour or public API
  • --redirect-warnings routing preserved
  • No changes outside the two files listed above
  • Commit message follows Node.js format
  • No trailing whitespace or formatting changes to unrelated code

Fixes: #63473

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels May 22, 2026
@DivyanshuX9

Copy link
Copy Markdown
Contributor Author

@Renegade334 could you please review this fix?

@Renegade334 Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both this and #63486 seem to have borrowed from each other, but the core concept seems to have originated here, so I'm going to aim to get this one merged.

You need to fix your commit authorship information, and add a Signed-off-by: trailer as per

6. Your commit must contain the `Signed-off-by` line with your name and email
address as an acknowledgement that you agree to the [Developer Certificate of Origin][].
Bot generated commits are exempt from this requirement. If a commit has
multiple authors, the `Signed-off-by` line should be added for each author;
and at least one should match the author information in the commit metadata.
This rule does not apply to dependency updates (e.g. cherry-picks), release
commits, or backport commits.

Comment thread src/node_errors.cc Outdated
Comment thread src/node_errors.cc Outdated
Comment thread test/parallel/test-repl-asm-warning-no-crash.js Outdated
@DivyanshuX9 DivyanshuX9 force-pushed the fix/issue-63473-repl-asm-warning branch from 0d433ed to c1c87a7 Compare May 24, 2026 09:30
@DivyanshuX9

Copy link
Copy Markdown
Contributor Author

Removed the obsolete REPL asm warning regression test and updated node_errors.cc so deferred warnings capture warning directly in SetImmediate instead of copying to warning_str. Also added the Signed-off-by trailer and pushed the rewritten branch history.

@Renegade334 please check again

@DivyanshuX9 DivyanshuX9 requested a review from Renegade334 May 24, 2026 09:33
@DivyanshuX9 DivyanshuX9 force-pushed the fix/issue-63473-repl-asm-warning branch from c1c87a7 to 99b20d4 Compare May 24, 2026 09:41

@Renegade334 Renegade334 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the changes.

@codecov

codecov Bot commented May 24, 2026

Copy link
Copy Markdown

Codecov Report

βœ… All modified and coverable lines are covered by tests.
βœ… Project coverage is 90.61%. Comparing base (3553a34) to head (6a9412f).
⚠️ Report is 88 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #63491      +/-   ##
==========================================
+ Coverage   90.13%   90.61%   +0.47%     
==========================================
  Files         718      730      +12     
  Lines      227914   236123    +8209     
  Branches    42811    46356    +3545     
==========================================
+ Hits       205435   213957    +8522     
+ Misses      14248    13932     -316     
- Partials     8231     8234       +3     
Files with missing lines Coverage Ξ”
src/node_errors.cc 64.00% <100.00%> (-0.18%) ⬇️

... and 129 files with indirect coverage changes

πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@DivyanshuX9

DivyanshuX9 commented May 24, 2026

Copy link
Copy Markdown
Contributor Author

should i make my PR message from
"Fixes: #62473"

to

"#63473"

to fix the one failing test , do i have to get review again or it will let it slide???

edit: its not letting me give the full link :( what to do

@DivyanshuX9

This comment was marked as off-topic.

@Renegade334

Copy link
Copy Markdown
Member

Please don't ping collaborators unnecessarily.

The easiest thing to do is to remove the Fixes: trailer from your commit entirely. It will be added by the tooling based on the PR description.

Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <Divyanshu88999@gmail.com>
@DivyanshuX9 DivyanshuX9 force-pushed the fix/issue-63473-repl-asm-warning branch from 99b20d4 to 6a9412f Compare May 24, 2026 16:04
@Renegade334 Renegade334 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels May 25, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 25, 2026
@nodejs-github-bot

This comment has been minimized.

@nodejs-github-bot

This comment has been minimized.

@nodejs-github-bot

This comment has been minimized.

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Copilot AI review requested due to automatic review settings May 29, 2026 14:55
@Renegade334 Renegade334 force-pushed the fix/issue-63473-repl-asm-warning branch from 7b20b8a to 6a9412f Compare May 29, 2026 15:02
@Renegade334

Copy link
Copy Markdown
Member

Please don't make unnecessary commits once the PR is in its final stages, it invalidates the existing CI.

In addition, merge commits aren't compatible with the tooling (https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#step-5-rebase). I have reverted to the branch state prior to the merge.

The CI was blocking on nodejs/build#4345 which has only just been resolved.

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@Renegade334 Renegade334 added the commit-queue Add this label to land a pull request using GitHub Actions. label May 29, 2026
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels May 29, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/63491
βœ”  Done loading data for nodejs/node/pull/63491
----------------------------------- PR info ------------------------------------
Title      Fix REPL crash when V8 emits warnings during preview mode (Issue #63473) (#63491)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     DivyanshuX9:fix/issue-63473-repl-asm-warning -> nodejs:main
Labels     c++, author ready, needs-ci
Commits    1
 - errors: handle V8 warnings in DisallowJavascriptExecutionScope
Committers 1
 - Divyanshu Sharma <Divyanshu88999@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/63491
Fixes: https://github.com/nodejs/node/issues/63473
Reviewed-By: RenΓ© <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/63491
Fixes: https://github.com/nodejs/node/issues/63473
Reviewed-By: RenΓ© <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
--------------------------------------------------------------------------------
   ⚠  Commits were pushed since the last approving review:
   ⚠  - errors: handle V8 warnings in DisallowJavascriptExecutionScope
   β„Ή  This PR was created on Fri, 22 May 2026 17:18:29 GMT
   βœ”  Approvals: 3
   βœ”  - RenΓ© (@Renegade334): https://github.com/nodejs/node/pull/63491#pullrequestreview-4354330688
   βœ”  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/63491#pullrequestreview-4351460626
   βœ”  - Anna Henningsen (@addaleax): https://github.com/nodejs/node/pull/63491#pullrequestreview-4362601541
   βœ”  Last GitHub CI successful
   β„Ή  Last Full PR CI on 2026-05-29T15:07:05Z: https://ci.nodejs.org/job/node-test-pull-request/73827/
- Querying data for job/node-test-pull-request/73827/
βœ”  Build data downloaded
   βœ”  Last Jenkins CI successful
--------------------------------------------------------------------------------
   βœ”  Aborted `git node land` session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/26653249247

@Renegade334 Renegade334 added commit-queue Add this label to land a pull request using GitHub Actions. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels May 29, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 29, 2026
@nodejs-github-bot nodejs-github-bot merged commit 31965d6 into nodejs:main May 29, 2026
127 of 131 checks passed
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Landed in 31965d6

aduh95 pushed a commit that referenced this pull request May 30, 2026
Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <Divyanshu88999@gmail.com>
PR-URL: #63491
Fixes: #63473
Reviewed-By: RenΓ© <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
aduh95 pushed a commit that referenced this pull request May 30, 2026
Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <Divyanshu88999@gmail.com>
PR-URL: #63491
Fixes: #63473
Reviewed-By: RenΓ© <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
sxa pushed a commit to sxa/node that referenced this pull request Jun 18, 2026
Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <Divyanshu88999@gmail.com>
PR-URL: nodejs#63491
Fixes: nodejs#63473
Reviewed-By: RenΓ© <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
sxa pushed a commit that referenced this pull request Jun 18, 2026
Defer non-critical warnings to the next event loop iteration when
can_call_into_js() returns false. This prevents crashes when V8
emits warnings during REPL preview evaluation or other contexts
where JavaScript execution is temporarily forbidden.

When a warning is emitted inside DisallowJavascriptExecutionScope,
ProcessEmitWarningGeneric cannot be called immediately. Instead,
use env->SetImmediate() to queue the warning emission for after
the scope exits. This preserves full warning formatting, deprecation
codes, and --redirect-warnings routing.

Signed-off-by: Divyanshu Sharma <Divyanshu88999@gmail.com>
PR-URL: #63491
Fixes: #63473
Reviewed-By: RenΓ© <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
mwalbeck pushed a commit to mwalbeck/docker-cyberchef that referenced this pull request Jul 11, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [node](https://github.com/nodejs/node) | stage | minor | `24.16.0-trixie` β†’ `24.18.0-trixie` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.18.0`](https://github.com/nodejs/node/releases/tag/v24.18.0): 2026-06-23, Version 24.18.0 'Krypton' (LTS), @&#8203;richardlau prepared by @&#8203;sxa

[Compare Source](nodejs/node@v24.17.0...v24.18.0)

##### Notable Changes

- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)

##### Commits

- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`9ff36e40f0`](nodejs/node@9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#&#8203;62755](nodejs/node#62755)
- \[[`7c22ee23aa`](nodejs/node@7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#&#8203;63588](nodejs/node#63588)
- \[[`2551abdb4a`](nodejs/node@2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#&#8203;62761](nodejs/node#62761)
- \[[`e8a55ce9b1`](nodejs/node@e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#&#8203;62763](nodejs/node#62763)
- \[[`ae61cd68f3`](nodejs/node@ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`3d05a1d396`](nodejs/node@3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`f9d10a3f6b`](nodejs/node@f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`e431d93e9e`](nodejs/node@e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`56e2505e48`](nodejs/node@56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`3bac77f2a8`](nodejs/node@3bac77f2a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`1bff901b09`](nodejs/node@1bff901b09)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`4433fca3df`](nodejs/node@4433fca3df)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`b5cf01217a`](nodejs/node@b5cf01217a)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`ce84aef37d`](nodejs/node@ce84aef37d)] - **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan) [#&#8203;62883](nodejs/node#62883)
- \[[`26781689b0`](nodejs/node@26781689b0)] - **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) [#&#8203;62905](nodejs/node#62905)
- \[[`aeea8f4970`](nodejs/node@aeea8f4970)] - **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) [#&#8203;62706](nodejs/node#62706)
- \[[`407cf91656`](nodejs/node@407cf91656)] - **crypto**: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) [#&#8203;62626](nodejs/node#62626)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b46d52b283`](nodejs/node@b46d52b283)] - **crypto**: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) [#&#8203;62499](nodejs/node#62499)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`61826df455`](nodejs/node@61826df455)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#&#8203;63531](nodejs/node#63531)
- \[[`16d2fd3c07`](nodejs/node@16d2fd3c07)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#&#8203;63280](nodejs/node#63280)
- \[[`3b8330deda`](nodejs/node@3b8330deda)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#&#8203;62576](nodejs/node#62576)
- \[[`141de35399`](nodejs/node@141de35399)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#&#8203;63201](nodejs/node#63201)
- \[[`b76bfcd4fa`](nodejs/node@b76bfcd4fa)] - **deps**: upgrade npm to 11.16.0 (npm team) [#&#8203;63602](nodejs/node#63602)
- \[[`4ec142314c`](nodejs/node@4ec142314c)] - **deps**: SQLite: cherry-pick [`b869ed6`](nodejs/node@b869ed6) (Junsu Han) [#&#8203;63525](nodejs/node#63525)
- \[[`19e8ce1c36`](nodejs/node@19e8ce1c36)] - **deps**: upgrade npm to 11.15.0 (npm team) [#&#8203;63463](nodejs/node#63463)
- \[[`8a264260e2`](nodejs/node@8a264260e2)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#&#8203;63217](nodejs/node#63217)
- \[[`50c8ff3f94`](nodejs/node@50c8ff3f94)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#&#8203;62811](nodejs/node#62811)
- \[[`6e56f01c4b`](nodejs/node@6e56f01c4b)] - **deps**: V8: cherry-pick [`435a2cd`](nodejs/node@435a2cdf664c) (Matthias Liedtke) [#&#8203;63136](nodejs/node#63136)
- \[[`3ba813b242`](nodejs/node@3ba813b242)] - **deps**: cherry-pick [libuv/libuv@`a43e543`](libuv/libuv@a43e543) (Ali Hassan) [#&#8203;63222](nodejs/node#63222)
- \[[`2390e3a5ac`](nodejs/node@2390e3a5ac)] - **doc**: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) [#&#8203;63650](nodejs/node#63650)
- \[[`52a1c18374`](nodejs/node@52a1c18374)] - **doc**: update `git node land` instructions for security releases (Antoine du Hamel) [#&#8203;63586](nodejs/node#63586)
- \[[`3e6b4da037`](nodejs/node@3e6b4da037)] - **doc**: drop --experimental from --permission (Rafael Gonzaga) [#&#8203;63583](nodejs/node#63583)
- \[[`84d05163b9`](nodejs/node@84d05163b9)] - **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga) [#&#8203;63479](nodejs/node#63479)
- \[[`7da2a4450e`](nodejs/node@7da2a4450e)] - **doc**: fix URL postMessage example in worker\_threads (Kit Dallege) [#&#8203;62203](nodejs/node#62203)
- \[[`3d79bd8b29`](nodejs/node@3d79bd8b29)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#&#8203;63515](nodejs/node#63515)
- \[[`4f4174aace`](nodejs/node@4f4174aace)] - **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) [#&#8203;63511](nodejs/node#63511)
- \[[`388323ca4b`](nodejs/node@388323ca4b)] - **doc**: fix double space in modules.md (Daijiro Wachi) [#&#8203;63512](nodejs/node#63512)
- \[[`5258ccc058`](nodejs/node@5258ccc058)] - **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi) [#&#8203;63453](nodejs/node#63453)
- \[[`43e83e6507`](nodejs/node@43e83e6507)] - **doc**: fix typo in deprecations (Daijiro Wachi) [#&#8203;63434](nodejs/node#63434)
- \[[`f05a61d54c`](nodejs/node@f05a61d54c)] - **doc**: remove unsupported template type from v8.md (RenΓ©) [#&#8203;63410](nodejs/node#63410)
- \[[`c39d5fc820`](nodejs/node@c39d5fc820)] - **doc**: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) [#&#8203;62696](nodejs/node#62696)
- \[[`398261f911`](nodejs/node@398261f911)] - **doc**: remove the bi-monthly contributor spotlight section (Claudio Wunder) [#&#8203;62734](nodejs/node#62734)
- \[[`fd9e14c405`](nodejs/node@fd9e14c405)] - **doc**: update http2's `push` and `trailers` events with `rawHeaders` param (YuSheng Chen) [#&#8203;63259](nodejs/node#63259)
- \[[`b943ce6933`](nodejs/node@b943ce6933)] - **doc**: remove inactive members from Triagers list (Antoine du Hamel) [#&#8203;63329](nodejs/node#63329)
- \[[`4b9cdfc022`](nodejs/node@4b9cdfc022)] - **doc**: reference correct function in Module docs (Robin Malfait) [#&#8203;63247](nodejs/node#63247)
- \[[`bed84b6df2`](nodejs/node@bed84b6df2)] - **doc**: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) [#&#8203;63211](nodejs/node#63211)
- \[[`32ea70569b`](nodejs/node@32ea70569b)] - **doc**: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) [#&#8203;63187](nodejs/node#63187)
- \[[`4627bcfd82`](nodejs/node@4627bcfd82)] - **doc**: run license-builder (github-actions\[bot]) [#&#8203;63232](nodejs/node#63232)
- \[[`28eba71845`](nodejs/node@28eba71845)] - **doc**: add large pull requests contributing guide (Matteo Collina) [#&#8203;62829](nodejs/node#62829)
- \[[`2648efd438`](nodejs/node@2648efd438)] - **doc**: remove unnecessary `<!-- eslint-` magic comments (Antoine du Hamel) [#&#8203;63200](nodejs/node#63200)
- \[[`a95fc1f8fc`](nodejs/node@a95fc1f8fc)] - **doc**: clarify SEA platform support excludes darwin-x64 (MJSHANG) [#&#8203;63181](nodejs/node#63181)
- \[[`aaef29e2e1`](nodejs/node@aaef29e2e1)] - **doc**: update release steps when post-release fails (Rafael Gonzaga) [#&#8203;63131](nodejs/node#63131)
- \[[`7d81419cf2`](nodejs/node@7d81419cf2)] - **doc**: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) [#&#8203;63121](nodejs/node#63121)
- \[[`ececd80d81`](nodejs/node@ececd80d81)] - **doc**: document the latest-vX.x schema (Marco Ippolito) [#&#8203;63033](nodejs/node#63033)
- \[[`27c1c1d842`](nodejs/node@27c1c1d842)] - **doc**: remove list of versions in `BUILDING.md` (Antoine du Hamel) [#&#8203;63113](nodejs/node#63113)
- \[[`e369886a65`](nodejs/node@e369886a65)] - **doc,sqlite**: document entryPoint argument for loadExtension (Edy Silva) [#&#8203;63152](nodejs/node#63152)
- \[[`e4e5137cbd`](nodejs/node@e4e5137cbd)] - **errors**: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) [#&#8203;63491](nodejs/node#63491)
- \[[`6d1f6048d2`](nodejs/node@6d1f6048d2)] - **fs**: make `Date` properties on `Stats` enumerable (LiviaMedeiros) [#&#8203;63328](nodejs/node#63328)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`39f61fb06c`](nodejs/node@39f61fb06c)] - **http2**: emit session close before stream close (Matteo Collina) [#&#8203;63414](nodejs/node#63414)
- \[[`8a8f2127d1`](nodejs/node@8a8f2127d1)] - **http2**: validate non-link headers in writeEarlyHints (Matteo Collina) [#&#8203;62017](nodejs/node#62017)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`c05f38229b`](nodejs/node@c05f38229b)] - **lib**: cleanup stateless diffiehellman key handling (Filip Skokan) [#&#8203;62645](nodejs/node#62645)
- \[[`1c16b45d35`](nodejs/node@1c16b45d35)] - **lib**: refactor internal webidl converters (Filip Skokan) [#&#8203;62979](nodejs/node#62979)
- \[[`02f35d6dce`](nodejs/node@02f35d6dce)] - **lib**: define `kEnumerableProperty` atomically (Antoine du Hamel) [#&#8203;63609](nodejs/node#63609)
- \[[`12c51547ba`](nodejs/node@12c51547ba)] - **lib**: fix typos in esm loader comments (RonGamzu) [#&#8203;63465](nodejs/node#63465)
- \[[`9b03b84262`](nodejs/node@9b03b84262)] - **lib**: fix typo idenity => identity (Daijiro Wachi) [#&#8203;63112](nodejs/node#63112)
- \[[`a84e6b0567`](nodejs/node@a84e6b0567)] - **lib**: fixes validator message (Daijiro Wachi) [#&#8203;62823](nodejs/node#62823)
- \[[`11734166a8`](nodejs/node@11734166a8)] - **lib**: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) [#&#8203;63017](nodejs/node#63017)
- \[[`7cead61d21`](nodejs/node@7cead61d21)] - **meta**: flip mcollina emails in .mailmap (Matteo Collina) [#&#8203;63621](nodejs/node#63621)
- \[[`a08cfcfd35`](nodejs/node@a08cfcfd35)] - **meta**: label "source maps" PRs (Chengzhong Wu) [#&#8203;63591](nodejs/node#63591)
- \[[`d56e8d2512`](nodejs/node@d56e8d2512)] - **meta**: add `vfs` subsystem label (RenΓ©) [#&#8203;62331](nodejs/node#62331)
- \[[`6201cfe488`](nodejs/node@6201cfe488)] - **meta**: skip scheduled workflows on forks (Jamie Magee) [#&#8203;63565](nodejs/node#63565)
- \[[`f095e2bd31`](nodejs/node@f095e2bd31)] - **meta**: add additional gitignore entries (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`1ea52c444c`](nodejs/node@1ea52c444c)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63402](nodejs/node#63402)
- \[[`b1b2327611`](nodejs/node@b1b2327611)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63235](nodejs/node#63235)
- \[[`7d88e130a9`](nodejs/node@7d88e130a9)] - **meta**: ignore AI assistants files (Matteo Collina) [#&#8203;62612](nodejs/node#62612)
- \[[`a53b51df38`](nodejs/node@a53b51df38)] - **module**: load ESM helpers eagerly in the snapshot (Joyee Cheung) [#&#8203;63550](nodejs/node#63550)
- \[[`69df688fff`](nodejs/node@69df688fff)] - **module**: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) [#&#8203;62920](nodejs/node#62920)
- \[[`75d9a4ed47`](nodejs/node@75d9a4ed47)] - **node-api**: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) [#&#8203;62710](nodejs/node#62710)
- \[[`c20aa4c47b`](nodejs/node@c20aa4c47b)] - **quic**: add reusePort option to QuicEndpoint (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`26a30d8a7f`](nodejs/node@26a30d8a7f)] - **quic**: implement rate limiting for version nego and immediate close (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`0b534b5770`](nodejs/node@0b534b5770)] - **quic**: fixup linting issue after other changes (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`4b367cbe09`](nodejs/node@4b367cbe09)] - **quic**: remove unused binding variable in session.cc (James M Snell) [#&#8203;63177](nodejs/node#63177)
- \[[`2574bef5a6`](nodejs/node@2574bef5a6)] - **repl**: fix dedup comparing normalized line against raw history (Daijiro Wachi) [#&#8203;62886](nodejs/node#62886)
- \[[`30e71c7e49`](nodejs/node@30e71c7e49)] - **sqlite**: keep source database alive during backup (Matteo Collina) [#&#8203;62673](nodejs/node#62673)
- \[[`677ca7e76c`](nodejs/node@677ca7e76c)] - **src**: simplify OpenSSL feature gates (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`c863c75c39`](nodejs/node@c863c75c39)] - **src**: add BoringSSL EVP enumeration fallback (Filip Skokan) [#&#8203;63206](nodejs/node#63206)
- \[[`f6b2466921`](nodejs/node@f6b2466921)] - **src**: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) [#&#8203;62924](nodejs/node#62924)
- \[[`92d4f07dd2`](nodejs/node@92d4f07dd2)] - **src**: remove license headers for new node\_profiling files (Chengzhong Wu) [#&#8203;63066](nodejs/node#63066)
- \[[`8ac5d771c8`](nodejs/node@8ac5d771c8)] - **src**: split profiling helpers from util (Ilyas Shabi) [#&#8203;63008](nodejs/node#63008)
- \[[`85d1639495`](nodejs/node@85d1639495)] - **src**: remove TOCTOU race condition when encoding SAB-backed `Buffer`s (Antoine du Hamel) [#&#8203;63517](nodejs/node#63517)
- \[[`9473c5f05c`](nodejs/node@9473c5f05c)] - **src**: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) [#&#8203;63231](nodejs/node#63231)
- \[[`f35c91ee68`](nodejs/node@f35c91ee68)] - **src**: improve token return value check (James M Snell) [#&#8203;63483](nodejs/node#63483)
- \[[`26f677c1c5`](nodejs/node@26f677c1c5)] - **src**: expose `node::RegisterContext` to make a node managed context (Chengzhong Wu) [#&#8203;62322](nodejs/node#62322)
- \[[`275cf909b6`](nodejs/node@275cf909b6)] - **src,sqlite**: only pass `xFilter` when user provided a callback (Antoine du Hamel) [#&#8203;63516](nodejs/node#63516)
- \[[`287e02303f`](nodejs/node@287e02303f)] - **src,sqlite**: remove dead code (Edy Silva) [#&#8203;63204](nodejs/node#63204)
- \[[`58fa2ee189`](nodejs/node@58fa2ee189)] - **stream**: switch to internal `sleep` binding (Antoine du Hamel) [#&#8203;63611](nodejs/node#63611)
- \[[`f954ab3f1a`](nodejs/node@f954ab3f1a)] - **stream**: use data listener for compose forwarding (Trivikram Kamat) [#&#8203;63593](nodejs/node#63593)
- \[[`dc57173003`](nodejs/node@dc57173003)] - **stream**: fix Writable.toWeb() hang on synchronous drain (sangwook) [#&#8203;61197](nodejs/node#61197)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)
- \[[`cee279c5d6`](nodejs/node@cee279c5d6)] - **stream**: remove unnecessary check (Antoine du Hamel) [#&#8203;63030](nodejs/node#63030)
- \[[`61b20f60a3`](nodejs/node@61b20f60a3)] - **test**: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`a835363808`](nodejs/node@a835363808)] - **test**: update WPT for WebCryptoAPI to [`97bbc72`](nodejs/node@97bbc7247a) (Node.js GitHub Bot) [#&#8203;63417](nodejs/node#63417)
- \[[`a00297480b`](nodejs/node@a00297480b)] - **test**: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) [#&#8203;62389](nodejs/node#62389)
- \[[`5a95a2b055`](nodejs/node@5a95a2b055)] - **test**: shorten path in net pipe connect errors (Matteo Collina) [#&#8203;63405](nodejs/node#63405)
- \[[`5e8ff22d8f`](nodejs/node@5e8ff22d8f)] - **test**: remove test-node-output-v8-warning (Joyee Cheung) [#&#8203;63469](nodejs/node#63469)
- \[[`ee15380950`](nodejs/node@ee15380950)] - **test**: update test426-fixtures to [`9b9e225`](nodejs/node@9b9e225) (Node.js GitHub Bot) [#&#8203;63373](nodejs/node#63373)
- \[[`9e063d9bea`](nodejs/node@9e063d9bea)] - **test**: update WPT for url to [`e4a4672`](nodejs/node@e4a4672e9e) (Node.js GitHub Bot) [#&#8203;63372](nodejs/node#63372)
- \[[`503bee4b43`](nodejs/node@503bee4b43)] - **test**: deflake async-hooks statwatcher test (Trivikram Kamat) [#&#8203;63396](nodejs/node#63396)
- \[[`cccc7c32d8`](nodejs/node@cccc7c32d8)] - **test**: avoid test\_runner watch restart in spec snapshot (Trivikram Kamat) [#&#8203;63392](nodejs/node#63392)
- \[[`c89489258c`](nodejs/node@c89489258c)] - **test**: reduce watch mode restart flakiness (Trivikram Kamat) [#&#8203;63390](nodejs/node#63390)
- \[[`e4d5e2578e`](nodejs/node@e4d5e2578e)] - **test**: isolate rerun-failures state file under tmpdir (Chemi Atlow) [#&#8203;63449](nodejs/node#63449)
- \[[`362644a9ba`](nodejs/node@362644a9ba)] - **test**: wait for ok before initial break after restart (Yuya Inoue) [#&#8203;62807](nodejs/node#62807)
- \[[`c4058d0e05`](nodejs/node@c4058d0e05)] - **test**: disable Maglev in near-heap-limit worker test (Trivikram Kamat) [#&#8203;63398](nodejs/node#63398)
- \[[`214da630a7`](nodejs/node@214da630a7)] - **test**: deflake connection refused proxy tests (Trivikram Kamat) [#&#8203;63395](nodejs/node#63395)
- \[[`1d61a29876`](nodejs/node@1d61a29876)] - **test**: avoid repeated writes in watch helper (Trivikram Kamat) [#&#8203;63386](nodejs/node#63386)
- \[[`2004e25387`](nodejs/node@2004e25387)] - **test**: deflake watch mode worker test (Trivikram Kamat) [#&#8203;63384](nodejs/node#63384)
- \[[`d691cccfc1`](nodejs/node@d691cccfc1)] - **test**: relax test-memory-usage arrayBuffers check (inoway46) [#&#8203;63244](nodejs/node#63244)
- \[[`0ff6bf853c`](nodejs/node@0ff6bf853c)] - **test**: reduce flakiness of `different-registry-per-thread` (Antoine du Hamel) [#&#8203;63244](nodejs/node#63244)
- \[[`d9f4e8e503`](nodejs/node@d9f4e8e503)] - **test**: fix flaky test-watch-mode-inspect timeout (Matteo Collina) [#&#8203;63361](nodejs/node#63361)
- \[[`6d7cd50328`](nodejs/node@6d7cd50328)] - **test**: relax min assertion in test-performance-eventloopdelay (Marco) [#&#8203;63100](nodejs/node#63100)
- \[[`9dafe1d2d8`](nodejs/node@9dafe1d2d8)] - **test**: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) [#&#8203;62055](nodejs/node#62055)
- \[[`989b2de973`](nodejs/node@989b2de973)] - **test**: avoid initial-break wait in restart-message (inoway46) [#&#8203;62060](nodejs/node#62060)
- \[[`a072a25ee7`](nodejs/node@a072a25ee7)] - **test**: move FFI tests to `NATIVE_SUITES` (Antoine du Hamel) [#&#8203;63165](nodejs/node#63165)
- \[[`64efbfd878`](nodejs/node@64efbfd878)] - **test**: use ERM to destroy sqlite database handles after tests (RenΓ©) [#&#8203;63076](nodejs/node#63076)
- \[[`7dee66cd94`](nodejs/node@7dee66cd94)] - **test\_runner**: dont buffer unordered events in process isolation mode (Moshe Atlow) [#&#8203;63432](nodejs/node#63432)
- \[[`d257eec1e3`](nodejs/node@d257eec1e3)] - **test\_runner**: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) [#&#8203;63431](nodejs/node#63431)
- \[[`288c320e2f`](nodejs/node@288c320e2f)] - **test\_runner**: show replayed-from-attempt hint in spec reporter (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`904bdf5bb4`](nodejs/node@904bdf5bb4)] - **test\_runner**: preserve run duration when using test-rerun (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`df183d7bfa`](nodejs/node@df183d7bfa)] - **test\_runner**: avoid hanging on incomplete v8 frames (Ali Hassan) [#&#8203;62704](nodejs/node#62704)
- \[[`ec86c69726`](nodejs/node@ec86c69726)] - **test\_runner**: fix diagnostics channel context tracking (Moshe Atlow) [#&#8203;63283](nodejs/node#63283)
- \[[`94e5f63b83`](nodejs/node@94e5f63b83)] - **tls**: add unsupported renegotiation error (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`06d308fb61`](nodejs/node@06d308fb61)] - **tools**: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`2e4a0d0c91`](nodejs/node@2e4a0d0c91)] - **tools**: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot\[bot]) [#&#8203;63415](nodejs/node#63415)
- \[[`4c9666b366`](nodejs/node@4c9666b366)] - **tools**: skip commit-lint on backport pull requests (Marco) [#&#8203;63378](nodejs/node#63378)
- \[[`67d0c490a8`](nodejs/node@67d0c490a8)] - **tools**: fix skip of `test-internet` on forks (Antoine du Hamel) [#&#8203;63492](nodejs/node#63492)
- \[[`02f73c7cac`](nodejs/node@02f73c7cac)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#&#8203;63075](nodejs/node#63075)
- \[[`5d016d3241`](nodejs/node@5d016d3241)] - **tools**: update gyp-next to 0.22.2 (Node.js GitHub Bot) [#&#8203;63374](nodejs/node#63374)
- \[[`55af0f0edb`](nodejs/node@55af0f0edb)] - **tools**: fix test426 updater (Antoine du Hamel) [#&#8203;63271](nodejs/node#63271)
- \[[`d8475e167a`](nodejs/node@d8475e167a)] - **tools**: use different branch for tool updates on staging branches (Antoine du Hamel) [#&#8203;63110](nodejs/node#63110)
- \[[`c605df9e50`](nodejs/node@c605df9e50)] - **util**: remove unused functions (Antoine du Hamel) [#&#8203;63612](nodejs/node#63612)
- \[[`fe4540ebdb`](nodejs/node@fe4540ebdb)] - **util**: create hex style cache and fast path (Guilherme AraΓΊjo) [#&#8203;62999](nodejs/node#62999)

### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.16.0...v24.17.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

##### Commits

- \[[`9e4dfc7bba`](nodejs/node@9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
- \[[`cb2aed980c`](nodejs/node@cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
- \[[`a8a0d12875`](nodejs/node@a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#&#8203;62891](nodejs/node#62891)
- \[[`66e6203c1c`](nodejs/node@66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#&#8203;62891](nodejs/node#62891)
- \[[`dd627ced27`](nodejs/node@dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`684bae568f`](nodejs/node@684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`3a631e7f83`](nodejs/node@3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#&#8203;62656](nodejs/node#62656)
- \[[`cf44df3996`](nodejs/node@cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#&#8203;63703](nodejs/node#63703)
- \[[`138c70294b`](nodejs/node@138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
- \[[`be7e719c3f`](nodejs/node@be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
- \[[`cc7c11b4d1`](nodejs/node@cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
- \[[`9224427b92`](nodejs/node@9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
- \[[`cf85d54839`](nodejs/node@cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
- \[[`a1bbc24f96`](nodejs/node@a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
- \[[`e3723ff2d6`](nodejs/node@e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`a77af4867b`](nodejs/node@a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`31beb4f707`](nodejs/node@31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
- \[[`8e75c73f91`](nodejs/node@8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)

</details>

---

### Configuration

πŸ“… **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/488
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

V8 warnings crash process within DisallowJavascriptExecutionScope

5 participants