The known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers
has now been addressed and now returns uninitialized memory as documented in the Buffer.allocUnsafe
documentation.
Commits
[0a15ccf3f4] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162
[a1c7d1dac9] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #60205
This release marks the transition of Node.js 24.x into Long Term Support (LTS)
with the codename 'Krypton'. It will continue to receive updates through to
the end of April 2028.
Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 24.10.0 are included.
Known issue
An issue has been identified in the Node.js 24.x line with Buffer.allocUnsafe
unintentionally returning zero-filled buffers. This API is documented to return uninitialized memory.
The documented behavior will be restored in the next Node.js 24.x LTS release to bring
it back in line with previous releases. For more information, see #60423.
v24.10.0: 2025-10-08, Version 24.10.0 (Current), @RafaelGSS
OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by
allowing use of NIST's post-quantum cryptography standards for future-proofing
applications against quantum computing threats. The following post-quantum
algorithms are now available in node:crypto:
ML-KEM (FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard) through new crypto.encapsulate() and crypto.decapsulate() methods.
ML-DSA (FIPS 204, Module-Lattice-Based Digital Signature Standard) in the existing crypto.sign() and crypto.verify() methods.
The second substantial extension to the Web Cryptography API
(globalThis.crypto.subtle) was recently accepted for incubation by WICG.
The following algorithms and methods from this extension are now available in
the Node.js Web Cryptography API implementation:
Node.js execution argument support in single executable applications
The single executable application configuration now supports additional fields
to specify Node.js execution arguments and control how they can be extended when
the application is run.
execArgv takes an array of strings for the execution arguments to be used.
execArgvExtension takes one of the following values:
"none": No additional execution arguments are allowed.
"cli": Additional execution arguments can be provided via a special command-line flag --node-options="--flag1 --flag2=value" at run time.
"env" (default): Additional execution arguments can be provided via the NODE_OPTIONS environment variable at run time.
Node.js supports both source phase imports and instance phase imports to WebAssembly
modules and for WASM imports to JavaScript, in line with the current Phase 3
WebAssembly ESM Integration proposal.
The implementation and the specification are still subject to change.
node:http and node:https now support proxies. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY, https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the
environment variables, and proxy the requests sent through the built-in http/https
client accordingly.
To use global proxy support from the command line:
This API allows dynamically configuring CA certificates that will be used by the
Node.js TLS clients by default.
Once called, the provided certificates will become the default CA certificate list
returned by tls.getCACertificates('default') and used by TLS connections that
don't specify their own CA certificates.
To add system CA certificates to the default bundle (which includes the Mozilla
CA certificates):
The support for priority signaling has been removed in nghttp2, following its
deprecation in the RFC 9113.
As a consequence of this, priority signaling is deprecated on all release lines of Node.js,
and removed from Node.js 24 so we can include latest updates from nghttp2.
Contributed by Matteo Collina and Antoine du Hamel in #58293.
import.meta.main is now available
Boolean value available in ECMAScript modules, which can be used to detect
whether the current module was the entry point of the current process.
exportfunctionfoo(){return'Hello, world';}functionmain(){constmessage=foo();console.log(message);}if(import.meta.main)main();// `foo` can be imported from another module without possible side-effects from `main`
Contributed by Joe and Antoine du Hamel in #57804.
Other Notable Changes
[e13930bbe0] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
[984894b38c] - doc: deprecate util.isNativeError in favor of Error.isError (Miguel Marcondes Filho) #58262
[d261274b0f] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) #58564
[510872a522] - (SEMVER-MINOR)doc: graduate Symbol.dispose/asyncDispose from experimental (James M Snell) #58467
[6f4c9dd423] - (SEMVER-MINOR)fs: add autoClose option to FileHandle readableWebStream (James M Snell) #58548
[32efb63242] - http: deprecate instantiating classes without new (Yagiz Nizipli) #58518
We’re excited to announce the release of Node.js 24! This release brings
several significant updates, including the upgrade of the V8 JavaScript
engine to version 13.6 and npm to version 11. Starting with
Node.js 24, support for MSVC has been removed, and ClangCL is now required
to compile Node.js on Windows. The AsyncLocalStorage API now uses AsyncContextFrame by default, and URLPattern is available globally.
These changes, along with many other improvements, continue to push the
platform forward.
As a reminder, Node.js 24 will enter long-term support (LTS) in October,
but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this
latest release and evaluate their potential impact on your applications.
Notable Changes
V8 13.6
The V8 engine is updated to version 13.6, which includes several new
JavaScript features:
The V8 update was a contribution by Michaël Zasso in #58070.
npm 11
Node.js 24 comes with npm 11, which includes several improvements and new
features. This update brings enhanced performance, improved security features,
and better compatibility with modern JavaScript packages.
The npm update was a contribution by the npm team in #56274.
AsyncLocalStorage defaults to AsyncContextFrame
AsyncLocalStorage now uses AsyncContextFrame by default, which provides a
more efficient implementation of asynchronous context tracking.
This change improves performance and makes the API more robust for advanced
use cases.
This change was a contribution by Stephen Belanger in #55552.
URLPattern as a global
The URLPattern
API is now exposed on the global object, making it easier to use without
explicit imports. This API provides a powerful pattern matching system for URLs,
similar to how regular expressions work for strings.
This feature was a contribution by Jonas Badalič in #56950.
Permission Model Improvements
The experimental Permission Model introduced in Node.js 20 has been improved,
and the flag has been changed from --experimental-permission to simply --permission, indicating its increasing stability and readiness for broader
adoption.
This change was a contribution by Rafael Gonzaga in #56240.
Test Runner Enhancements
The test runner module now automatically waits for subtests to finish,
eliminating the need to manually await test promises. This makes writing tests
more intuitive and reduces common errors related to unhandled promises.
The test runner improvements were contributions by Colin Ihrig in #56664.
Undici 7
Node.js 24 includes Undici 7, which brings numerous improvements to the
HTTP client capabilities, including better performance and support for newer
HTTP features.
Deprecations and Removals
Several APIs have been deprecated or removed in this release:
Runtime deprecation of url.parse() - use the WHATWG URL API instead (#55017)
Removal of deprecated tls.createSecurePair (#57361)
This PR contains the following updates:
20→24Release Notes
nodejs/node (lxc-node)
v24.12.0: 2025-12-10, Version 24.12.0 'Krypton' (LTS), @targosCompare Source
Notable Changes
1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #599828987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #6060092c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #5879792ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #5971105d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #59807Commits
e4a23a35ac] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #60603b6114ae5c9] - benchmark: add per-suite setup option (Joyee Cheung) #60574ac8e90af7c] - buffer: speed up concat via TypedArray#set (Gürgün Dayıoğlu) #60399acbc8ca13e] - build: upgrade Python linter ruff, add rules ASYNC,PERF (Christian Clauss) #59984f97a609a07] - console: optimize single-string logging (Gürgün Dayıoğlu) #604226cd9bdc580] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #606620fafe24d9b] - crypto: fix argument validation in crypto.timingSafeEqual fast path (Joyee Cheung) #6053854421e0419] - debugger: fix event listener leak in the run command (Joyee Cheung) #60464c361a628b4] - deps: V8: cherry-pick72b0e27(pthier) #60732c70f4588dd] - deps: V8: cherry-pick6bb32bd(Erik Corry) #60732881fe784c5] - deps: V8: cherry-pick0dd2318(Erik Corry) #60732457c33efcc] - deps: V8: cherry-pickdf20105(Erik Corry) #607320bf45a829c] - deps: V8: backporte5dbbba(Darshan Sen) #605244993bdc476] - deps: V8: cherry-pick5ba9200(Juan José Arboleda) #606201e9abe0078] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #608423f704ed08f] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #6064304e360fdb1] - deps: V8: cherry-pick06bf293,146962dande0fb10b(Michaël Zasso) #60713fcbd8dbbde] - deps: patch V8 to 13.6.233.17 (Michaël Zasso) #6071228e9433f39] - deps: V8: cherry-pick8735658(Joyee Cheung) #600693cac85b243] - deps: V8: backport2e4c5cf(Michaël Zasso) #606541daece1970] - deps: call OPENSSL_free after ANS1_STRING_to_UTF8 (Rafael Gonzaga) #606095f55a9c9ea] - deps: nghttp2: revert7784fa9(Antoine du Hamel) #597901d9e7c1f4d] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #597903140415068] - deps: update simdjson to 4.1.0 (Node.js GitHub Bot) #60542d911f9f1b8] - deps: update amaro to 1.1.5 (Node.js GitHub Bot) #60541daaaf04a32] - deps: V8: cherry-pick2abc613(Richard Lau) #60177b4f63ee5f8] - doc: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) #60650effcf7a8ab] - doc: fix link in--env-file=filesection (N. Bighetti) #605637011736703] - doc: fix linter issues (Antoine du Hamel) #606365cc79d8945] - doc: add missing history entry forsqlite.md(Antoine du Hamel) #60607bbc649057c] - doc: correct values/references for buffer.kMaxLength (René) #60305ea7ecb517b] - doc: recommend events.once to manage 'close' event (Dan Fabulich) #6001758bff04cc2] - doc: highlight module loading difference between import and require (Ajay A) #59815bbcbff9b4d] - doc: add CJS code snippets insqlite.md(Allon Murienik) #60395f8af33d5a7] - doc: fix typo inprocess.unrefdocumentation (우혁) #59698df105dc351] - doc: add some entries toglossary.md(Mohataseem Khan) #592774955cb2b5b] - doc: improve agent.createConnection docs for http and https agents (JaeHo Jang) #582056283bb5cc9] - doc: fix pseudo code in modules.md (chirsz) #57677d5059ea537] - doc: add missing variable in code snippet (Koushil Mankali) #55478900de373ae] - doc: add missing word insingle-executable-applications.md(Konstantin Tsabolov) #538645735044c8b] - doc: fix typo in http.md (Michael Solomon) #593542dee6df831] - doc: update devcontainer.json and add documentation (Joyee Cheung) #604728f2d98d7d2] - doc: add haramj as triager (Haram Jeong) #60348bbd7fdfff4] - doc: clarify require(esm) description (dynst) #6052033ad11a764] - doc: instantiate resolver object (Donghoon Nam) #6047681a61274f3] - doc: correct module loading descriptions (Joyee Cheung) #6034677911185fe] - doc: clarify --use-system-ca support status (Joyee Cheung) #60340185f6e95d9] - doc,crypto: link keygen to supported types (Filip Skokan) #60585772d6c6608] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708ad98e11ac2] - esm: use sync loading/resolving on non-loader-hook thread (Joyee Cheung) #603801a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #597785703ce68bc] - http: replace startsWith with strict equality (btea) #593942b696ffad8] - http2: add diagnostics channels for client stream request body (Darshan Sen) #60480dbdf4cb5a5] - inspector: inspect HTTP response body (Chengzhong Wu) #605729dc9a7d33d] - inspector: support inspecting HTTP/2 request and response bodies (Darshan Sen) #6048389fa2befe4] - inspector: fix crash when receiving non json message (Shima Ryuhei) #60388ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #5998233baaf42c8] - lib: replace global SharedArrayBuffer constructor with bound method (Renegade334) #60497b047586a08] - meta: bump actions/download-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #6053264192176d7] - meta: bump actions/upload-artifact from 4.6.2 to 5.0.0 (dependabot[bot]) #60531af6d4a6b9b] - meta: bump github/codeql-action from 3.30.5 to 4.31.2 (dependabot[bot]) #60533c17276fd24] - meta: bump actions/setup-node from 5.0.0 to 6.0.0 (dependabot[bot]) #605296e8b52a7dc] - meta: bump actions/stale from 10.0.0 to 10.1.0 (dependabot[bot]) #60528a12658595b] - meta: callcreate-release-post.ymlpost release (Aviv Keller) #603668987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #6060036da413663] - module: fix directory option in the enableCompileCache() API (Joyee Cheung) #5993192c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953545162b0d4] - node-api: use local files for instanceof test (Vladimir Morozov) #60190526c011d89] - perf_hooks: fix stack overflow error (Antoine du Hamel) #600841de0476939] - perf_hooks: move non-standard performance properties to perf_hooks (Chengzhong Wu) #6037007ec1239ef] - repl: fix pasting after moving the cursor to the left (Ruben Bridgewater) #60470b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217273c9661fd] - sqlite,doc: fix StatementSync section (Edy Silva) #60474d92ec21a4c] - src: use CP_UTF8 for wide file names on win32 (Fedor Indutny) #60575baef0468ed] - src: move Node-API version detection to where it is used (Anna Henningsen) #60512e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #58797566add0b19] - src: avoid C strings in more C++ exception throws (Anna Henningsen) #605929b796347c1] - src: add internal binding for constructing SharedArrayBuffers (Renegade334) #604973b01cbb411] - src: movenapi_addon_register_functonode_api_types.h(Anna Henningsen) #6051202fb7f4ecb] - src: remove unconditional NAPI_EXPERIMENTAL in node.h (Chengzhong Wu) #60345bd09ae24e4] - src: clean up generic counter implementation (Anna Henningsen) #60447cd6bf51dbd] - src: add enum handle for ToStringHelper + formatting (Burkov Egor) #5682992ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #59711ac3dbe48f7] - stream: don't try to read more if reading (Robert Nagy) #60454790288a93b] - test: ensure assertions are reachable intest/internet(Antoine du Hamel) #605130a85132989] - test: fix status when compiled without inspector (Antoine du Hamel) #602892f57673172] - test: deflake test-perf-hooks-timerify-histogram-sync (Joyee Cheung) #6063909726269de] - test: apply a delay towatch-mode-kill-signaltests (Joyee Cheung) #6061045537b9562] - test: async iife in repl (Tony Gorez) #448784ca81f101d] - test: parallelize sea tests when there's enough disk space (Joyee Cheung) #60604ea71e96191] - test: only show overridden env in child process failures (Joyee Cheung) #6055606b2e348c7] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60498de9c8cb670] - test: ensure assertions are reachable intest/es-module(Antoine du Hamel) #6050175bc40fced] - test: ensure assertions are reached on more tests (Antoine du Hamel) #604851a6084cfd3] - test: ensure assertions are reached on more tests (Antoine du Hamel) #605002c651c90cf] - test: split test-perf-hooks-timerify (Joyee Cheung) #605686e8b5f7345] - test: add more logs to test-esm-loader-hooks-inspect-wait (Joyee Cheung) #604669dea7ffa30] - test: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) #605650b3c3b710a] - test: split test-esm-wasm.js (Joyee Cheung) #60491a15b795b34] - test: correct conditional secure heap flags test (Shelley Vohr) #6038538b77b3a44] - test: fix flaky test-watch-mode-kill-signal-* (Joyee Cheung) #60443e8d7598057] - test: capture stack trace in debugger timeout errors (Joyee Cheung) #60457674befeb81] - test: ensure assertions are reachable intest/sequential(Antoine du Hamel) #60412952c08a735] - test: ensure assertions are reachable in more folders (Antoine du Hamel) #60411bbca57584b] - test: split test-runner-watch-mode (Joyee Cheung) #60391e78e0cf6e7] - test: move test-runner-watch-mode helper into common (Joyee Cheung) #6039184576ef021] - test: ensure assertions are reachable intest/addons(Antoine du Hamel) #601421659078c11] - test: ignore EPIPE errors in https proxy invalid URL test (Joyee Cheung) #6026979ffee80ec] - test: ensure assertions are reachable intest/client-proxy(Antoine du Hamel) #60175e5a812243a] - test: ensure assertions are reachable intest/async-hooks(Antoine du Hamel) #60150e924fd72e3] - test,crypto: handle a few more BoringSSL tests (Shelley Vohr) #59030a55ac11611] - test,crypto: update x448 and ed448 expectation when on boringssl (Shelley Vohr) #6038755d5e9ec73] - tls: fix leak on invalid protocol method (Shelley Vohr) #604275763c96e7c] - tools: replace invalid expression in dependabot config (Riddhi) #60649b6e21b47d7] - tools: skip unaffected GHA jobs for changes intest/internet(Antoine du Hamel) #60517999664c76d] - tools: do not use short hashes for deps versioning to avoid collision (Antoine du Hamel) #60407ada856d0fb] - tools: only add test reporter args when node:test is used (Joyee Cheung) #605511812c56bb3] - tools: fix update-icu script (Michaël Zasso) #60521747040438a] - tools: fix linter for semver-major release proposals (Antoine du Hamel) #60481f170551e40] - tools: fix failing release-proposal linter for LTS transitions (Antoine du Hamel) #604652db4ea0ce4] - tools: remove undici from daily wpt.fyi job (Filip Skokan) #604442a85aa4e7b] - tools: add lint rule to ensure assertions are reached (Antoine du Hamel) #6012548299ef5fb] - tools,doc: update JavaScript primitive types to match MDN Web Docs (JustApple) #605817ec04cf936] - util: fix stylize of special properties in inspect (Ge Gao) #6047905d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #59807884fe884a1] - vm: hint module identifier in instantiate errors (Chengzhong Wu) #60199a2caf19f70] - watch: fix interaction with multiple env files (Marco Ippolito) #60605v24.11.1: 2025-11-11, Version 24.11.1 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
The known issue relating to
Buffer.allocUnsafeincorrectly zero-filling buffershas now been addressed and now returns uninitialized memory as documented in the
Buffer.allocUnsafedocumentation.
Commits
0a15ccf3f4] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162a1c7d1dac9] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #6020599e2acf46b] - benchmark: add vm.SourceTextModule benchmark (Joyee Cheung) #59396c01c72b407] - benchmark: use non-deprecated WriteUtf8V2 method (Michaël Zasso) #60173a42dbd138e] - build: ibmi follow aix visibility (SRAVANI GUNDEPALLI) #603605673a54a5d] - build: use call command when calling python configure (Jacob Nichols) #60098c67cb727cb] - build: build v8 with -fvisibility=hidden -fvisibility-inlines-hidden (Joyee Cheung) #56290b03f7b93b1] - build: remove V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE defs (Joyee Cheung) #602962505568531] - build, src: fix include paths for vtune files (Rahul) #5999995330b036f] - crypto: update root certificates to NSS 3.116 (Node.js GitHub Bot) #59956c221d892ef] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #60550bc00aa4c77] - deps: update simdjson to 4.0.7 (Node.js GitHub Bot) #59883d03b89ec53] - deps: update corepack to 0.34.1 (Node.js GitHub Bot) #60314b7882090de] - deps: update inspector_protocol toaf7f5a8(Node.js GitHub Bot) #603127007f9dd65] - deps: update googletest to279f847(Node.js GitHub Bot) #60219a56aa9ffa8] - deps: upgrade npm to 11.6.2 (npm team) #601680bf8952721] - doc: mention more codemods indeprecations.md(Augustin Mauroy) #602432473ca77f6] - doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny() (Jimmy Leung) #5889939ddd8522e] - doc: useanyforworker_threads.Worker'error' event argumenterr(Jonas Geiler) #60300eaa825fd97] - doc: update decorator documentation to reflect actual policy (Muhammad Salman Aziz) #60288a744e42282] - doc: document wildcard supported by tools/test.py (Joyee Cheung) #60265ec0d5beb09] - doc: add --heap-snapshot-on-oom to useful v8 flag (jakecastelli) #6026013da0df12a] - doc: fixblob.bytes()heading level (XTY) #602528e771632b7] - doc: fix not working code example in vm docs (Artur Gawlik) #6022470c2080bff] - doc: improve code snippet alternative of url.parse() using WHATWG URL (Steven) #60209beadcf176e] - doc:createSQLTagStore->createTagStore(Aviv Keller) #60182b0da3b9c6a] - doc: use markdown when branch-diff major release (Rafael Gonzaga) #60179688115aa6b] - doc: update teams in collaborator-guide.md and add links (Bart Louwers) #60065923082a064] - doc: disambiguate top-levelworker_threadsmodule exports (René) #598907be4330870] - doc: add known issue to v24.11.0 release notes (Richard Lau) #604674d8f62aeaf] - doc, module: change async customization hooks to experimental (Gerhard Stöbich) #60302d86a118bbd] - http: lazy allocate cookies array (Robert Nagy) #597348c256d4139] - http: fix http client leaky with double response (theanarkh) #60062265e9d59fa] - http2: rename variable to additionalPseudoHeaders (Tobias Nießen) #6020865bec037e2] - http2: do not crash on mismatched ping buffer length (René) #601359b83ef53b7] - inspector: add network payload buffer size limits (Chengzhong Wu) #6023603ac05c458] - inspector: support handshake response for websocket inspection (Shima Ryuhei) #60225aa04f06190] - lib: fix typo in createBlobReaderStream (SeokHun) #601325aea1a429e] - lib: fix constructor in _errnoException stack tree (SeokHun) #601564f7745acc7] - lib: fix typo in QuicSessionStats (SeokHun) #60155f8725861ea] - lib: remove redundant destroyHook checks (Gürgün Dayıoğlu) #60120696c20bf3f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #6032590434ff99a] - meta: loop userland-migrations in deprecations (Chengzhong Wu) #60299ffbc0ae60a] - module: refactor and clarify async loader hook customizations (Joyee Cheung) #602786ed6062f7d] - module: handle null source from async loader hooks in sync hooks (Joyee Cheung) #59929a2871baed2] - msi: fix WiX warnings (Stefan Stojanovic) #602516199541d67] - src: fix timing of snapshot serialize callback (Joyee Cheung) #6043413b687959a] - src: add COUNT_GENERIC_USAGE utility for tests (Joyee Cheung) #60434a587623b4f] - src: conditionally disable source phase imports by default (Shelley Vohr) #60364e483267995] - src: use cached primordials_string (Sohyeon Kim) #602554c9a64fbaf] - src: replace Environment::GetCurrent with args.GetIsolate (Sohyeon Kim) #60256eb8a0493d1] - src: initial enablement of IsolateGroups (James M Snell) #60254463c6450cf] - src: useUtf8ValueandTwoByteValueinstead of V8 helpers (Anna Henningsen) #60244b370e02789] - src: add a default branch for module phase (Chengzhong Wu) #602614e1c5c5601] - src: make additional cleanups in node locks impl (James M Snell) #60061f00d4c10fc] - src: update locks to use DictionaryTemplate (James M Snell) #600611c8716e97c] - test: increase debugger waitFor timeout on macOS (Chengzhong Wu) #6036717b4f38e9c] - test: put helper in test-runner-output into common (Joyee Cheung) #6033043b9ea8389] - test: fix small compile warning in test_network_requests_buffer.cc (xiaocainiao633) #6028138a62980ad] - test: split test-runner-watch-mode-kill-signal (Joyee Cheung) #6029834e4c8c84f] - test: fix incorrect calculation in test-perf-hooks.js (Joyee Cheung) #602714481feb17b] - test: parallelize test-without-async-context-frame correctly (Joyee Cheung) #6027391ea9b06e0] - test: skip sea tests on x64 macOS (Joyee Cheung) #60250cedba09e60] - test: move sea tests into test/sea (Joyee Cheung) #60250635af55e12] - Revert "test: ensure message event fires in worker message port test" (Luigi Pinca) #6012668f678028e] - test: skip tests that cause timeouts on IBM i (SRAVANI GUNDEPALLI) #60148cc3a70598c] - test: deflake test-fs-promises-watch-iterator (Luigi Pinca) #600603d784dd766] - test: prepare junit file attribute normalization (sangwook) #5943284974d97ad] - test: skip failing test on macOS 15.7+ (Antoine du Hamel) #60419fabf8e4975] - test,crypto: fix conditional SHA3-* skip on BoringSSL (Filip Skokan) #603798faa494bf2] - test,crypto: sha3 algorithms aren't supported with BoringSSL (Shelley Vohr) #60374538a00c0f6] - test,doc: skip --max-old-space-size-percentage on 32-bit platforms (Asaf Federman) #601449ac5dbb694] - test_runner: use module.registerHooks in module mocks (Joyee Cheung) #60326f6ff6e7166] - test_runner: fix suite timeout (Moshe Atlow) #59853455bfeb52d] - test_runner: add junit file attribute support (sangwook) #59432223c5e105d] - tools: update gyp-next to 0.20.5 (Node.js GitHub Bot) #603132949408fc1] - tools: limit inspector protocol PR title length (Chengzhong Wu) #60324b36a898650] - tools: fix inspector_protocol updater (Chengzhong Wu) #60277d60f002b62] - tools: optimize wildcard execution in tools/test.py (Joyee Cheung) #602669d4e422419] - tools: add inspector_protocol updater (Chengzhong Wu) #602452f93a9894f] - tools: use cooldown property correctly (Rafael Gonzaga) #601349468ade95d] - typings: add missing properties and method in Worker (Woohyun Sung) #60257f611ec0a9e] - typings: add missing properties in HTTPParser (Woohyun Sung) #60257301c1347a1] - typings: delete undefined property in ConfigBinding (Woohyun Sung) #6025780fdb3d39b] - typings: add buffer internalBinding typing (방진혁) #601638cb3b77039] - util: use more defensive code when inspecting error objects (Antoine du Hamel) #60139748d4f6430] - util: mark special properties when inspecting them (Ruben Bridgewater) #601316183a759d7] - vm: make vm.Module.evaluate() conditionally synchronous (Joyee Cheung) #602054b8506628f] - win: upgrade Visual Studio workload from 2019 to 2022 (Jiawen Geng) #60318v24.11.0: 2025-10-28, Version 24.11.0 'Krypton' (LTS), @richardlauCompare Source
Notable Changes
This release marks the transition of Node.js 24.x into Long Term Support (LTS)
with the codename 'Krypton'. It will continue to receive updates through to
the end of April 2028.
Other than updating metadata, such as the
process.releaseobject, to reflectthat the release is LTS, no further changes from Node.js 24.10.0 are included.
Known issue
An issue has been identified in the Node.js 24.x line with
Buffer.allocUnsafeunintentionally returning zero-filled buffers. This API is
documented to return uninitialized memory.
The documented behavior will be restored in the next Node.js 24.x LTS release to bring
it back in line with previous releases. For more information, see
#60423.
v24.10.0: 2025-10-08, Version 24.10.0 (Current), @RafaelGSSCompare Source
Notable Changes
31bb476895] - (SEMVER-MINOR) console: allow per-streaminspectOptionsoption (Anna Henningsen) #600823b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #5998018c79d9e1c] - (SEMVER-MINOR) sqlite: create authorization api (Guilherme Araújo) #59928Commits
e8cff3d51e] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #5987203294252ab] - benchmark: update count to n in permission startup (Bruno Rodrigues) #598723c8a609d9b] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #598727b2032b13e] - benchmark: adjust dgram offset-length len values (Bruno Rodrigues) #59708552d887aee] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #5970831bb476895] - (SEMVER-MINOR) console: allow per-streaminspectOptionsoption (Anna Henningsen) #600820bf022d4c0] - console,util: improve array inspection performance (Ruben Bridgewater) #6003704d568e591] - deps: V8: cherry-pickf93055f(Olivier Flückiger) #60105621058b3bf] - deps: update archs files for openssl-3.5.4 (Node.js GitHub Bot) #6010181b3009fe6] - deps: upgrade openssl sources to openssl-3.5.4 (Node.js GitHub Bot) #60101dc44c9f349] - deps: upgrade npm to 11.6.1 (npm team) #60012ec0f137198] - deps: update ada to 3.3.0 (Node.js GitHub Bot) #60045f490f91874] - deps: update amaro to 1.1.4 (pmarchini) #60044de7a7cd0d7] - deps: update ada to 3.2.9 (Node.js GitHub Bot) #59987a533e5b5db] - doc: add automated migration info to deprecations (Augustin Mauroy) #600227fb8fe4875] - doc: fix typo on child_process.md (Angelo Gazzola) #6011424c1ef9846] - doc: remove optional title prefixes (Aviv Keller) #6008708b9eb8e19] - doc: mark.envfiles support as stable (Santeri Hiltunen) #5992566d90b8063] - doc: mention reverse proxy and include simple example (Steven) #5973614aa1119cb] - doc: provide alternative tourl.parse()using WHATWG URL (Steven) #59736f9412324f6] - doc: fix typo of built-in module specifier in worker_threads (Deokjin Kim) #5999264e738a342] - doc,crypto: reorder ML-KEM in the asymmetric key types table (Filip Skokan) #600671b25008b41] - http: improve writeEarlyHints by avoiding for-of loop (Haram Jeong) #5995835f9b6b28f] - inspector: improve batch diagnostic channel subscriptions (Chengzhong Wu) #600093b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #59980c495e1fe57] - lib: optimize priority queue (Gürgün Dayıoğlu) #600396be31fb9f3] - lib: implement passive listener behavior per spec (BCD1me) #59995c5e4aa763b] - meta: bump actions/setup-python from 5.6.0 to 6.0.0 (dependabot[bot]) #6009050fa1f4a76] - meta: bump ossf/scorecard-action from 2.4.2 to 2.4.3 (dependabot[bot]) #60096def4ce976c] - meta: bump actions/cache from 4.2.4 to 4.3.0 (dependabot[bot]) #6009524b5abc0e9] - meta: bump step-security/harden-runner from 2.12.2 to 2.13.1 (dependabot[bot]) #600948ccf2b0b34] - meta: bump actions/setup-node from 4.4.0 to 5.0.0 (dependabot[bot]) #6009378580147ef] - meta: bump actions/stale from 9.1.0 to 10.0.0 (dependabot[bot]) #60092705686b5c4] - meta: bump codecov/codecov-action from 5.5.0 to 5.5.1 (dependabot[bot]) #60091423a6bc744] - meta: bump github/codeql-action from 3.30.0 to 3.30.5 (dependabot[bot]) #600899d9bd0fb4f] - meta: move Michael to emeritus (Michael Dawson) #60070dbeee55824] - module: use sync cjs when importing cts (Marco Ippolito) #60072a722f677ac] - perf_hooks: fix histogram fast call signatures (Renegade334) #59600b3295b8353] - process: fix wrong asyncContext under unhandled-rejections=strict (Shima Ryuhei) #60103cff4a7608a] - process: fix defaultenvforprocess.execve(Richard Lau) #60029cd034e927f] - process: fix hrtime fast call signatures (Renegade334) #5960018c79d9e1c] - (SEMVER-MINOR) sqlite: create authorization api (Guilherme Araújo) #59928d949222043] - sqlite: replaceToLocalCheckedand improve filter error handling (Edy Silva) #600286417dc879e] - src: bring permissions macros in line with general C/C++ standards (Anna Henningsen) #60053e273c2020c] - src: update contextify to use DictionaryTemplate (James M Snell) #600595f9ff60664] - src: removeAnalyzeTemporaryDtorsoption from .clang-tidy (iknoom) #600089db54adccc] - src: update cares_wrap to use DictionaryTemplates (James M Snell) #60033fc0ceb7b82] - src: correct the error handling in StatementExecutionHelper (James M Snell) #600403e8fdc1d8d] - src: remove unused variables from report (Moonki Choi) #60047d744324d8e] - src: avoid unnecessary string allocations in SPrintF impl (Anna Henningsen) #60052de65a5c719] - src: make ToLower/ToUpper input args more flexible (Anna Henningsen) #60052354026df5a] - src: allowstd::string_viewarguments toSPrintF()and friends (Anna Henningsen) #6005842f7d7cb20] - src: remove unnecessarystd::stringerror messages (Anna Henningsen) #6005730c2c0fedd] - src: remove unnecessary shadowed functions on Utf8Value & BufferValue (Anna Henningsen) #60056eb99eec09b] - src: avoid unnecessary string ->char*-> string round trips (Anna Henningsen) #60055c1f1dbdce2] - src: remove useless dereferencing inTHROW_...(Anna Henningsen) #60054ea0f5e575d] - src: filloptions_args,options_envafter vectors are finalized (iknoom) #59945415fff217a] - src: use RAII for uv_process_options_t (iknoom) #59945982b03ecbd] - test: marktest-runner-run-watchflaky on macOS (Richard Lau) #60115831a0d3d28] - test: ensure that the message event is fired (Luigi Pinca) #599525538cfc1e8] - test: replace diagnostics_channel stackframe in output snapshots (Chengzhong Wu) #6002477ec400d90] - test: mark test-web-locks skip on IBM i (SRAVANI GUNDEPALLI) #599961aaadb9e31] - test: ensure message event fires in worker message port test (Jarred Sumner) #598851d5cc5e57a] - test: mark sea tests flaky on macOS x64 (Richard Lau) #60068c412b1855d] - test: expand tls-check-server-identity coverage (Diango Gavidia) #60002ad87975029] - test: fix typo of test-benchmark-readline.js (Deokjin Kim) #59993bad4b9b878] - test: add newstartNewREPLSevertesting utility (Dario Piotrowicz) #59964ef90b0f456] - test: verify tracing channel doesn't swallow unhandledRejection (Gerhard Stöbich) #59974d7285459fe] - timers: fix binding fast call signatures (Renegade334) #596006529ae9b0c] - tools: add message on auto-fixing js lint issues in gh workflow (Dario Piotrowicz) #591281ca116a6ea] - tools: verify signatures when updating nghttp* (Antoine du Hamel) #6011320d10a2398] - tools: use dependabot cooldown and move tools/doc (Rafael Gonzaga) #59978275c07064c] - typings: update 'types' binding (René) #596928c21c4b286] - wasi: fix WasiFunction fast call signature (Renegade334) #59600b865074641] - win,tools: add description to signature (Martin Costello) #59877v24.9.0: 2025-09-25, Version 24.9.0 (Current), @targosCompare Source
Notable Changes
9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #583785563361d22] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #5874804013ee933] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #59846Commits
cbec4fd6de] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #596969a4bbdc3c5] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #598360b284d86e8] - build: add the missing macro definitions for OpenHarmony (hqzing) #5980443e6e54d66] - build: do not include custom ESLint rules testing in tarball (Antoine du Hamel) #59809039ac19154] - crypto: expose signatureAlgorithm on X509Certificate (Patrick Costa) #59235647c332704] - crypto: usereturn awaitwhen returning Promises from async functions (Renegade334) #598418ed4587cf0] - crypto: use async functions for non-stub Promise-returning functions (Renegade334) #59841bb051c56ef] - crypto: avoid calls topromise.catch()(Renegade334) #5984105e560dd25] - deps: update googletest to50b8600(Node.js GitHub Bot) #59955fa40d3a785] - deps: update archs files for openssl-3.5.3 (Node.js GitHub Bot) #599018c85570d18] - deps: upgrade openssl sources to openssl-3.5.3 (Node.js GitHub Bot) #59901b71125664e] - deps: update undici to 7.16.0 (Node.js GitHub Bot) #59830dea5dd7077] - dgram: restore buffer optimization in fixBufferList (Yoo) #59934b0c1e67532] - diagnostics_channel: fix race condition with diagnostics_channel and GC (Ugaitz Urien) #599100b37b594c3] - doc: use "WebAssembly" instead of "Web Assembly" (Tobias Nießen) #599541e723f9c6b] - doc: fix typo in section on microtask order (Tobias Nießen) #59932a28962a85c] - doc: update V8 fast API guidance (René) #58999bd767c5d1b] - doc: add security escalation policy (Ulises Gascón) #598069df91e59e1] - doc: type improvement of filehttp.md(yusheng chen) #58189e4f571680b] - doc: deprecate closingfs.Diron garbage collection (Livia Medeiros) #59839e9cb986fa5] - doc: rephrase dynamic import() description (Nam Yooseong) #59224026d4e33f7] - doc,crypto: update subtle.generateKey and subtle.importKey (Filip Skokan) #598512b2591db52] - esm: make hasAsyncGraph non-enumerable (Joyee Cheung) #59905993f05d323] - fs,win: do not add a second trailing slash in readdir (Gerhard Stöbich) #598477aec53b607] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #5982483ae6102e7] - http: optimize checkIsHttpToken for short strings (방진혁) #598326695067636] - http,https: handle IPv6 with proxies (Joyee Cheung) #59894c5d910a0a9] - http2: fix allowHttp1+Upgrade, broken by shouldUpgradeCallback (Tim Perry) #59924acada1fb82] - inspector: ensure adequate memory allocation forBinary::toBase64(René) #59870396cc8ec65] - lib: update inspect output format for subclasses (Miguel Marcondes Filho) #59687fed1dac8de] - lib: update isDeepStrictEqual to support options (Miguel Marcondes Filho) #59762d785929fd7] - lib: add source map support for assert messages (Chengzhong Wu) #59751ff13d1d61e] - lib,src: cache ModuleWrap.hasAsyncGraph (Chengzhong Wu) #59703b200cd8470] - lib,src: refactor assert to load error source from memory (Chengzhong Wu) #59751e94c57301b] - meta: add .npmrc with ignore-scripts=true (Joyee Cheung) #59914728472a57b] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874be48760b93] - node-api: added SharedArrayBuffer api (Mert Can Altin) #59071f006a14522] - node-api: make napi_delete_reference use node_api_basic_env (Jeetu Suthar) #596840f46c1c3b0] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #598573eeb7b47ea] - sqlite: fix crash session extension callbacks with workers (Bart Louwers) #598480fe53375ec] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #583789a3e58a007] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #58748f14ed5ab7b] - src: simplify watchdog instantiations viastd::optional(Anna Henningsen) #59960e330f03f84] - src: update crypto objects to use DictionaryTemplate (James M Snell) #5994269b5607cf4] - src: simplify is_callable by making it a concept (Tobias Nießen) #5816986150f3401] - src: rename private fields to follow naming convention (Moonki Choi) #59923d17f299539] - src: use DictionaryTemplate more in URLPattern (James M Snell) #59892ac784912ac] - src: reduce the nearest parent package JSON cache size (Michael Smith) #59888abecdcb536] - src: replace FIXED_ONE_BYTE_STRING with Environment-cached strings (Moonki Choi) #598912bb152500b] - src: create strings inFIXED_ONE_BYTE_STRINGas internalized (Anna Henningsen) #5982603116a7cd8] - src: removestd::arrayoverload ofFIXED_ONE_BYTE_STRING(Anna Henningsen) #598268a5325d6e3] - src: ensurev8::Eternalis empty before setting it (Anna Henningsen) #59825f0c20ccd81] - src: remove unnecessaryEnvironment::GetCurrent()calls (Moonki Choi) #59814213188e491] - stream: use new AsyncResource instead of bind (Matteo Collina) #59867ce8435b003] - test: testcase demonstrating issue 59541 (Eric Rannaud) #598018f32746142] - test: guard write to proxy client if proxy connection is ended (Joyee Cheung) #597426790093fcb] - tls: load bundled and extra certificates off-thread (Joyee Cheung) #59856f5d3f919d8] - tls: only do off-thread certificate loading on loading tls (Joyee Cheung) #5985687bbaa23a0] - tools: fixtools/make-v8.shfor clang (Richard Lau) #598930d23fd525b] - tools: skip test-internet workflow for draft PRs (Michaël Zasso) #59817e17c73731a] - tools: copyeditbuild-tarball.yml(Antoine du Hamel) #5980897c4e1bac9] - typings: remove unused imports (Nam Yooseong) #598808b29bbca76] - url: replaced slice with at (Mikhail) #591816458867a6b] - url: add type checking to urlToHttpOptions() (simon-id) #597533c62b3886f] - util: inspect objects with throwing Symbol.toStringTag (Ruben Bridgewater) #598606133a82875] - util: fix debuglog.enabled not being present with callback logger (Ruben Bridgewater) #598589347ddddf4] - vm: explain how to share promises between contexts w/ afterEvaluate (Eric Rannaud) #5980144ce971619] - vm: "afterEvaluate", evaluate() return a promise from the outer context (Eric Rannaud) #598016e586a1409] - vm: expose hasTopLevelAwait on SourceTextModule (Chengzhong Wu) #5986549747a58a3] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #59846b970c0bbc2] - zlib: reduce code duplication (jhofstee) #578109782ca2b1b] - zlib: implement fast path for crc32 (Gürgün Dayıoğlu) #59813v24.8.0: 2025-09-10, Version 24.8.0 (Current), @targosCompare Source
Notable Changes
HTTP/2 Network Inspection Support in Node.js
Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js.
Usage
Write a
test.jsscript that makes HTTP/2 requests.Run it with these options:
Open
about:inspecton Google Chrome and click onOpen dedicated DevTools for Node.The
Networktab will let you track your HTTP/2 calls.Contributed by Darshan Sen in #59611.
Other Notable Changes
7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #595704b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #595703e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #59647b1d28785b2] - (SEMVER-MINOR) crypto: add Argon2 Web Cryptography algorithms (Filip Skokan) #59544430691d1af] - (SEMVER-MINOR) crypto: support SLH-DSA KeyObject, sign, and verify (Filip Skokan) #59537d6d05ba397] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #59428Commits
d913872369] - assert: cap input size in myersDiff to avoid Int32Array overflow (Haram Jeong) #595787bbbcf6666] - benchmark: sqlite prevent create both tables on prepare selects (Bruno Rodrigues) #5970944d7b92271] - benchmark: calibrate config array-vs-concat (Rafael Gonzaga) #595877f347fc551] - build: fix getting OpenSSL version on Windows (Michaël Zasso) #596094a317150d5] - build: fix 'implicit-function-declaration' on OpenHarmony platform (hqzing) #59547bda32af587] - build: usewindows-2025runner (Michaël Zasso) #59673a4a8ed8f6e] - build: compile bundled uvwasi conditionally (Carlo Cabrera) #59622d944a87761] - crypto: refactor subtle methods to use synchronous import (Filip Skokan) #597717a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #595704b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #595703e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #59647b1d28785b2] - (SEMVER-MINOR) crypto: add Argon2 Web Cryptography algorithms (Filip Skokan) #59544430691d1af] - (SEMVER-MINOR) crypto: support SLH-DSA KeyObject, sign, and verify (Filip Skokan) #595370d1e53d935] - deps: update uvwasi to 0.0.23 (Node.js GitHub Bot) #5979168732cf426] - deps: update histogram to 0.11.9 (Node.js GitHub Bot) #59689f12c1ad961] - deps: update googletest toeb2d85e(Node.js GitHub Bot) #5933545af6966ae] - deps: upgrade npm to 11.6.0 (npm team) #5975057617244a4] - deps: V8: cherry-pick6b1b9bc(Xiao-Tao) #592832e6225a747] - deps: update amaro to 1.1.2 (Node.js GitHub Bot) #596161f7f6dfae6] - diagnostics_channel: revoke DEP0163 (René) #597588671a6cdb3] - doc: stabilize --disable-sigusr1 (Rafael Gonzaga) #59707583b1b255d] - doc: update OpenSSL default security level to 2 (Jeetu Suthar) #597239b5eb6eb50] - doc: fix missing links in theerrorspage (Nam Yooseong) #59427e7bf712c57] - doc: update "Type stripping in dependencies" section (Josh Kelley) #5965296db47f91e] - doc: add Miles Guicent as triager (Miles Guicent) #5956287f829bd0c] - doc: markpath.matchesGlobas stable (Aviv Keller) #59572062b2f705e] - doc: improve documentation for raw headers in HTTP/2 APIs (Tim Perry) #596336ab9306370] - doc: update install_tools.bat free disk space (Stefan Stojanovic) #59579c8d6b60da6] - doc: fix quic session instance typo (jakecastelli) #5964261d0a2d1ba] - doc: fix filehandle.read typo (Ruy Adorno) #596353276bfa0d0] - doc: update migration recomendations forutil.is**()deprecations (Augustin Mauroy) #5926911de6c7ebb] - doc: fix missing link to the Error documentation in thehttppage (Alexander Makarenko) #59080f5b6829bba] - doc,crypto: add description to the KEM and supports() methods (Filip Skokan) #596445bfdc7ee74] - doc,crypto: cleanup unlinked and self method references webcrypto.md (Filip Skokan) #59608010458d061] - esm: populate separate cache for require(esm) in imported CJS (Joyee Cheung) #59679dbe6e63baf] - esm: fix missed renaming in ModuleJob.runSync (Joyee Cheung) #597248eb0d9d834] - fs: fix wrong order of file names in cpSync error message (Nicholas Paun) #59775e69be5611f] - fs: fix dereference: false on cpSync (Nicholas Paun) #596812865d2ac20] - http: unbreak keepAliveTimeoutBuffer (Robert Nagy) #59784ade1175475] - http: use cached '1.1' http version string (Robert Nagy) #5971774a09482de] - inspector: undici as shared-library should pass tests (Aras Abbasi) #59837772f8f415a] - inspector: add http2 tracking support (Darshan Sen) #596113d225572d7] - Revert "lib: optimize writable stream buffer clearing" (Yoo) #597434fd213ce73] - lib: fix isReadable and isWritable return type value (Gabriel Quaresma) #5908939befddb87] - lib: prefer TypedArrayPrototype primordials (Filip Skokan) #597660748160d2e] - lib: fix DOMException subclass support (Chengzhong Wu) #596801a93df808c] - lib: revert to using default derived class constructors (René) #59650bb0755df37] - meta: bumpcodecov/codecov-action(dependabot[bot]) #5972645d148d9be] - meta: bump actions/download-artifact from 4.3.0 to 5.0.0 (dependabot[bot]) #5972901b66b122e] - meta: bump github/codeql-action from 3.29.2 to 3.30.0 (dependabot[bot]) #5972834f7ab5502] - meta: bump actions/cache from 4.2.3 to 4.2.4 (dependabot[bot]) #597275806ea02af] - meta: bump actions/checkout from 4.2.2 to 5.0.0 (dependabot[bot]) #59725f667215583] - path: refactor path joining logic for clarity and performance (Lee Jiho) #597810340fe92a6] - repl: do not cause side effects in tab completion (Anna Henningsen) #59774a414c1eb51] - repl: fix REPL completion under unary expressions (Kingsword) #59744c206f8dd87] - repl: add isValidParentheses check before wrap input (Xuguang Mei) #596070bf9775ee2] - sea: implement sea.getAssetKeys() (Joyee Cheung) #59661bf26b478d8] - sea: allow using inspector command line flags with SEA (Joyee Cheung) #5956892128a8fe2] - src: use DictionaryTemplate for node_url_pattern (James M Snell) #59802bcb29fb84f] - src: correctly report memory changes to V8 (Yaksh Bariya) #5962344c24657d3] - src: fixup node_messaging error handling (James M Snell) #597922cd6a3b7ec] - src: track async resources via pointers to stack-allocated handles (Anna Henningsen) #5970434d752586f] - src: fix build on NetBSD (Thomas Klausner) #5971815fa779ac5] - src: fix race on process exit and off thread CA loading (Chengzhong Wu) #5963215cbd3966a] - src: separate module.hasAsyncGraph and module.hasTopLevelAwait (Joyee Cheung) #5967588d1ca8990] - src: use non-deprecated Get/SetPrototype methods (Michaël Zasso) #5967156ac9a2d46] - src: migrate WriteOneByte to WriteOneByteV2 (Chengzhong Wu) #596343d88aa9f2f] - src: remove duplicate code (theanarkh) #596490718a70b2a] - src: add name for more threads (theanarkh) #596010379a8b254] - src: remove JSONParser (Joyee Cheung) #5961990d0a1b2e9] - src,sqlite: refactor value conversion (Edy Silva) #596595e025c7ca7] - stream: replace manual function validation with validateFunction (방진혁) #59529155a999bed] - test: skip tests failing when run under root (Livia Medeiros) #597796313706c69] - test: update WPT for urlpattern tocff1ac1(Node.js GitHub Bot) #5960241245ad4c7] - test: skip more sea tests on Linux ppc64le (Richard Lau) #59755df63d37ec4] - test: fix internet/test-dns (Michaël Zasso) #596601f6c335e82] - test: mark test-inspector-network-fetch as flaky again (Joyee Cheung) #596401798683df1] - test: skip test-fs-cp* tests that are constantly failing on Windows (Joyee Cheung) #596374c48ec09e5] - test: deflake test-http-keep-alive-empty-line (Luigi Pinca) #59595dcdb259e85] - test_runner: fix todo inheritance (Moshe Atlow) #5972124177973a2] - test_runner: set mock timer's interval undefined (hotpineapple) #5947983d11f8a7a] - tools: print appropriate output when test aborted (hotpineapple) #597941eca2cc548] - tools: use sparse checkout inbuild-tarball.yml(Antoine du Hamel) #5978889fa1a929d] - tools: remove unused actions frombuild-tarball.yml(Antoine du Hamel) #59787794ca3511d] - tools: do not attempt to compress tgz archive (Antoine du Hamel) #59785377bdb9b7e] - tools: add v8windbg target (Chengzhong Wu) #597676696d1d6c9] - tools: improve error handling in node_mksnapshot (James M Snell) #594378dbd0f13e8] - tools: add sccache totest-internetworkflow (Antoine du Hamel) #597206523c2d7d9] - tools: update gyp-next to 0.20.4 (Node.js GitHub Bot) #5969019d633f40c] - tools: add script to make reviewing backport PRs easier (Antoine du Hamel) #5916115e547b3a4] - typings: add typing for 'uv' (방진혁) #59606ad5cfcc901] - typings: add missing properties in ConfigBinding (Lee Jiho) #5958570d2d6d479] - url: add err.input to ERR_INVALID_FILE_URL_PATH (Joyee Cheung) #59730e476e43c17] - util: fix numericSeparator with negative fractional numbers (sangwook) #59379b2e8f40d15] - util: remove unnecessary template strings (btea) #592016f79450ea2] - util: remove outdated TODO comment (haramjeong) #5976032731432ef] - util: use getOptionValue('--no-deprecation') in deprecated() (haramjeong) #5976065e4e68c90] - util: hide duplicated stack frames when using util.inspect (Ruben Bridgewater) #594472086f3365f] - vm: sync-ify SourceTextModule linkage (Chengzhong Wu) #59000c16163511d] - wasi: fixcleantarget intest/wasi/Makefile(Antoine du Hamel) #595762e54411cb6] - worker: optimize cpu profile implement (theanarkh) #59683d6d05ba397] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #59428v24.7.0: 2025-08-27, Version 24.7.0 (Current), @targosCompare Source
Notable Changes
Post-Quantum Cryptography in
node:cryptoOpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by
allowing use of NIST's post-quantum cryptography standards for future-proofing
applications against quantum computing threats. The following post-quantum
algorithms are now available in
node:crypto:crypto.encapsulate()andcrypto.decapsulate()methods.crypto.sign()andcrypto.verify()methods.Contributed by Filip Skokan in #59259 and #59491.
Modern Algorithms in Web Cryptography API
The second substantial extension to the Web Cryptography API
(
globalThis.crypto.subtle) was recently accepted for incubation by WICG.The following algorithms and methods from this extension are now available in
the Node.js Web Cryptography API implementation:
subtle.getPublicKey()SubtleCrypto.supports()Contributed by Filip Skokan in #59365, #59569, #59461, and #59539.
Node.js execution argument support in single executable applications
The single executable application configuration now supports additional fields
to specify Node.js execution arguments and control how they can be extended when
the application is run.
execArgvtakes an array of strings for the execution arguments to be used.execArgvExtensiontakes one of the following values:"none": No additional execution arguments are allowed."cli": Additional execution arguments can be provided via a special command-line flag--node-options="--flag1 --flag2=value"at run time."env"(default): Additional execution arguments can be provided via theNODE_OPTIONSenvironment variable at run time.For example, with the following configuration:
If the generated single executable application is named
sea, then running:Would be equivalent to running:
Contributed by Joyee Cheung in #59314 and #59560.
Root certificates updated to NSS 3.114
Certificates added:
Certificates removed:
Other Notable Changes
d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #503536ae202fcdf] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315dafee05358] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #594558dc6f5b696] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #59464Commits
0fa22cbf7c] - benchmark: calibrate config v8/serialize.js (Rafael Gonzaga) #59586f5ece45b45] - benchmark: reduce readfile-permission-enabled config (Rafael Gonzaga) #595898ebd4f4434] - benchmark: calibrate length of util.diff (Rafael Gonzaga) #595887dee3ffd14] - benchmark: reflect current OpenSSL in crypto key benchmarks (Filip Skokan) #59459027b861ca1] - benchmark, test: replace CRLF variable with string literal (Lee Jiho) #5946689dd770889] - build: do not set-mminimal-tocwithclang(Richard Lau) #59484e13de4542f] - child_process: remove unsafe array iteration (hotpineapple) #5934789fe63551e] - crypto: load system CA certificates off thread (Joyee Cheung) #59550152c5ef518] - (SEMVER-MINOR) crypto: add AES-OCB Web Cryptography algorithm (Filip Skokan) #59539c6c418343d] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #5957118a2ee5b6c] - (SEMVER-MINOR) crypto: support ML-KEM in Web Cryptography (Filip Skokan) #5956972937e5144] - crypto: require HMAC key length with SHA-3 hashes in Web Cryptography (Filip Skokan) #59567b7383186c7] - crypto: fix subtle.getPublicKey error for secret type key inputs (Filip Skokan) #595582d05c046db] - crypto: return cached copies from CryptoKey algorithm and usages getters (Filip Skokan) #59538207ffbeb07] - crypto: use CryptoKey internal slots in Web Cryptography (Filip Skokan) #595384276516781] - crypto: normalize RsaHashedKeyParams publicExponent (Filip Skokan) #5953814741539a7] - (SEMVER-MINOR) crypto: support ML-KEM, DHKEM, and RSASVE key encapsulation mechanisms (Filip Skokan) #59491d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #503534fe383e45a] - (SEMVER-MINOR) crypto: support ML-DSA spki/pkcs8 key formats in Web Cryptography (Filip Skokan) #59365a95386fbf9] - (SEMVER-MINOR) crypto: subject some algorithms in Web Cryptography on BoringSSL absence (Filip Skokan) #593653f47a2fb63] - (SEMVER-MINOR) crypto: add ChaCha20-Poly1305 Web Cryptography algorithm (Filip Skokan) #593656fcce9058a] - (SEMVER-MINOR) crypto: add subtle.getPublicKey() utility function in Web Cryptography (Filip Skokan) #5936576cde76429] - (SEMVER-MINOR) crypto: add SHA-3 Web Cryptography digest algorithms (Filip Skokan) #59365247d017501] - (SEMVER-MINOR) crypto: add SHAKE Web Cryptography digest algorithms (Filip Skokan) #59365f4fbcca5ce] - (SEMVER-MINOR) crypto: add SubtleCrypto.supports feature detection in Web Cryptography (Filip Skokan) #59365a55382214f] - (SEMVER-MINOR) crypto: support ML-DSA in Web Cryptography (Filip Skokan) #59365c38988c860] - crypto: fix EVPKeyCtxPointer::publicCheck() (Tobias Nießen) #5947161c3bcdc56] - (SEMVER-MINOR) crypto: support ML-KEM KeyObject (Filip Skokan) #594610821b446fb] - deps: update undici to 7.14.0 (Node.js GitHub Bot) #59507b3af17c065] - deps: V8: cherry-pick7b91e3e(Milad Fa) #594859b69baf146] - deps: V8: cherry-pick59d52e3(Milad Fa) #59485b4f202c2f1] - doc: improvesqlite.backup()progress/fulfillment documentation (René) #5959840b217a2f9] - doc: clarify experimental platform vulnerability policy (Matteo Collina) #59591cf84fffea5] - doc: link toTypedArray.from()in signature (Aviv Keller) #592264bf6ed0bf5] - doc: fix typos inenvironment_variables.md(PhistucK) #595361784c35a49] - doc: add security incident reponse plan (Rafael Gonzaga) #59470b962560240] - doc: clarify maxRSS unit inprocess.resourceUsage()(Alex Yang) #59511e6a6cdb9df] - doc: add missing Zstd strategy constants (RANDRIAMANANTENA Narindra Tiana Annaick) #59312a6a31cb467] - (SEMVER-MINOR) doc: compress Web Cryptography Algorithm matrix (Filip Skokan) #593658f8960cfcb] - doc: fix the version tls.DEFAULT_CIPHERS was added (Allon Murienik) #592479e76089f1a] - doc: clarify glob's exclude option behavior (hotpineapple) #59245dd5f835af7] - doc: add RafaelGSS as performance strategic lead (Rafael Gonzaga) #594452b7a7a525e] - doc,crypto: add supported asymmetric key types section (Filip Skokan) #594922fafe4c3bb] - esm: link modules synchronously when no async loader hooks are used (Joyee Cheung) #595195347c4997a] - esm: show race error message for inner module job race (Joyee Cheung) #59519b56d8af2fe] - esm: sync-ify module translation (Joyee Cheung) #59453b4a23d6a69] - http: trim off brackets from IPv6 addresses with string operations (Krishnadas PC) #594206ae202fcdf] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #59315dafee05358] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #59455b7ea39d860] - http2: report sent headers object in client stream dcs (Darshan Sen) #59419ebe9272dae] - inspector: initial support websocket inspection (Shima Ryuhei) #59404b35041c7dc] - inspector: prevent propagation of promise hooks to noPromise hooks (Shima Ryuhei) #58841fe7176d7c6] - lib: do not modify prototype deprecated asyncResource (encore) (Szymon Łągiewka) #5951893fc80a1e2] - (SEMVER-MINOR) lib: refactor kSupportedAlgorithms (Filip Skokan) #593659a12f71ad9] - lib: simplify IPv6 checks in isLoopback() (Krishnadas) #59375566fb04c82] - meta: update devcontainer to the latest schema (Aviv Keller) #54347389a24bbff] - module: allow overriding linked requests for a ModuleWrap (Chengzhong Wu) #595277880978fe3] - module: correctly detect top-level await in ambiguous contexts (Shima Ryuhei) #5864699128d9244] - node-api: link to other programming language bindings (Chengzhong Wu) #5951665c870e6cb] - node-api: clarify enum value ABI stability (Chengzhong Wu) #59085352d63541a] - sea: implement execArgvExtension (Joyee Cheung) #59560c6e3d5d98d] - (SEMVER-MINOR) sea: support execArgv in sea config (Joyee Cheung) #59314e7084df4db] - sqlite: add sqlite-type symbol for DatabaseSync (Alex Yang) #59405e2b6bdc640] - sqlite: handle ?NNN parameters as positional (Edy Silva) #5935099e4a12731] - sqlite: avoid useless call to FromMaybe() (Tobias Nießen) #59490dfd4962e5f] - src: enforce assumptions in FIXED_ONE_BYTE_STRING (Tobias Nießen) #5815593a368df04] - src: use simdjson to parse --snapshot-config (Joyee Cheung) #59473716750fcf8] - src: fix order of CHECK_NOT_NULL/dereference (Tobias Nießen) #5948744a8ecf8d4] - src: assert memory calc for max-old-space-size-percentage (Asaf Federman) #594603462b46fca] - src: use simdjson::pad (0hm☘️) #593913e1551d845] - src: move shared_ptr objects in KeyObjectData (Tobias Nießen) #59472c022c1f85a] - src: add internal GetOptionsAsFlags (Pietro Marchini) #59138c0f08454a3] - src: iterate metadata version entries with std::array (Chengzhong Wu) #57866f87836f3ae] - src: internalizev8::ConvertableToTraceFormatin traces (Chengzhong Wu) #57866852b8e46d8] - src: remove duplicate assignment ofO_EXCLin node_constants.cc (Daniel Osvaldo R) #5904964ffde608f] - src: add Intel CET properties to large_pages.S (tjuhaszrh) #59363823dce32ec] - src: update OpenSSL pqc checks (Filip Skokan) #594368dc6f5b696] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #59464b2b8383755] - test: use mustSucceed in test-repl-tab-complete-import (Sohyeon Kim) #59368e3ad5cc2c6] - test: skip sea tests on Linux ppc64le (Richard Lau) #59563f78f47ca5a] - test: support standalone env comment in tests (Pietro Marchini) #595460e8bc2c7ac] - test: rename test-net-server-drop-connections-in-cluster.js to -http- (Meghan Denny) #59532ed339580af] - test: lazy-load internalTTy (Pietro Marchini) #59517fe86bc6da8] - test: fixtest-setproctitlestatus whenpsis not available (Antoine du Hamel) #59523e517792973] - test: add parseTestMetadata support (Pietro Marchini) #5950331092972d6] - test: update WPT for WebCryptoAPI toff26d9b(Node.js GitHub Bot) #5949716afd103cc] - (SEMVER-MINOR) test: add Web Cryptography wrap/unwrap vectors (Filip Skokan) #593655598baf34e] - (SEMVER-MINOR) test: cleanup test-webcrypto-supports (Filip Skokan) #59365e7809d6ddb] - test: make test-debug-process locale-independent (BCD1me) #59254ca7856e73c] - test: mark test-wasi-pthread as flaky (Joyee Cheung) #594880ecd82197f] - test: split test-wasi.js (Joyee Cheung) #594880930c218d6] - test: deflake connection refused proxy tests (Joyee Cheung) #594767f457f886a] - test: use case-insensitive path checking on Windows in fs.cpSync tests (Joyee Cheung) #5947537809115f9] - test: add missing hasPostData in test-inspector-emit-protocol-event (Shima Ryuhei) #59412f4722b1672] - test: refactor error checks to use assert.ifError/mustSucceed (Sohyeon Kim) #594249ff71a672d] - test: fix typos (Lee Jiho) #593309a7700da62] - test: skip test-watch-mode inspect when no inspector (James M Snell) #59440e964c4334e] - test_runner: do not error when gettingfullNameof root context (René) #59377e076f7857c] - test_runner: add option to rerun only failed tests (Moshe Atlow) #59443eb8b1939a4] - test_runner: fix isSkipped check in junit (Sungwon) #594144e02ea1c52] - tools: update gyp-next to 0.20.3 (Node.js GitHub Bot) #5960399da7fbe11] - tools: avoid parsing test files twice (Pietro Marchini) #595269a6a8e319b] - tools: update coverage GitHub Actions to fixed version (Rich Trott) #595128d28236aff] - tools: fix return value of try_check_compiler (theanarkh) #5943452ab64ec3a] - tools: bump @eslint/plugin-kit from 0.3.3 to 0.3.4 in /tools/eslint (dependabot[bot]) #59271baa22893bb] - typings: add missing URLBinding methods (성우현 | Woohyun Sung) #59468b68e0d1eca] - util: fix error's namespaced node_modules highlighting using inspect (Ruben Bridgewater) #5944615ae21b88a] - util: add some additional error classes towellKnownPrototypes(Mark S. Miller) #59456c38b7cfa35] - worker: fix worker name with \0 (theanarkh) #59214f54ace694a] - worker: add worker name to report (theanarkh) #58935v24.6.0: 2025-08-14, Version 24.6.0 (Current), @RafaelGSSCompare Source
Notable Changes
471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #5927638aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #59293aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897Commits
f7484575ff] - assert: change utils to use index instead of for...of (방진혁) #59278269cd16185] - benchmark: remove deprecated _extend from benchmark (Rafael Gonzaga) #59228848e49c20b] - benchmark: add fs warmup to writefile-promises (Bruno Rodrigues) #592158c609be1b1] - benchmark: add calibrate-n script (Rafael Gonzaga) #591866a3bf772d8] - build: fix node_use_sqlite for GN builds (Shelley Vohr) #59017471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #5927638aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259a312e706cf] - crypto: prepare webcrypto key import/export for modern algorithms (Filip Skokan) #592843a7c2c3a47] - deps: update ada to 3.2.7 (Node.js GitHub Bot) #593368d9ceeaf6a] - deps: update archs files for openssl-3.5.2 (Node.js GitHub Bot) #5937133b06df354] - deps: upgrade openssl sources to openssl-3.5.2 (Node.js GitHub Bot) #59371fa70f1af77] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #58237f834a6be59] - deps: update undici to 7.13.0 (Node.js GitHub Bot) #59338db2417487e] - deps: update sqlite to 3.50.4 (Node.js GitHub Bot) #5933741978adb08] - deps: V8: backport493cb53(Chengzhong Wu) #5923805667991ca] - deps: V8: backport1c3e018(Renegade334) #58818fd61588bb4] - doc: rename x509.extKeyUsage to x509.keyUsage (Filip Skokan) #59332a271ae4360] - doc: fix Pbkdf2Params hash attribute heading (Filip Skokan) #5939572cfff165b] - doc: fix missing reference links for server.keepAliveTimeoutBuffer (Lee Jiho) #593568341916772] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #59344e3e489706b] - doc: run license-builder (github-actions[bot]) #5934346527e8cea] - doc: correct orthographyeg.→e.g.(Jacob Smith) #59329d140c3713e] - doc: clarify the need of compiler compatible with c++20 (Rafael Gonzaga) #5929795e9cabf9d] - doc: clarify release candidate stability index (Filip Skokan) #59295a056dd36d2] - doc: add WDYT to glossary (btea) #592801e2c52f5c4] - doc: add manpage entry for --use-system-ca (Joyee Cheung) #5927331a46fdeb4] - doc: add path.join and path.normalize clarification (Rafael Gonzaga) #59262cff3725ff9] - doc: fix typo intest/common/README.md(Yoo) #5918031a9283591] - doc: add note on process memoryUsage (fengmk2) #590265a98bff6b8] - doc: format safely fordoc-kit(Aviv Keller) #5922995b8b7ea5c] - domain: remove deprecated API call (Alex Yang) #593392990f178bd] - fs: fix glob TypeError on restricted dirs (Sylphy-0xd3ac) #58674e2fb4caf9c] - fs: correct error message when FileHandle is transferred (Alex Yang) #59156aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #592430fb005a53f] - http2: set Http2Stream#sentHeaders for raw headers (Darshan Sen) #59244e055539604] - lib: add trace-sigint APIs (theanarkh) #59040d2183d860a] - lib: optimize writable stream buffer clearing (Yoo) #5940647543a7e17] - lib: handle windows reserved device names on UNC (Rafael Gonzaga) #59286c6911f0717] - lib: do not modify prototype deprecated asyncResource (RafaelGSS) #591953c88b769bb] - lib: restructure assert to become a class (Miguel Marcondes Filho) #58253e91b54df59] - lib: handle superscript variants on windows device (Rafael Gonzaga) #592614ee467905d] - lib: use validateString (hotpineapple) #59296c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #59293c89b67e681] - lib: add type names in source mapped stack traces (Chengzhong Wu) #589765b2363be8d] - lib: prefer AsyncIteratorPrototype primordial (René) #5909741b4f4d694] - meta: clarify pr objection process further (James M Snell) #590960eb5962f1e] - meta: add mailmap entry for aditi-1400 (Aditi) #59316a2b72c2304] - meta: add tsc and build team as codeowners building.md (Rafael Gonzaga) #59298d69f3ee1e0] - meta: add nodejs/path to path files (Rafael Gonzaga) #592891e37eab865] - node-api: reword "implementation in an alternative VM" as implementable (Chengzhong Wu) #5903664add6302a] - src: use simdjson to parse SEA configuration (Joyee Cheung) #59323e9c6636585] - src: mark realm leaf classes final (Anna Henningsen) #5935542ef8147d1] - src: warn about FastOneByteString invalidation (James M Snell) #592758686b8037a] - src: remove unused DSAKeyExportJob (Filip Skokan) #592911e5f632666] - src: use C++20contains()method (iknoom) #5930422d4683cfe] - src: added CHECK_NOT_NULL check for multiple eq_wrap_async (F3lixTheCat) #592676a47ff4943] - src: clear all linked module caches once instantiated (Chengzhong Wu) #5911733728cb4ca] - src: add nullptr checks inStreamPipe::New(Burkov Egor) #576134a907bdad1] - src: add percentage support to --max-old-space-size (Asaf Federman) #590827c189d4f55] - test: deflake sequential/test-tls-session-timeout (Joyee Cheung) #59423fb0a6fb57f] - test: exclude mock from coverage (Shima Ryuhei) #593487e10f95f13] - test: split test-fs-cp.js (Joyee Cheung) #5940841bcf5f659] - test: update WPT resources,WebCryptoAPI,webstorage (Filip Skokan) #59311f9f3dc94cb] - test: add known issue test for fs.cpSync dereference bug (James M Snell) #58941244d0c38a8] - test: deflake stream-readable-to-web test (Ethan Arrowood) #58948564e604a1a] - test: make test-inspector-network-resource sequential (Shima Ryuhei) #591047ab13b7477] - test: don't use expose internals in test-http-outgoing-buffer.js (Meghan Denny) #59219319df3859a] - test,crypto: skip unsupported ciphers (Shelley Vohr) #59388713c70c32a] - test_runner: remove unused callee convertion (Alex Yang) #59221e4ca30e115] - tools: disable nullability-completeness warnings (Michaël Zasso) #59392dab7f6b542] - tools: check for std::vector<v8::Local> in lint (Aditi) #584977b94982eb0] - tools: allow selecting test subsystems with numbers in their names (Darshan Sen) #5924216bbcd8881] - typings: improve internal binding types (Nam Yooseong) #5935176bc4d659b] - typings: improve internal binding types (Michaël Zasso) #59176eecd3272a6] - worker: add name for worker (theanarkh) #5921384c3513ce2] - worker: implements nits in Web Locks code (Antoine du Hamel) #59270bd68fbd753] - worker: add cpuUsage for worker (theanarkh) #59177201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240v24.5.0: 2025-07-31, Version 24.5.0 (Current), @aduh95Compare Source
Notable Changes
Upgrade to OpenSSL 3.5
This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/.
Contributed by Richard Lau in #58100.
Unflag
--experimental-wasm-modulesNode.js supports both source phase imports and instance phase imports to WebAssembly
modules and for WASM imports to JavaScript, in line with the current Phase 3
WebAssembly ESM Integration proposal.
The implementation and the specification are still subject to change.
Contributed by Guy Bedford in #57038.
Built-in proxy support in
request()andAgentnode:httpandnode:httpsnow support proxies. WhenNODE_USE_ENV_PROXYis set to
1, the default global agent would parse thehttp_proxy/HTTP_PROXY,https_proxy/HTTPS_PROXY,no_proxy/NO_PROXYsettings from theenvironment variables, and proxy the requests sent through the built-in http/https
client accordingly.
To use global proxy support from the command line:
In addition,
http.Agentandhttps.Agentnow support the customproxyEnvoptions.For reference,
fetch()already supportsNODE_USE_ENV_PROXYas of Node.js 24.0.0.Contributed by Joyee Cheung in #58980.
Add
setDefaultCACertificates()tonode:tlsThis API allows dynamically configuring CA certificates that will be used by the
Node.js TLS clients by default.
Once called, the provided certificates will become the default CA certificate list
returned by
tls.getCACertificates('default')and used by TLS connections thatdon't specify their own CA certificates.
To add system CA certificates to the default bundle (which includes the Mozilla
CA certificates):
Contributed by Joyee Cheung in #58822.
Other notable changes
d5640ca58a] - (SEMVER-MINOR) cli: support${pid}placeholder in--cpu-prof-name(Haram Jeong) #59072c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #580879791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666Commits
5457c7a8a1] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #5918728538f2255] - benchmark: add --track to benchmark (Rafael Gonzaga) #59174a28d804497] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #5917209717eb68e] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #59171ad6757ef02] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #591707fc3143f61] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #59116f2812723a0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #59043e3e729ca60] - build: remove suppressions.supp (Rafael Gonzaga) #59079dc66422768] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #58100f5da4947d9] - cli: add --use-env-proxy (Joyee Cheung) #59151d5640ca58a] - (SEMVER-MINOR) cli: support${pid}placeholder in --cpu-prof-name (Haram Jeong) #59072eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822135fca5b72] - crypto: avoid copying buffers to UTF-8 strings incrypto.hash()(Renegade334) #59067998cef10e3] - deps: update archs files for openssl-3.5.1 (Node.js GitHub Bot) #592341f06ca956a] - deps: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #5923455a90eed8d] - deps: upgrade npm to 11.5.1 (npm team) #591992b5d451ae0] - deps: update amaro to 1.1.1 (Node.js GitHub Bot) #59141af789d9b5c] - deps: update undici to 7.12.0 (Node.js GitHub Bot) #59135a34e44545e] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132bfe4781c7d] - deps: update googletest to7e17b15(Node.js GitHub Bot) #5913172adf52e51] - deps: update ada to 3.2.6 (Node.js GitHub Bot) #589662a5f35b589] - deps: V8: cherry-pick3d750c2(Michaël Zasso) #587503f813eaba7] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134fb52d0d8df] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134f122602f9d] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #591139a8d2020ad] - doc: copyedit SECURITY.md (Rich Trott) #591903da5bc0668] - doc: fix broken sentence inURL.parse(Superchupu) #5916406cd7461e0] - doc: improve onboarding instructions (Joyee Cheung) #59159dfb72d158b] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #5891751b8dfd5c6] - doc: add Aditi-1400 to collaborators (Aditi) #591574ffa756ce3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #591116f81b274f7] - doc: fix typo in writing-test.md (SeokHun) #5912388e434e687] - doc: add new environment variables doc page (Dario Piotrowicz) #59052b1a318d706] - doc: update release key for aduh95 (Antoine du Hamel) #5887734c49000c9] - doc: add missing section forsetReturnArraysinsqlite.md(Edy Silva) #590749b2e965aff] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #590782d1dcb87e6] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #59050999b5e51e7] - doc: run license-builder (github-actions[bot]) #590561940a2cb46] - doc: fix typed list formatting (Aviv Keller) #590196cb5e0d22f] - doc: refineutil.parseArgsdefaultdefinition (Slayer95) #58958d2e7f8e13a] - doc: remove unused import inzlib.md(coderaiser) #590419d02960149] - doc: add missing environment variables to manpage (amir lavasani) #5896345ffdb34fb] - doc: add stability index to the--watch-kill-signalflag (Dario Piotrowicz) #589973924c43600] - doc: add missing<code>blocks (Antoine du Hamel) #58995cb95e183f3] - doc: add scroll margin to links (Roman Reiss) #58982c9ded6ba15] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #58983b919fe0447] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #5703871bb6cd077] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #590208d869e6d62] - fs: fix return value of fs APIs (theanarkh) #589967f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #5898085d6a28f4f] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077cfaa299f2e] - lib: fix incorrectArrayBufferPrototypeGetDetachedprimordial type (Dario Piotrowicz) #58978d555db22ad] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #5892896c9dd79e6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140324d9fc9d4] - meta: enable jsdoc/check-tag-names rule (Yagiz Nizipli) #5852104c751463b] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #58944fe0195fdcc] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #59011515b581d47] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #5808715e6c28d82] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #59087f67b686551] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #590943d2f919f7c] - process: make execve's args argument optional (Allon Murienik) #584121a44265810] - repl: handle errors from getters during completion (Shima Ryuhei) #59044467dbd31e6] - repl: fix repl crashing on variable declarations without init (Dario Piotrowicz) #590323a3eb6852d] - repl: improve REPL disabling completion on proxies and getters (Dario Piotrowicz) #5889155838e79b8] - src: call unmask after install signal handler (theanarkh) #5905977649ad93b] - src: useFastStringKeyforTrackV8FastApiCall(Anna Henningsen) #5914886babf9c4b] - src: use C++20constevalforFastStringKey(Anna Henningsen) #5914888b99eeae1] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093d89390fc8f] - src: add cache to nearest parent package json (Ilyas Shabi) #5908621780075e4] - src: check import attributes value types as strings (Chengzhong Wu) #58986ef89c2fac9] - src,test: fix config file parsing for flags defaulted to true (Edy Silva) #591101e990866e0] - test: mark web lock held test as flaky (Ilyas Shabi) #59144ba8e95a785] - test: use mustSucceed in test-fs-read (Sungwon) #5920439978f507f] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #581001c3aadb9d6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #59158a0d22e9c51] - test: remove timeout in test-https-proxy-request-handshake-failure (Joyee Cheung) #591657e0a0fccc1] - test: expand linting rules aroundassertw literal messages (Anna Henningsen) #59147c6070046c3] - test: update WPT for WebCryptoAPI toab08796(Node.js GitHub Bot) #5912915d8cc908e] - test: update WPT for WebCryptoAPI to19d82c5(Node.js GitHub Bot) #5912983023e5144] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #5901482d4175ec3] - test: updatestartCLIto set--port=0by default (Dario Piotrowicz) #5904216dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980a9511a6066] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #590911cffcc02a3] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #5897783cdf1701b] - test_runner: clean up promisified interval generation (René) #58824195d6038dc] - tools: clarify README linter error message (Joyee Cheung) #5916051f578a3bf] - tools: add support for URLs to PR commits inmerge.sh(Antoine du Hamel) #5916220be9012eb] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #59119623e264e93] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #590370e547e09ab] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #58992075d1968db] - util: respect nested formats in styleText (Alex Yang) #590989791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666v24.4.1: 2025-07-15, Version 24.4.1 (Current), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Commits
c33223f1a5] - (CVE-2025-27209) deps: V8: revert rapidhash commits (Michaël Zasso) nodejs-private/node-private#71356f9db2aaa] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721v24.4.0: 2025-07-09, Version 24.4.0 (Current), @RafaelGSSCompare Source
Notable Changes
22b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi) #5812180dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #5871987f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons) #585169623c50b53] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853797ec4da04] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #58697ed966a0215] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #58951fe17f5d285] - (SEMVER-MINOR) watch: add--watch-kill-signalflag (Dario Piotrowicz) #58719Commits
a118bfc536] - assert: remove dead code (Yoshiya Hinosawa) #5876031252b9af1] - benchmark: add source map and source map cache (Miguel Marcondes Filho) #581254170359bcd] - bootstrap: initialize http proxy after user module loader setup (Joyee Cheung) #58938c76585d10e] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr) #58867049c838609] - build: option to use custom inspector_protocol path (Shelley Vohr) #5883922b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi) #5812177712ae2a1] - crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan) #5894293e1a33b81] - crypto: fix inclusion of OPENSSL_IS_BORINGSSL define (Shelley Vohr) #58845573171deb0] - deps: V8: cherry-pick0ce2edb(Levi Zim) #58773bf66291382] - deps: V8: cherry-pick1d71595(Michaël Zasso) #58749f735b8b8d0] - deps: update sqlite to 3.50.2 (Node.js GitHub Bot) #588828e9622e494] - deps: update undici to 7.11.0 (Node.js GitHub Bot) #588598741da81c7] - deps: update googletest to35b75a2(Node.js GitHub Bot) #58710028ce40e25] - deps: update minimatch to 10.0.3 (Node.js GitHub Bot) #587123afb15b715] - dns: fix parse memory leaky (theanarkh) #58973f40ac32f3e] - dns: set timeout to 1000ms when timeout < 0 (theanarkh) #58441921b563999] - doc: remove broken link to permission model source code (Juan José) #5897278628d6158] - doc: clarify details of TSC public and private meetings (James M Snell) #58925ab834a8b94] - doc: mark stability markers consistent inglobals.md(Antoine du Hamel) #589328d4f6a0016] - doc: move "Core Promise APIs" to "Completed initiatives" (Antoine du Hamel) #5893494725fced5] - doc: fixfetchsubsections inglobals.md(Antoine du Hamel) #58933a7a4870014] - doc: add missingClass:mentions (Antoine du Hamel) #5893198f29fa2fd] - doc: remove myself from security steward rotation (Michael Dawson) #58927710e13d436] - doc: add ovflowd back to core collaborators (Claudio W.) #589118b93008dc0] - doc: update email address for Richard Lau (Richard Lau) #589109ff81d21ed] - doc: update vm doc links (Chengzhong Wu) #58885ff2efd266d] - doc: fix links in test.md (Vas Sudanagunta) #588765e854e1f61] - doc: add missing comma inchild_process.md(ronijames008) #5886248f5d6d686] - doc: add guidelines for introduction of ERM support (James M Snell) #5852680dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719b36fa0fda1] - doc: fix jsdoc definition of assert.ifError() fn in lib/assert.js (jesh) #58573cebb93ea12] - doc: add array type in http request headers (Michael Henrique) #580496e6b373da1] - doc: add missing colon to headers inglobals.md(Aviv Keller) #588251519b75191] - doc: fixstream.mdsection order (Antoine du Hamel) #5881187f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons) #58516b378fc3ac0] - fs: close dir before throwing ifoptions.bufferSizeis invalid (Livia Medeiros) #5885623bd4d1867] - fs: special input-1onchown,lchownandfchown(Alex Yang) #58836d07ce8e90c] - fs: throwERR_INVALID_THISon illegal invocations (Livia Medeiros) #588480d969a66dc] - inspector: support undici traffic data inspection (Chengzhong Wu) #58953839b25e371] - lib: exposesetupInstancemethod on WASI class (toyobayashi) #57214d8f3f649c2] - lib: fixgetTypeScriptParsingModejsdoc (沈鸿飞) #58681d534706211] - meta: bump step-security/harden-runner from 2.12.0 to 2.12.2 (dependabot[bot]) #589233ec5fe04d0] - meta: bump github/codeql-action from 3.28.18 to 3.29.2 (dependabot[bot]) #58922bd4a1a5b06] - meta: add IlyasShabi to collaborators (Ilyas Shabi) #58916d29b195b51] - module: link module with a module request record (Chengzhong Wu) #58886a78385c4bd] - module: convert schema-only core module onconvertCJSFilenameToURL(Alex Yang) #58612e0de362319] - module: update tests for combined ambiguous module syntax error (Mert Can Altin) #558747f7a833e82] - os: fix GetInterfaceAddresses memory lieaky (theanarkh) #589409623c50b53] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853efe19b50b6] - repl: fix eval errors thrown after close throwingERR_USE_AFTER_CLOSE(Dario Piotrowicz) #58791c891db1c05] - repl: improve tab completion on computed properties (Dario Piotrowicz) #58775797ec4da04] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #586978eecaa264d] - src: -Wunreachable-code-break in node_config_file.cc (Shelley Vohr) #58901143379df56] - src: -Wunreachable-code error in crypto_context.cc (Shelley Vohr) #58901056a1af197] - src: fix -Wunreachable-code-return in src/node_contextify.cc (Shelley Vohr) #58901ba661459f5] - src: fix -Wunreachable-code in src/node_api.cc (Shelley Vohr) #589016af0163dda] - src: simplify adding fast APIs to ExternalReferenceRegistry (René) #58896210e608938] - src: cleanup uv_fs_req before uv_fs_stat on existSync (RafaelGSS) #589152445f86dc9] - src: -Wmismatched-new-delete in debug_utils.cc (Shelley Vohr) #5884412286c9f64] - src: use ranges library (C++20) more systematically (Daniel Lemire) #58028ed966a0215] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #58951dd54910ab1] - src,permission: enhance permission model debug (Rafael Gonzaga) #5889894f9424d78] - test: deflake test-runner-watch-mode-kill-signal (Dario Piotrowicz) #58952b6ff6c8d20] - test: add known issue tests for recursive readdir calls with Buffer path (Dario Piotrowicz) #58893c300f107ac] - test: add known issue tests for fs.cp (James M Snell) #58883d8a86a622e] - test: add tests to ensure that node.1 is kept in sync with cli.md (Dario Piotrowicz) #5887857c69acb78] - test: replace.filter()[0]with.find()(Livia Medeiros) #5887267b3f4fbee] - test: remove reliance on in-treedeps/undici(Richard Lau) #58866df85b02a00] - test: close dirs infs-opendirtest (Livia Medeiros) #58855692f1aebf0] - test: update WPT for urlpattern to84b75f0(Node.js GitHub Bot) #587853a119be362] - test: save the config file in a temporary directory (Luigi Pinca) #58799924cf1ef25] - test: deflake test-config-file (Luigi Pinca) #58799b5c7e645c9] - test_runner: correctly filter --experimental-config-file (Pietro Marchini) #58833d0faf723c7] - test_runner: fix timeout not propagated to the child process in run (jakecastelli) #588316052d8c1ac] - test_runner: correct "already mocked" error punctuation placement (Jacob Smith) #58840e8dd1897d5] - tools: compile maglev files into v8_compiler if maglev is disabled (Yao Zi) #58861191396260c] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #589211e423e0680] - tools: update inspector_protocol to69d69dd(Shelley Vohr) #589000def4e23b1] - tools: update gyp-next to 0.20.2 (Node.js GitHub Bot) #58788adb950cde2] - tools,doc: move more MDN links to types (Antoine du Hamel) #589301ee539a3aa] - tty: treat emptyNO_COLORsame as absentNO_COLOR(Antoine du Hamel) #580742b34867ba9] - v8: fix missing callback in heap utils destroy (Ruben Bridgewater) #58846a1f4333695] - vm: expose import phase on SourceTextModule.moduleRequests (Chengzhong Wu) #58829fe17f5d285] - (SEMVER-MINOR) watch: add--watch-kill-signalflag (Dario Piotrowicz) #58719v24.3.0: 2025-06-24, Version 24.3.0 (Current), @RafaelGSSCompare Source
Notable Changes
841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #584909b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #586437cdda927fa] - test: fix test-timeout-flag after revert of auto subtest wait (Pietro Marchini) #58282dce1995c55] - Revert "test_runner: remove promises returned by t.test()" (Romain Menke) #582828b0c5edbb6] - Revert "test_runner: remove promises returned by test()" (Romain Menke) #58282713fbad7b6] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #58438ef0230abaf] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700Commits
2ba2c93dee] - build: fix typo 'Stoage' to 'Storage' in help text (ganglike) #5877711811c15da] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #587867643ce9322] - deps: update acorn to 8.15.0 (Node.js GitHub Bot) #587114b61f10eb6] - deps: V8: cherry-picke3df60f(Chengzhong Wu) #58691fa6854f083] - deps: update amaro to 1.1.0 (Node.js GitHub Bot) #5875468671f4314] - deps: upgrade npm to 11.4.2 (npm team) #58696450f4815b3] - deps: update amaro to 1.0.0 (Node.js GitHub Bot) #586393aa2762e96] - deps: update sqlite to 3.50.1 (Node.js GitHub Bot) #5863080eac147e6] - deps: update simdjson to 3.13.0 (Node.js GitHub Bot) #58629dc1023878c] - deps: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) #5862897fbfd82af] - doc: fix stability 1.x links excluding the decimal digit (Dario Piotrowicz) #58783e2e88d4971] - doc: fix wrong RFC number in http2 (Deokjin Kim) #587537bb1246c8f] - doc: add history entry for TS support in hooks (Antoine du Hamel) #58732f125310d3a] - doc: run license-builder (github-actions[bot]) #58722841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #587141cc77c7ee6] - doc: punctuation fix for Node-API versioning clarification (Jiacai Liu) #58599d59680348e] - doc: add path rules and validation for export targets in package.json (0hm☘️) #58604b6760b3379] - esm: syncify default path ofModuleLoader.load(Jacob Smith) #5741996c78d726c] - fs: makeDirdisposers idempotent (René) #5869262b5879d88] - fs: avoid computing time coefficient constants in runtime (Livia Medeiros) #58728af18c0e81a] - fs: remove IIFE in glob (LiviaMedeiros) #58418fb4378b72e] - fs: add UV_ENOSPC to list of things to pass to err directly (Jacky Zhao) #56918839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490c9dc0a8903] - http: fix keep-alive not timing out after post-request empty line (Shima Ryuhei) #58178b11da1115e] - http2: fix DEP0194 message (KaKa) #58669b1f60d2f18] - http2: add diagnostics channel 'http2.server.stream.close' (Darshan Sen) #58602be93091694] - inspector: add protocol methods retrieving sent/received data (Chengzhong Wu) #5864520089e2a2e] - lib: renamevalidateInternalFieldintovalidateThisInternalField(LiviaMedeiros) #5876574983832f9] - lib: makevalidateInternalField()throwERR_INVALID_THIS(LiviaMedeiros) #58765081c70878f] - lib: make domexception a native error (Chengzhong Wu) #586916390f70da2] - lib,src: support DOMException ser-des (Chengzhong Wu) #586494c2c100f63] - meta: add @nodejs/inspector as codeowner (Chengzhong Wu) #58790ff8a3691c4] - module: fix typescript import.meta.main (Marco Ippolito) #5866145f7d160ed] - module: refactor commonjs typescript loader (Marco Ippolito) #586579b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643a3c7a63c73] - module: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) #58598d0e42ffa58] - repl: avoid deprecatedrequire.extensionsin tab completion (baki gul) #5865382b18ba890] - repl: fix tab completion not working with computer string properties (Dario Piotrowicz) #587098c2089683e] - src: add FromV8Value<T>() for integral and enum types (Aditi) #57931a0b1378a20] - src: pass resource on permission checks for spawn (Rafael Gonzaga) #58758dfb0144490] - src: enhance error messages for unknown options (Pietro Marchini) #58677e9c6fa514c] - src: replace std::array with static arrays in contextify (Mert Can Altin) #585804347ce3dba] - src: add new CopyUtimes function to reduce code duplication (Dario Piotrowicz) #58625893999e0ee] - src: replace V8 Fast API todo comment with note comment (Dario Piotrowicz) #586147cdda927fa] - test: fix test-timeout-flag after revert of auto subtest wait (Pietro Marchini) #58282d9c2b7054b] - test: refactor repl save-load tests (Dario Piotrowicz) #587153faa4e8b56] - test: deflake test-buffer-large-size-buffer-alloc-unsafe (Luigi Pinca) #587718eec789888] - test: correct SIMD support comment (Richard Lau) #587676e0ee39b6d] - test: skip the test if the buffer allocation fails (Luigi Pinca) #58738d94b184700] - test: deflake test-buffer-large-size-buffer-alloc (Luigi Pinca) #58734704b1fa075] - test: add tests for REPL custom evals (Dario Piotrowicz) #57850c39d570871] - test: reduce the use of private symbols in test-events-once.js (Yoshiya Hinosawa) #58685b7e488c77f] - test: refactor repl tab complete tests (Dario Piotrowicz) #58636ec808b3e06] - test: usecommon.skipIfInspectorDisabled()to skip tests (Dario Piotrowicz) #5867594e53d4f6c] - test: update WPT for urlpattern to3ffda23(Node.js GitHub Bot) #58537fa089d610f] - test: update WPT for dom/abort todc92816(Node.js GitHub Bot) #58644aa657f0fc4] - test: split indirect eval import tests (Chengzhong Wu) #5863776e3c8aaf2] - test: update WPT for es-exceptions to2f96fa1(Node.js GitHub Bot) #586407e34aa4eaa] - test: skip tests failing when run under root (Livia Medeiros) #5861085f062c22e] - test: deflake async-hooks/test-improper-order on AIX (Baki Gul) #58567181014a8fe] - test: cleanup status files (Filip Skokan) #58633a4d756068d] - test: close FileHandle objects in tests explicitly (James M Snell) #58615a1529d5d99] - test_runner: automatically wait for subtests to finish (Colin Ihrig) #58800dce1995c55] - Revert "test_runner: remove promises returned by t.test()" (Romain Menke) #582828b0c5edbb6] - Revert "test_runner: remove promises returned by test()" (Romain Menke) #582826ef7329c8c] - Revert "test_runner: automatically wait for subtests to finish" (Romain Menke) #58282c9e7b5e43a] - test_runner: preferAtomicsprimordials (Renegade334) #58716713fbad7b6] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #584389df1cfe402] - tools: make nodedownload module compatible with Python 3.14 (Lumír 'Frenzy' Balhar) #58752b5ff3f42b8] - tools: include toolchain.gypi in abseil.gyp (Chengzhong Wu) #58678dc2f23e986] - tools: bumpbrace-expansionin/tools/clang-format(dependabot[bot]) #58699e6a1787140] - tools: bump brace-expansion from 1.1.11 to 1.1.12 in /tools/eslint (dependabot[bot]) #58698b22e970774] - tools: switch to@stylistic/eslint-plugin(Michaël Zasso) #58623268c8c1799] - tools: remove config.status undermake distclean(René) #58603c1f9791844] - tools: edit commit-queue workflow file (Antoine du Hamel) #58667afbaf9277b] - tools: improve release proposal linter (Antoine du Hamel) #5864717df800b90] - typings: add Atomics primordials (Renegade334) #58577ffff8ce3a4] - typings: add ZSTD_COMPRESS, ZSTD_DECOMPRESS to internalBinding (Meghan Denny) #58655ef0230abaf] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #587006f7b89516f] - util: inspect: do not crash on an Error stack pointing to itself (Sam Verschueren) #58196v24.2.0: 2025-06-09, Version 24.2.0 (Current), @aduh95Compare Source
Notable Changes
Remove support for HTTP/2 priority signaling
The support for priority signaling has been removed in nghttp2, following its
deprecation in the RFC 9113.
As a consequence of this, priority signaling is deprecated on all release lines of Node.js,
and removed from Node.js 24 so we can include latest updates from nghttp2.
Contributed by Matteo Collina and Antoine du Hamel in
#58293.
import.meta.mainis now availableBoolean value available in ECMAScript modules, which can be used to detect
whether the current module was the entry point of the current process.
Contributed by Joe and Antoine du Hamel in
#57804.
Other Notable Changes
e13930bbe0] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499984894b38c] - doc: deprecateutil.isNativeErrorin favor ofError.isError(Miguel Marcondes Filho) #58262d261274b0f] - doc: deprecate passing an empty string tooptions.shell(Antoine du Hamel) #58564510872a522] - (SEMVER-MINOR) doc: graduateSymbol.dispose/asyncDisposefrom experimental (James M Snell) #584676f4c9dd423] - (SEMVER-MINOR) fs: addautoCloseoption toFileHandlereadableWebStream (James M Snell) #5854832efb63242] - http: deprecate instantiating classes without new (Yagiz Nizipli) #585180234a8ef53] - (SEMVER-MINOR) http2: add diagnostics channelhttp2.server.stream.finish(Darshan Sen) #585600f1e94f731] - (SEMVER-MINOR) lib: graduate error codes that have been around for years (James M Snell) #5854113abca3c26] - (SEMVER-MINOR) perf_hooks: make event loop delay histogram disposable (James M Snell) #583848ea1fc5f3b] - (SEMVER-MINOR) src: support namespace options in configuration file (Pietro Marchini) #58073d6ea36ad6c] - src,permission: implicit allow-fs-read to app entrypoint (Rafael Gonzaga) #585795936cef60a] - (SEMVER-MINOR) test: add disposable histogram test (James M Snell) #583847a91f4aaa1] - (SEMVER-MINOR) test: add test for async disposable worker thread (James M Snell) #58385532c173cf2] - (SEMVER-MINOR) util: addnonestyle to styleText (James M Snell) #58437aeb9ab4c4c] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #58385Commits
6c92329b1b] - Revert "benchmark: fix broken fs.cpSync benchmark" (Yuesong Jake Li) #584768bc045264e] - benchmark: fix broken fs.cpSync benchmark (Dario Piotrowicz) #5847246aa079cce] - benchmark: add callback-basedfs.globto glob benchmark (Livia Medeiros) #58417a57b05e105] - benchmark: add more options to cp-sync (Sonny) #582788b5ada4b31] - buffer: use Utf8LengthV2() instead of Utf8Length() (Tobias Nießen) #5815622e97362f3] - build: search for libnode.so in multiple places (Jan Staněk) #582130b4056c573] - build: add support for OpenHarmony operating system (hqzing) #58350db7f413dd3] - build: fix pointer compression builds (Joyee Cheung) #581717ff37183e5] - build: fix defaults for shared llhttp (Antoine du Hamel) #58269b8c33190fe] - build,win: fix dll build (Stefan Stojanovic) #58357ef9ecbe8a6] - child_process: give names toChildProcessfunctions (Livia Medeiros) #58370cec9d9d016] - crypto: forward auth tag to OpenSSL immediately (Tobias Nießen) #585479fccb0609f] - crypto: expose crypto.constants.OPENSSL_IS_BORINGSSL (Shelley Vohr) #58387e7c69b9345] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #57269d0b89598a3] - deps: use proper C standard when building libuv (Yaksh Bariya) #585878a1fe7bc6a] - deps: update simdjson to 3.12.3 (Node.js GitHub Bot) #5768236b639b1eb] - deps: update googletest toe9092b1(Node.js GitHub Bot) #58565f8a2a1ef52] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #58566efb28f7895] - deps: V8: cherry-pick249de88(Michaël Zasso) #5856188e621ea97] - deps: update sqlite to 3.50.0 (Node.js GitHub Bot) #582728d2ba386f1] - deps: update OpenSSL gen container to Ubuntu 22.04 (Michaël Zasso) #584327e62a77a7f] - deps: update undici to 7.10.0 (Node.js GitHub Bot) #5844587eebd7bad] - deps: keep required OpenSSL doc files (Michaël Zasso) #5843110910660f6] - deps: update undici to 7.9.0 (Node.js GitHub Bot) #582685e27078ca2] - deps: update ada to 3.2.4 (Node.js GitHub Bot) #581523b1e4bdbbb] - deps: update libuv to 1.51.0 (Node.js GitHub Bot) #581246bddf587ae] - dns: fix dns query cache implementation (Ethan Arrowood) #58404984894b38c] - doc: deprecate utilisNativeError in favor of ErrorisError (Miguel Marcondes Filho) #58262377ef3ce3a] - doc: add support link for panva (Filip Skokan) #5859133a69ff9e4] - doc: update metadata for _transformState deprecation (James M Snell) #58530d261274b0f] - doc: deprecate passing an empty string tooptions.shell(Antoine du Hamel) #58564447ca11010] - doc: correct formatting of example definitions for--test-shard(Jacob Smith) #585712f555e0e19] - doc: clarify DEP0194 scope (Antoine du Hamel) #58504af0446edcb] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #5831380cc17f1ec] - doc: explain child_process code and signal null values everywhere (Darshan Sen) #58479e13930bbe0] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #584995f3f045ecc] - doc: updategit node releaseexample (Antoine du Hamel) #584754bbd026cde] - doc: add missing options.info for ZstdOptions (Jimmy Leung) #58360a6d0d2a0d7] - doc: add missing options.info for BrotliOptions (Jimmy Leung) #58359510872a522] - (SEMVER-MINOR) doc: graduate Symbol.dispose/asyncDispose from experimental (James M Snell) #5846708685256cd] - doc: clarify x509.checkIssued only checks metadata (Filip Skokan) #58457095794fc24] - doc: add links to parent class fornode:zlibclasses (Antoine du Hamel) #584337acac70bce] - doc: remove remaining uses of@@​wellknownsyntax (René) #5841362056d40c7] - doc: clarify behavior of --watch-path and --watch flags (Juan Ignacio Benito) #58136e6e6ae887d] - doc: fix the order ofprocess.mdsections (Allon Murienik) #58403d2f6c82c0f] - doc,lib: update source map links to ECMA426 (Chengzhong Wu) #58597a994d3d51a] - doc,src,test: fix typos (Noritaka Kobayashi) #58477252acc1e89] - errors: show url of unsupported attributes in the error message (Aditi) #58303767e88cbc3] - esm: unwrap WebAssembly.Global on Wasm Namespaces (Guy Bedford) #57525adef9af3ae] - (SEMVER-MINOR) esm: implement import.meta.main (Joe) #57804308f4cac4b] - esm: add support for dynamic source phase hook (Guy Bedford) #58147fcef56cb05] - fs: improve cpSync no-filter copyDir performance (Dario Piotrowicz) #58461996fdb05ab] - fs: fix cp handle existing symlinks (Yuesong Jake Li) #58476d2931e50e3] - fs: fix cpSync handle existing symlinks (Yuesong Jake Li) #584766f4c9dd423] - (SEMVER-MINOR) fs: add autoClose option to FileHandle readableWebStream (James M Snell) #585488870bb8677] - fs: improvecpSyncdest overriding performance (Dario Piotrowicz) #58160f2e2301559] - fs: unexpose internal constants (Chengzhong Wu) #5832732efb63242] - http: deprecate instantiating classes without new (Yagiz Nizipli) #585180b987e5741] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #5829344ca874b2c] - http2: add lenient flag for RFC-9113 (Carlos Fuentes) #581160234a8ef53] - (SEMVER-MINOR) http2: add diagnostics channel 'http2.server.stream.finish' (Darshan Sen) #585602b868e8aa7] - http2: add diagnostics channel 'http2.server.stream.error' (Darshan Sen) #58512b4df8d38cd] - http2: add diagnostics channel 'http2.server.stream.start' (Darshan Sen) #58449d86ff608bb] - http2: remove no longer userful options.selectPadding (Jimmy Leung) #5837313dbbdc8a8] - http2: add diagnostics channel 'http2.server.stream.created' (Darshan Sen) #5839008855464ec] - http2: add diagnostics channel 'http2.client.stream.close' (Darshan Sen) #58329566fc567b8] - http2: add diagnostics channel 'http2.client.stream.finish' (Darshan Sen) #58317f30b9117d4] - http2: add diagnostics channel 'http2.client.stream.error' (Darshan Sen) #5830679b852a692] - inspector: add mimeType and charset support to Network.Response (Shima Ryuhei) #58192402ac8b1d8] - inspector: add protocol method Network.dataReceived (Chengzhong Wu) #5800129f34a7f86] - lib: disable REPL completion on proxies and getters (Dario Piotrowicz) #579090f1e94f731] - (SEMVER-MINOR) lib: graduate error codes that have been around for years (James M Snell) #58541cc1aacabb0] - lib: make ERM functions into wrappers returning undefined (Livia Medeiros) #584008df4dee38c] - lib: remove no-mixed-operators eslint rule (Ruben Bridgewater) #58375104d173f58] - meta: bump github/codeql-action from 3.28.16 to 3.28.18 (dependabot[bot]) #58552b454e8386c] - meta: bump codecov/codecov-action from 5.4.2 to 5.4.3 (dependabot[bot]) #58551f31e014b81] - meta: bump step-security/harden-runner from 2.11.0 to 2.12.0 (dependabot[bot]) #581094da920cc13] - meta: bump ossf/scorecard-action from 2.4.1 to 2.4.2 (dependabot[bot]) #58550eb9bb95fe2] - meta: bump rtCamp/action-slack-notify from 2.3.2 to 2.3.3 (dependabot[bot]) #5810827ada1f18c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #584564606a6792b] - meta: bump github/codeql-action from 3.28.11 to 3.28.16 (dependabot[bot]) #581127dfe448b7f] - meta: bump codecov/codecov-action from 5.4.0 to 5.4.2 (dependabot[bot]) #5811018bb5f7e7e] - meta: bump actions/download-artifact from 4.2.1 to 4.3.0 (dependabot[bot]) #5810672f2a22889] - module: clarify cjs global-like error on ModuleJobSync (Carlos Espa) #56491b0e0b1afae] - net: always publish to 'net.client.socket' diagnostics channel (Darshan Sen) #58349f373d6a540] - node-api: use WriteOneByteV2 in napi_get_value_string_latin1 (Chengzhong Wu) #58325429c38db1b] - node-api: use WriteV2 in napi_get_value_string_utf16 (Tobias Nießen) #58165b882148999] - path: improve path.resolve() performance when used as process.cwd() (Ruben Bridgewater) #5836213abca3c26] - (SEMVER-MINOR) perf_hooks: make event loop delay histogram disposable (James M Snell) #583841cd417d823] - permission: remove useless conditional (Juan José) #58514462c4b0c24] - readline: add stricter validation for functions called after closed (Dario Piotrowicz) #58283e3e36f902c] - repl: extract and standardize history from both repl and interface (Giovanni Bucci) #58225cbb2a0172f] - report: use uv_getrusage_thread in report (theanarkh) #584053a6bd9c4c4] - sqlite: handle thrown errors in result callback (Colin Ihrig) #584260d761bbccd] - src: env_vars caching and local variable scope optimization (Mert Can Altin) #576248ea1fc5f3b] - (SEMVER-MINOR) src: support namespace options in configuration file (Pietro Marchini) #58073f72ce2ef75] - src: remove fast API for InternalModuleStat (Joyee Cheung) #584898a1eaea151] - src: update std::vector<v8::Local<T>> to use v8::LocalVector<T> (Aditi) #58500d99d657842] - src: fix FIPS init error handling (Tobias Nießen) #5837911e4cd698b] - src: fix possible dereference of null pointer (Eusgor) #58459ca0f5a0188] - src: add env->cppgc_allocation_handle() convenience method (James M Snell) #58483440d4f42bd] - src: fix -Wreturn-stack-address error (Shelley Vohr) #5843908615b1020] - src: prepare for v8 sandboxing (James M Snell) #5837663f643e844] - src: reorganize ContextifyFunction methods (Chengzhong Wu) #584343b6895a506] - src: improve CompileFunctionAndCacheResult error handling (Chengzhong Wu) #584347f1c95aee8] - src: make a number of minor improvements to buffer (James M Snell) #58377ce081bcb9a] - src: fix build when using shared simdutf (Antoine du Hamel) #58407a35cc216e5] - src: track cppgc wrappers with a list in Realm (Joyee Cheung) #56534947c1c2cd5] - src,lib: obtain sourceURL in magic comments from V8 (Chengzhong Wu) #58389d6ea36ad6c] - src,permission: implicit allow-fs-read to app entrypoint (Rafael Gonzaga) #58579e8a07f2198] - stream: making DecompressionStream spec compilent for trailing junk (0hm☘️) #583163caa2f71c1] - stream: test explicit resource management implicitly (LiviaMedeiros) #582969ccdf4fdb4] - test: improve flakiness detection on stack corruption tests (Darshan Sen) #58601d3fea003df] - test: mark timeouts & flaky test as flaky on IBM i (Abdirahim Musse) #585838347ef6b53] - test: dispose of filehandles in filehandle.read tests (Livia Medeiros) #5854334e86f91aa] - test: rewrite test-child-process-spawn-args (Michaël Zasso) #58546d7a2458a58] - test: make sqlite-database-sync tests work with system sqlite (Jelle Licht) #585074d9d6830e0] - test: force slow JSON.stringify path for overflow (Shelley Vohr) #58181bef67e45e3] - test: account for truthy signal in flaky async_hooks tests (Darshan Sen) #58478007c82f206] - test: marktest-http2-debugas flaky on LinuxONE (Richard Lau) #5849421f6400098] - test: update WPT for WebCryptoAPI to591c95c(Node.js GitHub Bot) #581761deb5f06a5] - test: remove --no-warnings flag (Tobias Nießen) #58424beba631a10] - test: add tests ensuring worker threads cannot access internals (Joe) #583325936cef60a] - (SEMVER-MINOR) test: add disposable histogram test (James M Snell) #583847a91f4aaa1] - (SEMVER-MINOR) test: add test for async disposable worker thread (James M Snell) #583855fc4706280] - test: leverage process.features.openssl_is_boringssl in test (Shelley Vohr) #584214629b18397] - test: fix test-buffer-tostring-range on allocation failure (Joyee Cheung) #584164c445a8c85] - test: skip in test-buffer-tostring-rangeerror on allocation failure (Joyee Cheung) #5841553cb29898b] - test: fix missing edge case in test-blob-slice-with-large-size (Joyee Cheung) #5841489fdfdedc1] - test: make crypto tests work with BoringSSL (Shelley Vohr) #581173b5d0e62b1] - test: test reordering of setAAD and setAuthTag (Tobias Nießen) #58396029440bec5] - test: switch from deprecatedoptparsetoargparse(Aviv Keller) #58224d05263edcc] - test: do not skip OCB decryption in FIPS mode (Tobias Nießen) #5838223474cb257] - test: show more information in test-http2-debug upon failure (Joyee Cheung) #58391d0302e7b3d] - test: remove loop over single element (Tobias Nießen) #5836833f615897d] - test: add chacha20-poly1305 to auth tag order test (Tobias Nießen) #583678f09a1f502] - test: skip wasm-allocation tests for pointer compression builds (Joyee Cheung) #581714ae6a1a5ed] - test: remove references to create(De|C)ipher (Tobias Nießen) #583634d647271b2] - test_runner: emit event when file changes in watch mode (Jacopo Martinelli) #579031eda87c365] - test_runner: add level parameter to reporter.diagnostic (Jacopo Martinelli) #5792313377512be] - tools: bump the eslint group in/tools/eslintwith 6 updates (dependabot[bot]) #58549fcc881de0d] - tools: supportDisposableStackandAsyncDisposableStackin linter (LiviaMedeiros) #58454208d6a5754] - tools: support explicit resource management in eslint (LiviaMedeiros) #5829632070f304a] - tools: add missing highway defines for IBM i (Abdirahim Musse) #58335ddab63a323] - tty: improve color terminal color detection (Ruben Bridgewater) #58146c094bea8d9] - tty: use terminal VT mode on Windows (Anna Henningsen) #58358dc21054a1e] - typings: add inspector internalBinding typing (Shima Ryuhei) #584923499285904] - typings: remove no longer validFixedSizeBlobCopyJobtype (Dario Piotrowicz) #583051ed2deb2c8] - typings: remove no longer validrevokeDataObjecttype (Dario Piotrowicz) #58305532c173cf2] - (SEMVER-MINOR) util: add 'none' style to styleText (James M Snell) #584372d5a1ef528] - vm: import call should return a promise in the current context (Chengzhong Wu) #58309588c2449f2] - win,tools: use Azure Trusted Signing (Stefan Stojanovic) #58502aeb9ab4c4c] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #5838523416cce0a] - worker: give names toMessagePortfunctions (Livia Medeiros) #5830744df21b7fb] - zlib: remove mentions of unexposed Z_TREES constant (Jimmy Leung) #58371v24.1.0: 2025-05-21, Version 24.1.0 (Current), @aduh95Compare Source
Notable Changes
9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308fcead7c28e] - (SEMVER-MINOR) fs: add toDirsupport for explicit resource management (Antoine du Hamel) #58206f7041b9369] - Revert "test_runner: change ts default glob" (Théo LUDWIG) #58202Commits
b33e8d2a71] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #58149a1b078b18c] - buffer: give names toBuffer.prototype.*Write()functions (Livia Medeiros) #582584c967b73c3] - buffer: use constexpr where possible (Yagiz Nizipli) #58141327095a928] - build: fix uvwasi pkgname (Antoine du Hamel) #582702e54653d3d] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #580907e4453fe93] - build: escape > metachar in vcbuild (Gerhard Stöbich) #581577dabf079b1] - child_process: give names to promisifiedexec()andexecFile()(LiviaMedeiros) #57916a896eff1f2] - crypto: handle missing OPENSSL_TLS_SECURITY_LEVEL (Shelley Vohr) #581036403aa458f] - crypto: merge CipherBase.initiv into constructor (Tobias Nießen) #5816630897d915c] - deps: V8: backport1d3362c(Shu-yu Guo) #5823063f5d69d2b] - deps: V8: cherry-pick4f38995(Shu-yu Guo) #582305a5f6bb1d4] - deps: V8: cherry-pick044b9b6(Rezvan Mahdavi Hezaveh) #58230db57f0a4c0] - deps: patch V8 to 13.6.233.10 (Michaël Zasso) #58230f54a7a44ab] - Revert "deps: patch V8 to support compilation with MSVC" (Michaël Zasso) #58187e3193eeca4] - Revert "deps: always define V8_EXPORT_PRIVATE as no-op" (Michaël Zasso) #58187e75ecf8ad1] - Revert "deps: disable V8 concurrent sparkplug compilation" (Michaël Zasso) #58187a0ca15558d] - deps: update llhttp to 9.3.0 (Fedor Indutny) #5814490d4c11992] - deps: update amaro to 0.5.3 (Node.js GitHub Bot) #581749d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #583552676ca0cf5] - doc: add latest security release steward (Rafael Gonzaga) #58339c35cc1bdd9] - doc: document default test-reporter change (Nico Jansen) #583022bb433d4a5] - doc: fix CryptoKey.algorithm type and other interfaces in webcrypto.md (Filip Skokan) #58294f04f09d783] - doc: mark the callback argument of crypto.generatePrime as mandatory (Allon Murienik) #582993b9b010844] - doc: remove comma delimiter mention on permissions doc (Rafael Gonzaga) #58297f0cf1a028d] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291a1b937bdee] - doc: update commit-queue documentation (Dario Piotrowicz) #58275b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308fc30cdd8d2] - doc: update stability status for diagnostics_channel to experimental (Idan Goshen) #58261290a5ab8ca] - doc: clarify napi_get_value_string_* for bufsize 0 (Tobias Nießen) #58158c26863a683] - doc: fix typo of filehttp.md,outgoingMessage.setTimeoutsection (yusheng chen) #5818862dbd36dcb] - doc: update return types for eventNames method in EventEmitter (Yukihiro Hasegawa) #58083130c135f38] - fs: add support forURLforfs.glob'scwdoption (Antoine du Hamel) #58182fcead7c28e] - (SEMVER-MINOR) fs: add toDirsupport for explicit resource management (Antoine du Hamel) #58206655326ba9f] - fs: glob is stable, so should not emit experimental warnings (Théo LUDWIG) #582366ebcce7625] - fs: ensuredir.read()does not throw synchronously (Antoine du Hamel) #582287715722323] - http: remove unused functions and add todos (Yagiz Nizipli) #5814374a807e31f] - http,https: give names to anonymous or misnamed functions (Livia Medeiros) #5818024a9aefb08] - http2: add diagnostics channel 'http2.client.stream.start' (Darshan Sen) #582922cb86a3cd6] - http2: add diagnostics channel 'http2.client.stream.created' (Darshan Sen) #582468f1aee90d9] - http2: give name to promisifiedconnect()(LiviaMedeiros) #57916b66f1b0be6] - inspector: support for worker inspection in chrome devtools (Shima Ryuhei) #56759868e72e367] - lib: fix sourcemaps with ts module mocking (Marco Ippolito) #58193570cb6f6b6] - meta: ignore mailmap changes in linux ci (Jonas Badalic) #58356b94f63b865] - module: handle instantiated async module jobs in require(esm) (Joyee Cheung) #58067714b706f2e] - repl: add proper vertical cursor movements (Giovanni Bucci) #58003629a954477] - repl: add possibility to edit multiline commands while adding them (Giovanni Bucci) #5800317746129f3] - sqlite: setnameandlengthonsqlite.backup()(Livia Medeiros) #58251908782b1c0] - sqlite: add build option to build without sqlite (Michael Dawson) #58122a92a4074e4] - src: remove unusedinternalVerifyIntegrityinternal binding (Dario Piotrowicz) #58285e0355b71ba] - src: add a variant of ToV8Value() for primitive arrays (Aditi) #57576cb24fc71c4] - src: remove unusedcheckMessagePortinternal binding (Dario Piotrowicz) #582674db5d0bc49] - src: remove unusedshouldRetryAsESMinternal binding (Dario Piotrowicz) #582653b8d4e32ca] - src: add a couple fast apis in node_os (James M Snell) #58210a135c0aea3] - src: remove unneeded explicit V8 flags (Michaël Zasso) #58230abeb5c4cdc] - src: fix module buffer allocation (X-BW) #577389ca4b46eb3] - src: use String::WriteV2() in TwoByteValue (Tobias Nießen) #58164bb28e2bfd7] - src: remove overzealous tcsetattr error check (Ben Noordhuis) #58200329e008e73] - src: refactor WriteUCS2 and remove flags argument (Tobias Nießen) #58163c815f29d61] - src: remove NonCopyableMaybe (Tobias Nießen) #58168685d137dec] - test: reduce iteration count in test-child-process-stdout-flush-exit (Antoine du Hamel) #5827340dc092e25] - test: remove unnecessaryconsole.logfrom test-repl-null-thrown (Dario Piotrowicz) #58281a3af644dda] - test: allowtmpDir.pathto be modified (Aviv Keller) #5817397f80374a6] - test: addFloat16Arraytocommon.getArrayBufferViews()(Livia Medeiros) #5823365683735ab] - test: fix executable flags (Livia Medeiros) #58250ebb82aa1c3] - test: deflake test-http2-client-socket-destroy (Luigi Pinca) #58212eb4f130b17] - test: remove Float16Array flag (Livia Medeiros) #5818409a85fdeb1] - test: skip test-buffer-tostring-rangeerror when low on memory (Ruben Bridgewater) #5814265446632b1] - test: reduce flakiness in test-heapdump-http2 (Joyee Cheung) #58148f7041b9369] - Revert "test_runner: change ts default glob" (Théo LUDWIG) #58202287454298d] - test_runner: unify --require and --import behavior when isolation none (Pietro Marchini) #579246301b003f7] - tools: ignoredeps/andbenchmark/for CodeQL (Rafael Gonzaga) #582542d5de7e309] - tools: add read permission to workflows that read contents (Antoine du Hamel) #58255b8d4715527] - tools: support environment variables via comments (Pietro Marchini) #58186d8e88f2c17] - typings: add missing typings forTypedArray(Jason Zhang) #582484c6f73c5d5] - url: improve performance of the format function (Giovanni Bucci) #5709994c720c4ee] - util: add internalassignFunctionName()function (LiviaMedeiros) #579163ed159afd1] - watch: fix watch args not being properly filtered (Dario Piotrowicz) #58279v24.0.2: 2025-05-14, Version 24.0.2 (Current), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Commits
7d0c17b2ad] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688v24.0.1: 2025-05-08, Version 24.0.1 (Current), @aduh95Compare Source
Notable Changes
2e1d9581e0] - Revert "buffer: move SlowBuffer to EOL" (Filip Skokan) #58211Commits
d38e811c5b] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #581282e1d9581e0] - Revert "buffer: move SlowBuffer to EOL" (Filip Skokan) #58211a883b0c979] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #581153d84b5c7a4] - doc: add HBSPS as triager (Wiyeong Seo) #579801e57cb686e] - doc: add history entries to--input-typesection (Antoine du Hamel) #581750b54f06b6f] - doc: add ambassaor message (Brian Muenzenmeyer) #5760046bee52d57] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145e732a8bfdd] - doc: fix typo in benchmark script path (Miguel Marcondes Filho) #58129d49ff34adb] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456bc9f5a2e79] - doc: fix typo of filezlib.md(yusheng chen) #58093c8e8558958] - doc: clarify future Corepack removal in v25+ (Trivikram Kamat) #57825b13d5d14bd] - meta: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot[bot]) #581110ebb17a300] - meta: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot[bot]) #581075946785bf4] - tools: exclude deps/v8/tools from CodeQL scans (Rich Trott) #581320708497c7f] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #58105v24.0.0: 2025-05-06, Version 24.0.0 (Current), @RafaelGSS and @juanarbolCompare Source
We’re excited to announce the release of Node.js 24! This release brings
several significant updates, including the upgrade of the V8 JavaScript
engine to version 13.6 and npm to version 11. Starting with
Node.js 24, support for MSVC has been removed, and ClangCL is now required
to compile Node.js on Windows. The
AsyncLocalStorageAPI now usesAsyncContextFrameby default, andURLPatternis available globally.These changes, along with many other improvements, continue to push the
platform forward.
As a reminder, Node.js 24 will enter long-term support (LTS) in October,
but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this
latest release and evaluate their potential impact on your applications.
Notable Changes
V8 13.6
The V8 engine is updated to version 13.6, which includes several new
JavaScript features:
Float16ArrayRegExp.escapeError.isErrorThe V8 update was a contribution by Michaël Zasso in #58070.
npm 11
Node.js 24 comes with npm 11, which includes several improvements and new
features. This update brings enhanced performance, improved security features,
and better compatibility with modern JavaScript packages.
The npm update was a contribution by the npm team in #56274.
AsyncLocalStoragedefaults toAsyncContextFrameAsyncLocalStoragenow usesAsyncContextFrameby default, which provides amore efficient implementation of asynchronous context tracking.
This change improves performance and makes the API more robust for advanced
use cases.
This change was a contribution by Stephen Belanger in #55552.
URLPatternas a globalThe
URLPatternAPI is now exposed on the global object, making it easier to use without
explicit imports. This API provides a powerful pattern matching system for URLs,
similar to how regular expressions work for strings.
This feature was a contribution by Jonas Badalič in #56950.
Permission Model Improvements
The experimental Permission Model introduced in Node.js 20 has been improved,
and the flag has been changed from
--experimental-permissionto simply--permission, indicating its increasing stability and readiness for broaderadoption.
This change was a contribution by Rafael Gonzaga in #56240.
Test Runner Enhancements
The test runner module now automatically waits for subtests to finish,
eliminating the need to manually await test promises. This makes writing tests
more intuitive and reduces common errors related to unhandled promises.
The test runner improvements were contributions by Colin Ihrig in #56664.
Undici 7
Node.js 24 includes Undici 7, which brings numerous improvements to the
HTTP client capabilities, including better performance and support for newer
HTTP features.
Deprecations and Removals
Several APIs have been deprecated or removed in this release:
url.parse()- use the WHATWG URL API instead (#55017)tls.createSecurePair(#57361)SlowBuffer(#55175)new(#55718)argstospawnandexecFilein child_process (#57199)Semver-Major Commits
c6b934380a] - (SEMVER-MAJOR) src: enableFloat16Arrayon global object (Michaël Zasso) #5815469efb81a73] - (SEMVER-MAJOR) src: enable explicit resource management (Michaël Zasso) #58154b00ff4270e] - (SEMVER-MAJOR) src,test: unregister the isolate after disposal and before freeing (Joyee Cheung) #58070b81697d860] - (SEMVER-MAJOR) src: use non-deprecated WriteUtf8V2() method (Yagiz Nizipli) #580701f06169b87] - (SEMVER-MAJOR) src: use non-deprecated Utf8LengthV2() method (Yagiz Nizipli) #58070eae9a296f0] - (SEMVER-MAJOR) src: use V8-owned CppHeap (Joyee Cheung) #58070087c254a11] - (SEMVER-MAJOR) test: fix test-fs-write for V8 13.6 (Michaël Zasso) #580709e49bedd8e] - (SEMVER-MAJOR) build: update list of installed cppgc headers (Michaël Zasso) #5807093cca8a43e] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.6 (Michaël Zasso) #58070347daa07be] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.5 (Michaël Zasso) #580702a35d5a86c] - (SEMVER-MAJOR) build: fix V8 TLS config for shared lib builds (Michaël Zasso) #58070b0fb5a09cf] - (SEMVER-MAJOR) build: pass-fPICto linker as well for shared builds (Michaël Zasso) #58070dd4c5d6c73] - (SEMVER-MAJOR) src,test: add V8 API to test the hash seed (Michaël Zasso) #580701d5d7b6eed] - (SEMVER-MAJOR) src: usev8::ExternalMemoryAccounter(Michaël Zasso) #580703779e43cce] - (SEMVER-MAJOR) tools: update license-builder and LICENSE for V8 deps (Michaël Zasso) #5807082c2255206] - (SEMVER-MAJOR) deps: remove deps/simdutf (Michaël Zasso) #580708a258eb7b1] - (SEMVER-MAJOR) test: handle explicit resource management globals (Michaël Zasso) #580709e0d9b6024] - (SEMVER-MAJOR) test: adapt assert tests to stack trace changes (Michaël Zasso) #58070f7406aa56d] - (SEMVER-MAJOR) test: update test-linux-perf-logger (Michaël Zasso) #58070c7493fac5e] - (SEMVER-MAJOR) Revert "test: disable fast API call count