src,lib: stabilize permission model #56201

RafaelGSS · 2024-12-10T03:07:58Z

This PR upgrades the Permission Model from 1.1 (Active Development) to 2.0 (Stable).

I’ve been diving deep into the Permission Model since its release in Node.js 20.0.0, looking at its limitations and what’s been fixed so far. Most of the technical challenges have been addressed, except for how symlinks are handled. After a lot of research, it turns out this isn’t fixable due to how the Permission Model relies on file paths, making TOCTOU issues theoretically possible. This isn’t unique to Node.js though—even Deno’s permission system has similar behaviour (see this article).

Since the feature’s release, there’s been a shift in how we think about security in Node.js. We’ve leaned into a "Defense in Depth" approach—recognizing that no single feature will let you run untrusted code safely. Instead, these features are like seatbelts: they reduce risk significantly (let’s say 90% of cases, though that’s not a hard number) but won’t stop everything. This aligns with our threat model, and the Permission Model reflects that philosophy.

The only remaining "limitation" is symlink behaviour. Fixing this would require changing how the Permission Model works at a fundamental level. It’s not feasible because TOCTOU issues are always a possibility when operating on file paths. Importantly, this isn’t just a Node.js thing—other runtimes face the same challenge.

That said, symlinks aren’t a dealbreaker:

The Permission Model blocks symlink creation by default.
An attacker would need an exact map of existing symlinks in your system to do something harmful. That’s a very unlikely scenario.
If you explicitly allow access to something like /proc/, you’re responsible for understanding what that includes. The docs already cover this.

I have been talking with @tniessen in private as he has been indirectly involved in this feature (by raising concerns or suggestions). Some questions that he raised, and that I expect some of you might raise here too, were:

"Most importantly, is anyone actually using the permission model? What is the use case and what security expectations do these users have?"

As with any non-popular feature, it's hard to assess its usage in the ecosystem, but we have received some issues in the security-wg repository that could mean people are evaluating its usage:

[Bug]：use pm2 and --experimental-permission, throw Error: Access to this API has been restricted security-wg#1330
Is it possible to make a process.send cmd: "NODE_*" attack while under --experimental-pemission? security-wg#1156
Can I use --experimental-permission in new worker_threads.Worder's execArgv? security-wg#1043 (same author of b)
How to includes "," or "*" char self in --allow-fs-read? security-wg#1039 (same author of b)
Permission Model - Roadmap security-wg#898 (comment)
Segmentation fault when using inspector on experimental permission enabled process #53385
Experimental permission wildcards seem to not be additive #50659
Node should log denied path by permission restriction #49080
There are more, but I don't think I should list all of them here.

I was also approached by many people on social media saying "thanks" for the feature and that they are looking forward to having it established. I also understand that testing a feature is different from using this feature in production.

"Following up on that, what security guarantees does the permission model provide, if any? Do those security guarantees actually match the security expectations of the people that actively use the permission model today?"

The Permission Model is most useful in development environments or scenarios where you want extra guardrails, but it doesn’t replace the core rule: don’t run untrusted code in Node.js.

If you configure it correctly, it’ll block most unwanted filesystem access, but it’s not a magic bullet. It’s a tool that works well when used as intended, and it complements Node.js’ broader security posture.

cc: @nodejs/security-wg

nodejs-github-bot · 2024-12-10T03:08:03Z

Review requested:

@nodejs/performance
@nodejs/security-wg

github-actions · 2024-12-10T03:08:09Z

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @RafaelGSS.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

codecov · 2024-12-10T04:21:34Z

Codecov Report

Attention: Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 88.53%. Comparing base (f184a0a) to head (ab96885).
Report is 192 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/process/pre_execution.js	66.66%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #56201   +/-   ##
=======================================
  Coverage   88.53%   88.53%           
=======================================
  Files         657      657           
  Lines      189858   189899   +41     
  Branches    36450    36464   +14     
=======================================
+ Hits       168089   168130   +41     
- Misses      14973    14977    +4     
+ Partials     6796     6792    -4

Files with missing lines	Coverage Δ
lib/internal/process/permission.js	`69.44% <100.00%> (ø)`
src/env.cc	`85.45% <100.00%> (ø)`
src/node_options.cc	`87.98% <100.00%> (+0.10%)`	⬆️
src/node_options.h	`98.29% <100.00%> (ø)`
lib/internal/process/pre_execution.js	`90.69% <66.66%> (+0.13%)`	⬆️

... and 26 files with indirect coverage changes

mertcanaltin

lgtm

targos · 2024-12-10T10:53:41Z

You could add a flag alias so this is not semver-major.

mcollina

lgtm

Move permission model from 1.1 (Active Development) to 2.0 (Stable).

nodejs-github-bot · 2024-12-10T19:13:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/63980/

nodejs-github-bot · 2024-12-10T23:27:48Z

CI: https://ci.nodejs.org/job/node-test-pull-request/63988/

test/fixtures/dotenv/node-options.env

doc/api/cli.md

Refs: nodejs#56201

Move permission model from 1.1 (Active Development) to 2.0 (Stable). PR-URL: #56201 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Santiago Gimeno <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]>

Notable changes: crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 module: * (SEMVER-MINOR) add prefix-only modules to `module.builtinModules` (Jordan Harband) #56185 * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 stream: * (SEMVER-MINOR) handle generator destruction from Duplex.from() (Matthieu Sieben) #55096 PR-URL: #56310

Notable changes: crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 module: * (SEMVER-MINOR) add prefix-only modules to `module.builtinModules` (Jordan Harband) #56185 * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 stream: * (SEMVER-MINOR) handle generator destruction from Duplex.from() (Matthieu Sieben) #55096 PR-URL: TODO

Notable changes: crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 module: * (SEMVER-MINOR) add prefix-only modules to `module.builtinModules` (Jordan Harband) #56185 * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 stream: * (SEMVER-MINOR) handle generator destruction from Duplex.from() (Matthieu Sieben) #55096 PR-URL: #56310

Move permission model from 1.1 (Active Development) to 2.0 (Stable). PR-URL: #56201 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Santiago Gimeno <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]>

Notable changes: crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) #56087 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 module: * (SEMVER-MINOR) add prefix-only modules to `module.builtinModules` (Jordan Harband) #56185 * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698 * (SEMVER-MINOR) implement module.registerHooks() (Joyee Cheung) #55698 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 PR-URL: #56310

Move permission model from 1.1 (Active Development) to 2.0 (Stable). PR-URL: #56201 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Santiago Gimeno <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]>

Notable changes: assert: * (SEMVER-MINOR) add partialDeepStrictEqual (Giovanni Bucci) #54630 cli: * (SEMVER-MINOR) implement --trace-env and --trace-env-[js|native]-stack (Joyee Cheung) #55604 crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) #56087 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 * move typescript support to active development (Marco Ippolito) #55536 * add LJHarb to collaborators (Jordan Harband) #56132 * (SEMVER-MINOR) add report version and history section (Chengzhong Wu) #55697 * (SEMVER-MINOR) sort --report-exclude alphabetically (Rafael Gonzaga) #55697 doc,lib,src,test: * (SEMVER-MINOR) unflag sqlite module (Colin Ihrig) #55890 module: * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) add module.stripTypeScriptTypes (Marco Ippolito) #55282 * (SEMVER-MINOR) simplify `findPackageJSON` implementation (Antoine du Hamel) #55412 * (SEMVER-MINOR) add `findPackageJSON` util (Jacob Smith) #55412 net: * (SEMVER-MINOR) support blocklist in net.connect (theanarkh) #56075 * (SEMVER-MINOR) add SocketAddress.parse (James M Snell) #56076 * (SEMVER-MINOR) add net.BlockList.isBlockList(value) (James M Snell) #56078 * (SEMVER-MINOR) support blocklist for net.Server (theanarkh) #56079 process: * (SEMVER-MINOR) deprecate `features.{ipv6,uv}` and `features.tls_*` (René) #55545 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 * (SEMVER-MINOR) add `StatementSync.prototype.iterate` method (tpoisseau) #54213 src: * (SEMVER-MINOR) add cli option to preserve env vars on dr (Rafael Gonzaga) #55697 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 util: * (SEMVER-MINOR) add sourcemap support to getCallSites (Marco Ippolito) #55589 PR-URL: TODO

Notable changes: assert: * (SEMVER-MINOR) add partialDeepStrictEqual (Giovanni Bucci) #54630 cli: * (SEMVER-MINOR) implement --trace-env and --trace-env-[js|native]-stack (Joyee Cheung) #55604 crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) #56087 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 * move typescript support to active development (Marco Ippolito) #55536 * add LJHarb to collaborators (Jordan Harband) #56132 * (SEMVER-MINOR) add report version and history section (Chengzhong Wu) #55697 * (SEMVER-MINOR) sort --report-exclude alphabetically (Rafael Gonzaga) #55697 doc,lib,src,test: * (SEMVER-MINOR) unflag sqlite module (Colin Ihrig) #55890 module: * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) add module.stripTypeScriptTypes (Marco Ippolito) #55282 * (SEMVER-MINOR) simplify `findPackageJSON` implementation (Antoine du Hamel) #55412 * (SEMVER-MINOR) add `findPackageJSON` util (Jacob Smith) #55412 net: * (SEMVER-MINOR) support blocklist in net.connect (theanarkh) #56075 * (SEMVER-MINOR) add SocketAddress.parse (James M Snell) #56076 * (SEMVER-MINOR) add net.BlockList.isBlockList(value) (James M Snell) #56078 * (SEMVER-MINOR) support blocklist for net.Server (theanarkh) #56079 process: * (SEMVER-MINOR) deprecate `features.{ipv6,uv}` and `features.tls_*` (René) #55545 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 * (SEMVER-MINOR) add `StatementSync.prototype.iterate` method (tpoisseau) #54213 src: * (SEMVER-MINOR) add cli option to preserve env vars on dr (Rafael Gonzaga) #55697 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 util: * (SEMVER-MINOR) add sourcemap support to getCallSites (Marco Ippolito) #55589 PR-URL: #56329

Move permission model from 1.1 (Active Development) to 2.0 (Stable). PR-URL: #56201 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Santiago Gimeno <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]>

Notable changes: assert: * (SEMVER-MINOR) add partialDeepStrictEqual (Giovanni Bucci) #54630 cli: * (SEMVER-MINOR) implement --trace-env and --trace-env-[js|native]-stack (Joyee Cheung) #55604 crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) #56087 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 * move typescript support to active development (Marco Ippolito) #55536 * add LJHarb to collaborators (Jordan Harband) #56132 * (SEMVER-MINOR) add report version and history section (Chengzhong Wu) #55697 * (SEMVER-MINOR) sort --report-exclude alphabetically (Rafael Gonzaga) #55697 doc,lib,src,test: * (SEMVER-MINOR) unflag sqlite module (Colin Ihrig) #55890 module: * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) add module.stripTypeScriptTypes (Marco Ippolito) #55282 * (SEMVER-MINOR) simplify `findPackageJSON` implementation (Antoine du Hamel) #55412 * (SEMVER-MINOR) add `findPackageJSON` util (Jacob Smith) #55412 net: * (SEMVER-MINOR) support blocklist in net.connect (theanarkh) #56075 * (SEMVER-MINOR) add SocketAddress.parse (James M Snell) #56076 * (SEMVER-MINOR) add net.BlockList.isBlockList(value) (James M Snell) #56078 * (SEMVER-MINOR) support blocklist for net.Server (theanarkh) #56079 process: * (SEMVER-MINOR) deprecate `features.{ipv6,uv}` and `features.tls_*` (René) #55545 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 * (SEMVER-MINOR) add `StatementSync.prototype.iterate` method (tpoisseau) #54213 src: * (SEMVER-MINOR) add cli option to preserve env vars on dr (Rafael Gonzaga) #55697 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 util: * (SEMVER-MINOR) add sourcemap support to getCallSites (Marco Ippolito) #55589 PR-URL: #56329

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `23.4.0` -> `23.5.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v23.5.0`](https://github.com/nodejs/node/releases/tag/v23.5.0): 2024-12-19, Version 23.5.0 (Current), @aduh95 [Compare Source](nodejs/node@v23.4.0...v23.5.0) ##### Notable Changes ##### WebCryptoAPI [`Ed25519`](nodejs/node@Ed25519) and X25519 algorithms are now stable Following the merge of Curve25519 into the [Web Cryptography API Editor's Draft](https://w3c.github.io/webcrypto/) the `Ed25519` and `X25519` algorithm identifiers are now stable and will no longer emit an ExperimentalWarning upon use. Contributed by Filip Skokan in [#56142](nodejs/node#56142). ##### On-thread hooks are back This release introduces `module.registerHooks()` for registering module loader customization hooks that are run for all modules loaded by `require()`, `import` and functions returned by `createRequire()` in the same thread, which makes them easier for CJS monkey-patchers to migrate to. ```mjs import assert from 'node:assert'; import { registerHooks, createRequire } from 'node:module'; import { writeFileSync } from 'node:fs'; writeFileSync('./bar.js', 'export const id = 123;', 'utf8'); registerHooks({ resolve(specifier, context, nextResolve) { const replaced = specifier.replace('foo', 'bar'); return nextResolve(replaced, context); }, load(url, context, nextLoad) { const result = nextLoad(url, context); return { ...result, source: result.source.toString().replace('123', '456'), }; }, }); // Checks that it works with require. const require = createRequire(import.meta.url); const required = require('./foo.js'); // Redirected by resolve hook to bar.js assert.strictEqual(required.id, 456); // Replaced by load hook to 456 // Checks that it works with import. const imported = await import('./foo.js'); // Redirected by resolve hook to bar.js assert.strictEqual(imported.id, 456); // Replaced by load hook to 456 ``` This complements the `module.register()` hooks - the new hooks fit better internally and cover all corners in the module graph; whereas `module.register()` previously could not cover `require()` while it was on-thread, and still cannot cover `createRequire()` after being moved off-thread. They are also run in the same thread as the modules being loaded and where the hooks are registered, which means they are easier to debug (no more `console.log()` getting lost) and do not have the many deadlock issues haunting the `module.register()` hooks. The new API also takes functions directly so that it's easier for intermediate loader packages to take user options from files that the hooks can't be aware of, like many existing CJS monkey-patchers do. Contributed by Joyee Cheung in [#55698](nodejs/node#55698). ##### Other notable changes - \[[`59cae91465`](nodejs/node@59cae91465)] - **(SEMVER-MINOR)** **dgram**: support blocklist in udp (theanarkh) [#56087](nodejs/node#56087) - \[[`72f79b44ed`](nodejs/node@72f79b44ed)] - **doc**: stabilize util.styleText (Rafael Gonzaga) [#56265](nodejs/node#56265) - \[[`b5a2c0777d`](nodejs/node@b5a2c0777d)] - **(SEMVER-MINOR)** **module**: add prefix-only modules to `module.builtinModules` (Jordan Harband) [#56185](nodejs/node#56185) - \[[`9863d27566`](nodejs/node@9863d27566)] - **(SEMVER-MINOR)** **module**: only emit require(esm) warning under --trace-require-module (Joyee Cheung) [#56194](nodejs/node#56194) - \[[`8e780bc5ae`](nodejs/node@8e780bc5ae)] - **(SEMVER-MINOR)** **module**: use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) [#55698](nodejs/node#55698) - \[[`65bc8e847f`](nodejs/node@65bc8e847f)] - **(SEMVER-MINOR)** **report**: fix typos in report keys and bump the version (Yuan-Ming Hsu) [#56068](nodejs/node#56068) - \[[`0ab36e1937`](nodejs/node@0ab36e1937)] - **(SEMVER-MINOR)** **sqlite**: aggregate constants in a single property (Edigleysson Silva (Edy)) [#56213](nodejs/node#56213) - \[[`efcc5d90c5`](nodejs/node@efcc5d90c5)] - **(SEMVER-MINOR)** **src,lib**: stabilize permission model (Rafael Gonzaga) [#56201](nodejs/node#56201) ##### Commits - \[[`2314e4916e`](nodejs/node@2314e4916e)] - **assert**: make Maps be partially compared in partialDeepStrictEqual (Giovanni Bucci) [#56195](nodejs/node#56195) - \[[`cfbdff7b45`](nodejs/node@cfbdff7b45)] - **assert**: make partialDeepStrictEqual work with ArrayBuffers (Giovanni Bucci) [#56098](nodejs/node#56098) - \[[`f264dd6d20`](nodejs/node@f264dd6d20)] - **buffer**: document concat zero-fill (Duncan) [#55562](nodejs/node#55562) - \[[`4831b87d83`](nodejs/node@4831b87d83)] - **build**: set DESTCPU correctly for 'make binary' on loongarch64 (吴小白) [#56271](nodejs/node#56271) - \[[`1497bb405e`](nodejs/node@1497bb405e)] - **build**: fix missing fp16 dependency in d8 builds (Joyee Cheung) [#56266](nodejs/node#56266) - \[[`445c8c7489`](nodejs/node@445c8c7489)] - **build**: add major release action (Rafael Gonzaga) [#56199](nodejs/node#56199) - \[[`f4faedfa69`](nodejs/node@f4faedfa69)] - **build**: fix C string encoding for `PRODUCT_DIR_ABS` (Anna Henningsen) [#56111](nodejs/node#56111) - \[[`6f49c8006c`](nodejs/node@6f49c8006c)] - **build**: use variable for simdutf path (Shelley Vohr) [#56196](nodejs/node#56196) - \[[`fcaa2c82a6`](nodejs/node@fcaa2c82a6)] - **build**: fix GN build on macOS (Joyee Cheung) [#56141](nodejs/node#56141) - \[[`08e5309f4f`](nodejs/node@08e5309f4f)] - ***Revert*** "**build**: avoid compiling with VS v17.12" (Gerhard Stöbich) [#56151](nodejs/node#56151) - \[[`c2fb38cfdf`](nodejs/node@c2fb38cfdf)] - **crypto**: graduate WebCryptoAPI [`Ed25519`](nodejs/node@Ed25519) and X25519 algorithms as stable (Filip Skokan) [#56142](nodejs/node#56142) - \[[`8658833884`](nodejs/node@8658833884)] - **deps**: update nghttp3 to 1.6.0 (Node.js GitHub Bot) [#56258](nodejs/node#56258) - \[[`7c941d4610`](nodejs/node@7c941d4610)] - **deps**: update simdutf to 5.6.4 (Node.js GitHub Bot) [#56255](nodejs/node#56255) - \[[`4e9113eada`](nodejs/node@4e9113eada)] - **deps**: update libuv to 1.49.2 (Luigi Pinca) [#56224](nodejs/node#56224) - \[[`db6aba12e4`](nodejs/node@db6aba12e4)] - **deps**: update c-ares to v1.34.4 (Node.js GitHub Bot) [#56256](nodejs/node#56256) - \[[`25bb462bc2`](nodejs/node@25bb462bc2)] - **deps**: define V8\_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) [#56238](nodejs/node#56238) - \[[`54308c51bb`](nodejs/node@54308c51bb)] - **deps**: update sqlite to 3.47.2 (Node.js GitHub Bot) [#56178](nodejs/node#56178) - \[[`59cae91465`](nodejs/node@59cae91465)] - **(SEMVER-MINOR)** **dgram**: support blocklist in udp (theanarkh) [#56087](nodejs/node#56087) - \[[`52c18e605e`](nodejs/node@52c18e605e)] - **doc**: fix color contrast issue in light mode (Rich Trott) [#56272](nodejs/node#56272) - \[[`72f79b44ed`](nodejs/node@72f79b44ed)] - **doc**: stabilize util.styleText (Rafael Gonzaga) [#56265](nodejs/node#56265) - \[[`0d08756d0c`](nodejs/node@0d08756d0c)] - **doc**: clarify util.aborted resource usage (Kunal Kumar) [#55780](nodejs/node#55780) - \[[`f94f21080b`](nodejs/node@f94f21080b)] - **doc**: add esm examples to node:repl (Alfredo González) [#55432](nodejs/node#55432) - \[[`7a10ef88d9`](nodejs/node@7a10ef88d9)] - **doc**: add esm examples to node:readline (Alfredo González) [#55335](nodejs/node#55335) - \[[`cc7a7c391b`](nodejs/node@cc7a7c391b)] - **doc**: fix 'which' to 'that' and add commas (Selveter Senitro) [#56216](nodejs/node#56216) - \[[`c5b086250e`](nodejs/node@c5b086250e)] - **doc**: fix winget config path (Alex Yang) [#56233](nodejs/node#56233) - \[[`71c38a24d4`](nodejs/node@71c38a24d4)] - **doc**: add esm examples to node:tls (Alfredo González) [#56229](nodejs/node#56229) - \[[`394fffbbde`](nodejs/node@394fffbbde)] - **doc**: add esm examples to node:perf_hooks (Alfredo González) [#55257](nodejs/node#55257) - \[[`7b2a6ee61e`](nodejs/node@7b2a6ee61e)] - **doc**: `sea.getRawAsset(key)` always returns an ArrayBuffer (沈鸿飞) [#56206](nodejs/node#56206) - \[[`8092dcf27e`](nodejs/node@8092dcf27e)] - **doc**: update announce documentation for releases (Rafael Gonzaga) [#56200](nodejs/node#56200) - \[[`2974667815`](nodejs/node@2974667815)] - **doc**: update blog link to /vulnerability (Rafael Gonzaga) [#56198](nodejs/node#56198) - \[[`f3b3ff85e0`](nodejs/node@f3b3ff85e0)] - **doc**: call out import.meta is only supported in ES modules (Anton Kastritskii) [#56186](nodejs/node#56186) - \[[`a9e67280e7`](nodejs/node@a9e67280e7)] - **doc**: add ambassador message - benefits of Node.js (Michael Dawson) [#56085](nodejs/node#56085) - \[[`e4922ab15f`](nodejs/node@e4922ab15f)] - **doc**: fix incorrect link to style guide (Yuan-Ming Hsu) [#56181](nodejs/node#56181) - \[[`114a3e5a05`](nodejs/node@114a3e5a05)] - **doc**: fix c++ addon hello world sample (Edigleysson Silva (Edy)) [#56172](nodejs/node#56172) - \[[`f1c2d2f65e`](nodejs/node@f1c2d2f65e)] - **doc**: update blog release-post link (Ruy Adorno) [#56123](nodejs/node#56123) - \[[`d48b5224c0`](nodejs/node@d48b5224c0)] - **doc**: fix module.md headings (Chengzhong Wu) [#56131](nodejs/node#56131) - \[[`4cc0493a0b`](nodejs/node@4cc0493a0b)] - **fs**: make mutating `options` in Callback `readdir()` not affect results (LiviaMedeiros) [#56057](nodejs/node#56057) - \[[`8d485f1c09`](nodejs/node@8d485f1c09)] - **fs**: make mutating `options` in Promises `readdir()` not affect results (LiviaMedeiros) [#56057](nodejs/node#56057) - \[[`595851b5ed`](nodejs/node@595851b5ed)] - **fs,win**: fix readdir for named pipe (Hüseyin Açacak) [#56110](nodejs/node#56110) - \[[`075b36b7b4`](nodejs/node@075b36b7b4)] - **http**: add setDefaultHeaders option to http.request (Tim Perry) [#56112](nodejs/node#56112) - \[[`febd969c46`](nodejs/node@febd969c46)] - **http2**: remove duplicate codeblock (Vitaly Aminev) [#55915](nodejs/node#55915) - \[[`b0ebd23e52`](nodejs/node@b0ebd23e52)] - **http2**: support ALPNCallback option (ZYSzys) [#56187](nodejs/node#56187) - \[[`f10239fde7`](nodejs/node@f10239fde7)] - **lib**: remove redundant global regexps (Gürgün Dayıoğlu) [#56182](nodejs/node#56182) - \[[`fd55d3cbdd`](nodejs/node@fd55d3cbdd)] - **lib**: clean up persisted signals when they are settled (Edigleysson Silva (Edy)) [#56001](nodejs/node#56001) - \[[`889094fdbc`](nodejs/node@889094fdbc)] - **lib**: handle Float16Array in node:v8 serdes (Bartek Iwańczuk) [#55996](nodejs/node#55996) - \[[`5aec513207`](nodejs/node@5aec513207)] - **lib**: disable default memory leak warning for AbortSignal (Lenz Weber-Tronic) [#55816](nodejs/node#55816) - \[[`b5a2c0777d`](nodejs/node@b5a2c0777d)] - **(SEMVER-MINOR)** **module**: add prefix-only modules to `module.builtinModules` (Jordan Harband) [#56185](nodejs/node#56185) - \[[`9863d27566`](nodejs/node@9863d27566)] - **(SEMVER-MINOR)** **module**: only emit require(esm) warning under --trace-require-module (Joyee Cheung) [#56194](nodejs/node#56194) - \[[`5665e86da6`](nodejs/node@5665e86da6)] - **module**: prevent main thread exiting before esm worker ends (Shima Ryuhei) [#56183](nodejs/node#56183) - \[[`8e780bc5ae`](nodejs/node@8e780bc5ae)] - **(SEMVER-MINOR)** **module**: use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) [#55698](nodejs/node#55698) - \[[`e5bb6c2303`](nodejs/node@e5bb6c2303)] - **(SEMVER-MINOR)** **module**: implement module.registerHooks() (Joyee Cheung) [#55698](nodejs/node#55698) - \[[`f883bedceb`](nodejs/node@f883bedceb)] - **node-api**: allow napi_delete_reference in finalizers (Chengzhong Wu) [#55620](nodejs/node#55620) - \[[`65bc8e847f`](nodejs/node@65bc8e847f)] - **(SEMVER-MINOR)** **report**: fix typos in report keys and bump the version (Yuan-Ming Hsu) [#56068](nodejs/node#56068) - \[[`a6f0cfa468`](nodejs/node@a6f0cfa468)] - **sea**: only assert snapshot main function for main threads (Joyee Cheung) [#56120](nodejs/node#56120) - \[[`0ab36e1937`](nodejs/node@0ab36e1937)] - **(SEMVER-MINOR)** **sqlite**: aggregate constants in a single property (Edigleysson Silva (Edy)) [#56213](nodejs/node#56213) - \[[`4745798225`](nodejs/node@4745798225)] - **sqlite**: add support for custom functions (Colin Ihrig) [#55985](nodejs/node#55985) - \[[`53cc0cc744`](nodejs/node@53cc0cc744)] - **sqlite**: support `db.loadExtension` (Alex Yang) [#53900](nodejs/node#53900) - \[[`3968599702`](nodejs/node@3968599702)] - **src**: fix outdated js2c.cc references (Chengzhong Wu) [#56133](nodejs/node#56133) - \[[`efcc5d90c5`](nodejs/node@efcc5d90c5)] - **(SEMVER-MINOR)** **src,lib**: stabilize permission model (Rafael Gonzaga) [#56201](nodejs/node#56201) - \[[`a4a83613cb`](nodejs/node@a4a83613cb)] - **stream**: commit pull-into descriptors after filling from queue (Mattias Buelens) [#56072](nodejs/node#56072) - \[[`3298ef4891`](nodejs/node@3298ef4891)] - **test**: remove test-sqlite-statement-sync flaky designation (Luigi Pinca) [#56051](nodejs/node#56051) - \[[`1d8cc6179d`](nodejs/node@1d8cc6179d)] - **test**: use --permission over --experimental-permission (Rafael Gonzaga) [#56239](nodejs/node#56239) - \[[`5d252b7a67`](nodejs/node@5d252b7a67)] - **test**: remove exludes for sea tests on PPC (Michael Dawson) [#56217](nodejs/node#56217) - \[[`8288f57724`](nodejs/node@8288f57724)] - **test**: fix test-abortsignal-drop-settled-signals flakiness (Edigleysson Silva (Edy)) [#56197](nodejs/node#56197) - \[[`683cc15796`](nodejs/node@683cc15796)] - **test**: move localizationd data from `test-icu-env` to external file (Livia Medeiros) [#55618](nodejs/node#55618) - \[[`a0c4a5f122`](nodejs/node@a0c4a5f122)] - **test**: update WPT for url to [`6fa3fe8`](nodejs/node@6fa3fe8a92) (Node.js GitHub Bot) [#56136](nodejs/node#56136) - \[[`a0e3926285`](nodejs/node@a0e3926285)] - **test**: remove `hasOpenSSL3x` utils (Antoine du Hamel) [#56164](nodejs/node#56164) - \[[`041a49094e`](nodejs/node@041a49094e)] - **test**: update streams wpt (Mattias Buelens) [#56072](nodejs/node#56072) - \[[`ea9a675f56`](nodejs/node@ea9a675f56)] - **test_runner**: exclude test files from coverage by default (Pietro Marchini) [#56060](nodejs/node#56060) - \[[`118cd9998f`](nodejs/node@118cd9998f)] - **tools**: fix `node:` enforcement for docs (Antoine du Hamel) [#56284](nodejs/node#56284) - \[[`c4c56daae8`](nodejs/node@c4c56daae8)] - **tools**: update github_reporter to 1.7.2 (Node.js GitHub Bot) [#56205](nodejs/node#56205) - \[[`78743b1533`](nodejs/node@78743b1533)] - **tools**: add REPLACEME check to workflow (Mert Can Altin) [#56251](nodejs/node#56251) - \[[`002ee71d9b`](nodejs/node@002ee71d9b)] - **tools**: use `github.actor` instead of bot username for release proposals (Antoine du Hamel) [#56232](nodejs/node#56232) - \[[`d25d16efeb`](nodejs/node@d25d16efeb)] - ***Revert*** "**tools**: disable automated libuv updates" (Luigi Pinca) [#56223](nodejs/node#56223) - \[[`b395e0c8c9`](nodejs/node@b395e0c8c9)] - **tools**: update gyp-next to 0.19.1 (Anna Henningsen) [#56111](nodejs/node#56111) - \[[`a5aaf31c50`](nodejs/node@a5aaf31c50)] - **tools**: fix release proposal linter to support more than 1 folk preparing (Antoine du Hamel) [#56203](nodejs/node#56203) - \[[`fa667d609e`](nodejs/node@fa667d609e)] - **tools**: remove has_absl_stringify from gyp file (Michaël Zasso) [#56157](nodejs/node#56157) - \[[`65b541e70e`](nodejs/node@65b541e70e)] - **tools**: enable linter for `tools/icu/**` (Livia Medeiros) [#56176](nodejs/node#56176) - \[[`28a4b6ff58`](nodejs/node@28a4b6ff58)] - **tools**: use commit title as MR title when creating release proposal (Antoine du Hamel) [#56165](nodejs/node#56165) - \[[`e20eef659f`](nodejs/node@e20eef659f)] - **tools**: update gyp-next to 0.19.0 (Node.js GitHub Bot) [#56158](nodejs/node#56158) - \[[`efcc829085`](nodejs/node@efcc829085)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#56099](nodejs/node#56099) - \[[`5620b2be8a`](nodejs/node@5620b2be8a)] - **tools**: improve release proposal MR opening (Antoine du Hamel) [#56161](nodejs/node#56161) - \[[`3e17a8e78e`](nodejs/node@3e17a8e78e)] - **util**: harden more built-in classes against prototype pollution (Antoine du Hamel) [#56225](nodejs/node#56225) - \[[`13815417c7`](nodejs/node@13815417c7)] - **util**: fix Latin1 decoding to return string output (Mert Can Altin) [#56222](nodejs/node#56222) - \[[`77397c5013`](nodejs/node@77397c5013)] - **util**: do not rely on mutable `Object` and `Function`' `constructor` prop (Antoine du Hamel) [#56188](nodejs/node#56188) - \[[`84f98e0a74`](nodejs/node@84f98e0a74)] - **v8,tools**: expose experimental wasm revectorize feature (Yolanda-Chen) [#54896](nodejs/node#54896) - \[[`8325fa5c04`](nodejs/node@8325fa5c04)] - **worker**: fix crash when a worker joins after exit (Stephen Belanger) [#56191](nodejs/node#56191) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Refs: nodejs#56201

Refs: #56201 PR-URL: #56240 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

Move permission model from 1.1 (Active Development) to 2.0 (Stable). PR-URL: #56201 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Santiago Gimeno <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]>

Notable changes: assert: * (SEMVER-MINOR) add partialDeepStrictEqual (Giovanni Bucci) #54630 cli: * (SEMVER-MINOR) implement --trace-env and --trace-env-[js|native]-stack (Joyee Cheung) #55604 crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) #56087 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 * move typescript support to active development (Marco Ippolito) #55536 * add LJHarb to collaborators (Jordan Harband) #56132 * (SEMVER-MINOR) add report version and history section (Chengzhong Wu) #56130 * (SEMVER-MINOR) sort --report-exclude alphabetically (Rafael Gonzaga) #55788 doc,lib,src,test: * (SEMVER-MINOR) unflag sqlite module (Colin Ihrig) #55890 module: * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) add module.stripTypeScriptTypes (Marco Ippolito) #55282 * (SEMVER-MINOR) simplify `findPackageJSON` implementation (Antoine du Hamel) #55412 * (SEMVER-MINOR) add `findPackageJSON` util (Jacob Smith) #55412 net: * (SEMVER-MINOR) support blocklist in net.connect (theanarkh) #56075 * (SEMVER-MINOR) add SocketAddress.parse (James M Snell) #56076 * (SEMVER-MINOR) add net.BlockList.isBlockList(value) (James M Snell) #56078 * (SEMVER-MINOR) support blocklist for net.Server (theanarkh) #56079 process: * (SEMVER-MINOR) deprecate `features.{ipv6,uv}` and `features.tls_*` (René) #55545 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 * (SEMVER-MINOR) add `StatementSync.prototype.iterate` method (tpoisseau) #54213 src: * (SEMVER-MINOR) add cli option to preserve env vars on dr (Rafael Gonzaga) #55697 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 util: * (SEMVER-MINOR) add sourcemap support to getCallSites (Marco Ippolito) #55589 PR-URL: #56329

Notable changes: assert: * (SEMVER-MINOR) add partialDeepStrictEqual (Giovanni Bucci) #54630 cli: * (SEMVER-MINOR) implement --trace-env and --trace-env-[js|native]-stack (Joyee Cheung) #55604 crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) #56087 doc: * stabilize util.styleText (Rafael Gonzaga) #56265 * move typescript support to active development (Marco Ippolito) #55536 * add LJHarb to collaborators (Jordan Harband) #56132 * (SEMVER-MINOR) add report version and history section (Chengzhong Wu) #56130 * (SEMVER-MINOR) sort --report-exclude alphabetically (Rafael Gonzaga) #55788 doc,lib,src,test: * (SEMVER-MINOR) unflag sqlite module (Colin Ihrig) #55890 module: * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194 * (SEMVER-MINOR) add module.stripTypeScriptTypes (Marco Ippolito) #55282 net: * (SEMVER-MINOR) support blocklist in net.connect (theanarkh) #56075 * (SEMVER-MINOR) add SocketAddress.parse (James M Snell) #56076 * (SEMVER-MINOR) add net.BlockList.isBlockList(value) (James M Snell) #56078 * (SEMVER-MINOR) support blocklist for net.Server (theanarkh) #56079 process: * (SEMVER-MINOR) deprecate `features.{ipv6,uv}` and `features.tls_*` (René) #55545 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) #56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) #56213 * (SEMVER-MINOR) add `StatementSync.prototype.iterate` method (tpoisseau) #54213 src: * (SEMVER-MINOR) add cli option to preserve env vars on dr (Rafael Gonzaga) #55697 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) #56201 util: * (SEMVER-MINOR) add sourcemap support to getCallSites (Marco Ippolito) #55589 PR-URL: #56329

Notable changes: assert: * (SEMVER-MINOR) add partialDeepStrictEqual (Giovanni Bucci) nodejs#54630 cli: * (SEMVER-MINOR) implement --trace-env and --trace-env-[js|native]-stack (Joyee Cheung) nodejs#55604 crypto: * graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) nodejs#56142 dgram: * (SEMVER-MINOR) support blocklist in udp (theanarkh) nodejs#56087 doc: * stabilize util.styleText (Rafael Gonzaga) nodejs#56265 * move typescript support to active development (Marco Ippolito) nodejs#55536 * add LJHarb to collaborators (Jordan Harband) nodejs#56132 * (SEMVER-MINOR) add report version and history section (Chengzhong Wu) nodejs#56130 * (SEMVER-MINOR) sort --report-exclude alphabetically (Rafael Gonzaga) nodejs#55788 doc,lib,src,test: * (SEMVER-MINOR) unflag sqlite module (Colin Ihrig) nodejs#55890 module: * (SEMVER-MINOR) only emit require(esm) warning under --trace-require-module (Joyee Cheung) nodejs#56194 * (SEMVER-MINOR) add module.stripTypeScriptTypes (Marco Ippolito) nodejs#55282 net: * (SEMVER-MINOR) support blocklist in net.connect (theanarkh) nodejs#56075 * (SEMVER-MINOR) add SocketAddress.parse (James M Snell) nodejs#56076 * (SEMVER-MINOR) add net.BlockList.isBlockList(value) (James M Snell) nodejs#56078 * (SEMVER-MINOR) support blocklist for net.Server (theanarkh) nodejs#56079 process: * (SEMVER-MINOR) deprecate `features.{ipv6,uv}` and `features.tls_*` (René) nodejs#55545 report: * (SEMVER-MINOR) fix typos in report keys and bump the version (Yuan-Ming Hsu) nodejs#56068 sqlite: * (SEMVER-MINOR) aggregate constants in a single property (Edigleysson Silva (Edy)) nodejs#56213 * (SEMVER-MINOR) add `StatementSync.prototype.iterate` method (tpoisseau) nodejs#54213 src: * (SEMVER-MINOR) add cli option to preserve env vars on dr (Rafael Gonzaga) nodejs#55697 src,lib: * (SEMVER-MINOR) stabilize permission model (Rafael Gonzaga) nodejs#56201 util: * (SEMVER-MINOR) add sourcemap support to getCallSites (Marco Ippolito) nodejs#55589 PR-URL: nodejs#56329

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | engines | minor | [`~22.12.0` -> `~22.13.0`](https://renovatebot.com/diffs/npm/node/v22.12.0/v22.13.0) | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v22.13.0`](https://github.com/nodejs/node/releases/tag/v22.13.0): 2025-01-07, Version 22.13.0 'Jod' (LTS), @ruyadorno [Compare Source](nodejs/node@v22.12.0...v22.13.0) ##### Notable Changes ##### Stabilize Permission Model Upgrades the Permission Model status from Active Development to Stable. Contributed by Rafael Gonzaga [#56201](nodejs/node#56201) ##### Graduate WebCryptoAPI [`Ed25519`](nodejs/node@Ed25519) and X25519 algorithms as stable Following the merge of Curve25519 into the [Web Cryptography API Editor's Draft](https://w3c.github.io/webcrypto/) the `Ed25519` and `X25519` algorithm identifiers are now stable and will no longer emit an ExperimentalWarning upon use. Contributed by (Filip Skokan) [#56142](nodejs/node#56142) ##### Other Notable Changes - \[[`05d6227a88`](nodejs/node@05d6227a88)] - **(SEMVER-MINOR)** **assert**: add partialDeepStrictEqual (Giovanni Bucci) [#54630](nodejs/node#54630) - \[[`a933103499`](nodejs/node@a933103499)] - **(SEMVER-MINOR)** **cli**: implement --trace-env and --trace-env-\[js|native]-stack (Joyee Cheung) [#55604](nodejs/node#55604) - \[[`ba9d5397de`](nodejs/node@ba9d5397de)] - **(SEMVER-MINOR)** **dgram**: support blocklist in udp (theanarkh) [#56087](nodejs/node#56087) - \[[`f6d0c01303`](nodejs/node@f6d0c01303)] - **doc**: stabilize util.styleText (Rafael Gonzaga) [#56265](nodejs/node#56265) - \[[`34c68827af`](nodejs/node@34c68827af)] - **doc**: move typescript support to active development (Marco Ippolito) [#55536](nodejs/node#55536) - \[[`dd14b80350`](nodejs/node@dd14b80350)] - **doc**: add LJHarb to collaborators (Jordan Harband) [#56132](nodejs/node#56132) - \[[`5263086169`](nodejs/node@5263086169)] - **(SEMVER-MINOR)** **doc**: add report version and history section (Chengzhong Wu) [#56130](nodejs/node#56130) - \[[`8cb3c2018d`](nodejs/node@8cb3c2018d)] - **(SEMVER-MINOR)** **doc**: sort --report-exclude alphabetically (Rafael Gonzaga) [#55788](nodejs/node#55788) - \[[`55239a48b6`](nodejs/node@55239a48b6)] - **(SEMVER-MINOR)** **doc,lib,src,test**: unflag sqlite module (Colin Ihrig) [#55890](nodejs/node#55890) - \[[`7cbe3de1d8`](nodejs/node@7cbe3de1d8)] - **(SEMVER-MINOR)** **module**: only emit require(esm) warning under --trace-require-module (Joyee Cheung) [#56194](nodejs/node#56194) - \[[`6575b76042`](nodejs/node@6575b76042)] - **(SEMVER-MINOR)** **module**: add module.stripTypeScriptTypes (Marco Ippolito) [#55282](nodejs/node#55282) - \[[`bacfe6d5c9`](nodejs/node@bacfe6d5c9)] - **(SEMVER-MINOR)** **net**: support blocklist in net.connect (theanarkh) [#56075](nodejs/node#56075) - \[[`b47888d390`](nodejs/node@b47888d390)] - **(SEMVER-MINOR)** **net**: support blocklist for net.Server (theanarkh) [#56079](nodejs/node#56079) - \[[`566f0a1d25`](nodejs/node@566f0a1d25)] - **(SEMVER-MINOR)** **net**: add SocketAddress.parse (James M Snell) [#56076](nodejs/node#56076) - \[[`ed7eab1421`](nodejs/node@ed7eab1421)] - **(SEMVER-MINOR)** **net**: add net.BlockList.isBlockList(value) (James M Snell) [#56078](nodejs/node#56078) - \[[`ea4891856d`](nodejs/node@ea4891856d)] - **(SEMVER-MINOR)** **process**: deprecate `features.{ipv6,uv}` and `features.tls_*` (René) [#55545](nodejs/node#55545) - \[[`01eb308f26`](nodejs/node@01eb308f26)] - **(SEMVER-MINOR)** **report**: fix typos in report keys and bump the version (Yuan-Ming Hsu) [#56068](nodejs/node#56068) - \[[`97c38352d0`](nodejs/node@97c38352d0)] - **(SEMVER-MINOR)** **sqlite**: aggregate constants in a single property (Edigleysson Silva (Edy)) [#56213](nodejs/node#56213) - \[[`b4041e554a`](nodejs/node@b4041e554a)] - **(SEMVER-MINOR)** **sqlite**: add `StatementSync.prototype.iterate` method (tpoisseau) [#54213](nodejs/node#54213) - \[[`2e3ca1bbdd`](nodejs/node@2e3ca1bbdd)] - **(SEMVER-MINOR)** **src**: add cli option to preserve env vars on diagnostic reports (Rafael Gonzaga) [#55697](nodejs/node#55697) - \[[`bcfe9c80fc`](nodejs/node@bcfe9c80fc)] - **(SEMVER-MINOR)** **util**: add sourcemap support to getCallSites (Marco Ippolito) [#55589](nodejs/node#55589) ##### Commits - \[[`e9024779c0`](nodejs/node@e9024779c0)] - **assert**: make Maps be partially compared in partialDeepStrictEqual (Giovanni Bucci) [#56195](nodejs/node#56195) - \[[`4c13d8e587`](nodejs/node@4c13d8e587)] - **assert**: make partialDeepStrictEqual work with ArrayBuffers (Giovanni Bucci) [#56098](nodejs/node#56098) - \[[`a4fa31a86e`](nodejs/node@a4fa31a86e)] - **assert**: optimize partial comparison of two `Set`s (Antoine du Hamel) [#55970](nodejs/node#55970) - \[[`05d6227a88`](nodejs/node@05d6227a88)] - **(SEMVER-MINOR)** **assert**: add partialDeepStrictEqual (Giovanni Bucci) [#54630](nodejs/node#54630) - \[[`5e1321abd7`](nodejs/node@5e1321abd7)] - **buffer**: document concat zero-fill (Duncan) [#55562](nodejs/node#55562) - \[[`be5ba7c648`](nodejs/node@be5ba7c648)] - **build**: set DESTCPU correctly for 'make binary' on loongarch64 (吴小白) [#56271](nodejs/node#56271) - \[[`38cf37ee2d`](nodejs/node@38cf37ee2d)] - **build**: fix missing fp16 dependency in d8 builds (Joyee Cheung) [#56266](nodejs/node#56266) - \[[`dbb7557455`](nodejs/node@dbb7557455)] - **build**: add major release action (Rafael Gonzaga) [#56199](nodejs/node#56199) - \[[`27cc90f3be`](nodejs/node@27cc90f3be)] - **build**: fix C string encoding for `PRODUCT_DIR_ABS` (Anna Henningsen) [#56111](nodejs/node#56111) - \[[`376561c2b4`](nodejs/node@376561c2b4)] - **build**: use variable for simdutf path (Shelley Vohr) [#56196](nodejs/node#56196) - \[[`126ae15000`](nodejs/node@126ae15000)] - **build**: allow overriding clang usage (Shelley Vohr) [#56016](nodejs/node#56016) - \[[`97bb8f7c76`](nodejs/node@97bb8f7c76)] - **build**: remove defaults for create-release-proposal (Rafael Gonzaga) [#56042](nodejs/node#56042) - \[[`a8fb1a06f3`](nodejs/node@a8fb1a06f3)] - **build**: set node_arch to target_cpu in GN (Shelley Vohr) [#55967](nodejs/node#55967) - \[[`9f48ca27f1`](nodejs/node@9f48ca27f1)] - **build**: use variable for crypto dep path (Shelley Vohr) [#55928](nodejs/node#55928) - \[[`e47ccd2287`](nodejs/node@e47ccd2287)] - **build**: fix GN build for sqlite (Cheng) [#55912](nodejs/node#55912) - \[[`8d70b99a5a`](nodejs/node@8d70b99a5a)] - **build**: compile bundled simdutf conditionally (Jakub Jirutka) [#55886](nodejs/node#55886) - \[[`826fd35242`](nodejs/node@826fd35242)] - **build**: compile bundled simdjson conditionally (Jakub Jirutka) [#55886](nodejs/node#55886) - \[[`1015b22085`](nodejs/node@1015b22085)] - **build**: compile bundled ada conditionally (Jakub Jirutka) [#55886](nodejs/node#55886) - \[[`77e2869ca6`](nodejs/node@77e2869ca6)] - **build**: use glob for dependencies of out/Makefile (Richard Lau) [#55789](nodejs/node#55789) - \[[`a933103499`](nodejs/node@a933103499)] - **(SEMVER-MINOR)** **cli**: implement --trace-env and --trace-env-\[js|native]-stack (Joyee Cheung) [#55604](nodejs/node#55604) - \[[`72e8e0684e`](nodejs/node@72e8e0684e)] - **crypto**: graduate WebCryptoAPI [`Ed25519`](nodejs/node@Ed25519) and X25519 algorithms as stable (Filip Skokan) [#56142](nodejs/node#56142) - \[[`fe2b344ddb`](nodejs/node@fe2b344ddb)] - **crypto**: ensure CryptoKey usages and algorithm are cached objects (Filip Skokan) [#56108](nodejs/node#56108) - \[[`9ee9f524a7`](nodejs/node@9ee9f524a7)] - **crypto**: allow non-multiple of 8 in SubtleCrypto.deriveBits (Filip Skokan) [#55296](nodejs/node#55296) - \[[`76f242d993`](nodejs/node@76f242d993)] - **deps**: update nghttp3 to 1.6.0 (Node.js GitHub Bot) [#56258](nodejs/node#56258) - \[[`c7ff2ea6b5`](nodejs/node@c7ff2ea6b5)] - **deps**: update simdutf to 5.6.4 (Node.js GitHub Bot) [#56255](nodejs/node#56255) - \[[`04230be1ef`](nodejs/node@04230be1ef)] - **deps**: update libuv to 1.49.2 (Luigi Pinca) [#56224](nodejs/node#56224) - \[[`88589b85b7`](nodejs/node@88589b85b7)] - **deps**: update c-ares to v1.34.4 (Node.js GitHub Bot) [#56256](nodejs/node#56256) - \[[`5c2e0618f3`](nodejs/node@5c2e0618f3)] - **deps**: define V8\_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) [#56238](nodejs/node#56238) - \[[`9f8f3c9658`](nodejs/node@9f8f3c9658)] - **deps**: update sqlite to 3.47.2 (Node.js GitHub Bot) [#56178](nodejs/node#56178) - \[[`17b6931d3b`](nodejs/node@17b6931d3b)] - **deps**: update ngtcp2 to 1.9.1 (Node.js GitHub Bot) [#56095](nodejs/node#56095) - \[[`22b453b619`](nodejs/node@22b453b619)] - **deps**: upgrade npm to 10.9.2 (npm team) [#56135](nodejs/node#56135) - \[[`d7eb41b382`](nodejs/node@d7eb41b382)] - **deps**: update sqlite to 3.47.1 (Node.js GitHub Bot) [#56094](nodejs/node#56094) - \[[`669c722aa9`](nodejs/node@669c722aa9)] - **deps**: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) [#55980](nodejs/node#55980) - \[[`f61a0454d2`](nodejs/node@f61a0454d2)] - **deps**: update corepack to 0.30.0 (Node.js GitHub Bot) [#55977](nodejs/node#55977) - \[[`d98bf0b891`](nodejs/node@d98bf0b891)] - **deps**: update ngtcp2 to 1.9.0 (Node.js GitHub Bot) [#55975](nodejs/node#55975) - \[[`fc362624bf`](nodejs/node@fc362624bf)] - **deps**: update simdutf to 5.6.3 (Node.js GitHub Bot) [#55973](nodejs/node#55973) - \[[`f61dcc4df4`](nodejs/node@f61dcc4df4)] - **deps**: upgrade npm to 10.9.1 (npm team) [#55951](nodejs/node#55951) - \[[`bfe7982491`](nodejs/node@bfe7982491)] - **deps**: update zlib to 1.3.0.1-motley-7e2e4d7 (Node.js GitHub Bot) [#54432](nodejs/node#54432) - \[[`d714367ef8`](nodejs/node@d714367ef8)] - **deps**: update simdjson to 3.10.1 (Node.js GitHub Bot) [#54678](nodejs/node#54678) - \[[`ccc9b105ec`](nodejs/node@ccc9b105ec)] - **deps**: update simdutf to 5.6.2 (Node.js GitHub Bot) [#55889](nodejs/node#55889) - \[[`ba9d5397de`](nodejs/node@ba9d5397de)] - **(SEMVER-MINOR)** **dgram**: support blocklist in udp (theanarkh) [#56087](nodejs/node#56087) - \[[`7ddbf94849`](nodejs/node@7ddbf94849)] - **dgram**: check udp buffer size to avoid fd leak (theanarkh) [#56084](nodejs/node#56084) - \[[`360d68de0f`](nodejs/node@360d68de0f)] - **doc**: fix color contrast issue in light mode (Rich Trott) [#56272](nodejs/node#56272) - \[[`f6d0c01303`](nodejs/node@f6d0c01303)] - **doc**: stabilize util.styleText (Rafael Gonzaga) [#56265](nodejs/node#56265) - \[[`9436c3c949`](nodejs/node@9436c3c949)] - **doc**: clarify util.aborted resource usage (Kunal Kumar) [#55780](nodejs/node#55780) - \[[`b1cec2cef9`](nodejs/node@b1cec2cef9)] - **doc**: add esm examples to node:repl (Alfredo González) [#55432](nodejs/node#55432) - \[[`d6a84cf781`](nodejs/node@d6a84cf781)] - **doc**: add esm examples to node:readline (Alfredo González) [#55335](nodejs/node#55335) - \[[`a11ac1c0f2`](nodejs/node@a11ac1c0f2)] - **doc**: fix 'which' to 'that' and add commas (Selveter Senitro) [#56216](nodejs/node#56216) - \[[`5331df7911`](nodejs/node@5331df7911)] - **doc**: fix winget config path (Alex Yang) [#56233](nodejs/node#56233) - \[[`7a8071b43c`](nodejs/node@7a8071b43c)] - **doc**: add esm examples to node:tls (Alfredo González) [#56229](nodejs/node#56229) - \[[`7d8c1e72d5`](nodejs/node@7d8c1e72d5)] - **doc**: add esm examples to node:perf_hooks (Alfredo González) [#55257](nodejs/node#55257) - \[[`ea53c4b1ae`](nodejs/node@ea53c4b1ae)] - **doc**: `sea.getRawAsset(key)` always returns an ArrayBuffer (沈鸿飞) [#56206](nodejs/node#56206) - \[[`7a94100a3e`](nodejs/node@7a94100a3e)] - **doc**: update announce documentation for releases (Rafael Gonzaga) [#56200](nodejs/node#56200) - \[[`44c4e57e32`](nodejs/node@44c4e57e32)] - **doc**: update blog link to /vulnerability (Rafael Gonzaga) [#56198](nodejs/node#56198) - \[[`5e5b4b0cbd`](nodejs/node@5e5b4b0cbd)] - **doc**: call out import.meta is only supported in ES modules (Anton Kastritskii) [#56186](nodejs/node#56186) - \[[`a83de32d35`](nodejs/node@a83de32d35)] - **doc**: add ambassador message - benefits of Node.js (Michael Dawson) [#56085](nodejs/node#56085) - \[[`bb880dd21a`](nodejs/node@bb880dd21a)] - **doc**: fix incorrect link to style guide (Yuan-Ming Hsu) [#56181](nodejs/node#56181) - \[[`39ce902e58`](nodejs/node@39ce902e58)] - **doc**: fix c++ addon hello world sample (Edigleysson Silva (Edy)) [#56172](nodejs/node#56172) - \[[`19c72c4acc`](nodejs/node@19c72c4acc)] - **doc**: update blog release-post link (Ruy Adorno) [#56123](nodejs/node#56123) - \[[`b667cc4669`](nodejs/node@b667cc4669)] - **doc**: fix module.md headings (Chengzhong Wu) [#56131](nodejs/node#56131) - \[[`34c68827af`](nodejs/node@34c68827af)] - **doc**: move typescript support to active development (Marco Ippolito) [#55536](nodejs/node#55536) - \[[`c4a97d810b`](nodejs/node@c4a97d810b)] - **doc**: mention `-a` flag for the release script (Ruy Adorno) [#56124](nodejs/node#56124) - \[[`dd14b80350`](nodejs/node@dd14b80350)] - **doc**: add LJHarb to collaborators (Jordan Harband) [#56132](nodejs/node#56132) - \[[`2feb0781ed`](nodejs/node@2feb0781ed)] - **doc**: add create-release-action to process (Rafael Gonzaga) [#55993](nodejs/node#55993) - \[[`71f6263942`](nodejs/node@71f6263942)] - **doc**: rename file to advocacy-ambassador-program.md (Tobias Nießen) [#56046](nodejs/node#56046) - \[[`8efa240500`](nodejs/node@8efa240500)] - **doc**: remove unused import from sample code (Blended Bram) [#55570](nodejs/node#55570) - \[[`e64cef8bf4`](nodejs/node@e64cef8bf4)] - **doc**: add FAQ to releases section (Rafael Gonzaga) [#55992](nodejs/node#55992) - \[[`4bb0f30f92`](nodejs/node@4bb0f30f92)] - **doc**: move history entry to class description (Luigi Pinca) [#55991](nodejs/node#55991) - \[[`6d02bd6873`](nodejs/node@6d02bd6873)] - **doc**: add history entry for textEncoder.encodeInto() (Luigi Pinca) [#55990](nodejs/node#55990) - \[[`e239382ed8`](nodejs/node@e239382ed8)] - **doc**: improve GN build documentation a bit (Shelley Vohr) [#55968](nodejs/node#55968) - \[[`78b6aef6bc`](nodejs/node@78b6aef6bc)] - **doc**: fix deprecation codes (Filip Skokan) [#56018](nodejs/node#56018) - \[[`474bf80a44`](nodejs/node@474bf80a44)] - **doc**: remove confusing and outdated sentence (Luigi Pinca) [#55988](nodejs/node#55988) - \[[`57381076c5`](nodejs/node@57381076c5)] - **doc**: deprecate passing invalid types in `fs.existsSync` (Carlos Espa) [#55892](nodejs/node#55892) - \[[`e529cf6b26`](nodejs/node@e529cf6b26)] - **doc**: add doc for PerformanceObserver.takeRecords() (skyclouds2001) [#55786](nodejs/node#55786) - \[[`a6ef0f6f6e`](nodejs/node@a6ef0f6f6e)] - **doc**: add vetted courses to the ambassador benefits (Matteo Collina) [#55934](nodejs/node#55934) - \[[`63526049f2`](nodejs/node@63526049f2)] - **doc**: order `node:crypto` APIs alphabetically (Julian Gassner) [#55831](nodejs/node#55831) - \[[`36080b7b61`](nodejs/node@36080b7b61)] - **doc**: doc how to add message for promotion (Michael Dawson) [#55843](nodejs/node#55843) - \[[`12b2ad4287`](nodejs/node@12b2ad4287)] - **doc**: add esm example for zlib (Leonardo Peixoto) [#55946](nodejs/node#55946) - \[[`352daac296`](nodejs/node@352daac296)] - **doc**: fix typo (Alex Yang) [#56125](nodejs/node#56125) - \[[`6e7e9a126d`](nodejs/node@6e7e9a126d)] - **doc**: document approach for building wasm in deps (Michael Dawson) [#55940](nodejs/node#55940) - \[[`0b3ac05422`](nodejs/node@0b3ac05422)] - **doc**: remove RedYetiDev from triagers team (Aviv Keller) [#55947](nodejs/node#55947) - \[[`20be5e2f80`](nodejs/node@20be5e2f80)] - **doc**: add esm examples to node:timers (Alfredo González) [#55857](nodejs/node#55857) - \[[`3ba9b57436`](nodejs/node@3ba9b57436)] - **doc**: fix relative path mention in --allow-fs (Rafael Gonzaga) [#55791](nodejs/node#55791) - \[[`3e6b3a9a8b`](nodejs/node@3e6b3a9a8b)] - **doc**: include git node release --promote to steps (Rafael Gonzaga) [#55835](nodejs/node#55835) - \[[`5bdfde8dc6`](nodejs/node@5bdfde8dc6)] - **doc**: add history entry for import assertion removal (Antoine du Hamel) [#55883](nodejs/node#55883) - \[[`c842146c05`](nodejs/node@c842146c05)] - **doc**: add a note on console stream behavior (Gireesh Punathil) [#55616](nodejs/node#55616) - \[[`5263086169`](nodejs/node@5263086169)] - **(SEMVER-MINOR)** **doc**: add report version and history section (Chengzhong Wu) [#56130](nodejs/node#56130) - \[[`8cb3c2018d`](nodejs/node@8cb3c2018d)] - **(SEMVER-MINOR)** **doc**: sort --report-exclude alphabetically (Rafael Gonzaga) [#55788](nodejs/node#55788) - \[[`55239a48b6`](nodejs/node@55239a48b6)] - **(SEMVER-MINOR)** **doc,lib,src,test**: unflag sqlite module (Colin Ihrig) [#55890](nodejs/node#55890) - \[[`04d7c7a349`](nodejs/node@04d7c7a349)] - **fs**: make mutating `options` in Callback `readdir()` not affect results (LiviaMedeiros) [#56057](nodejs/node#56057) - \[[`92bcd528e7`](nodejs/node@92bcd528e7)] - **fs**: make mutating `options` in Promises `readdir()` not affect results (LiviaMedeiros) [#56057](nodejs/node#56057) - \[[`3a55bd9448`](nodejs/node@3a55bd9448)] - **fs**: lazily load ReadFileContext (Gürgün Dayıoğlu) [#55998](nodejs/node#55998) - \[[`0331b3fdd3`](nodejs/node@0331b3fdd3)] - **fs,win**: fix readdir for named pipe (Hüseyin Açacak) [#56110](nodejs/node#56110) - \[[`79152b54e9`](nodejs/node@79152b54e9)] - **http**: add setDefaultHeaders option to http.request (Tim Perry) [#56112](nodejs/node#56112) - \[[`19782855a8`](nodejs/node@19782855a8)] - **http**: don't emit error after destroy (Robert Nagy) [#55457](nodejs/node#55457) - \[[`8494512c17`](nodejs/node@8494512c17)] - **http2**: remove duplicate codeblock (Vitaly Aminev) [#55915](nodejs/node#55915) - \[[`d2f82223d1`](nodejs/node@d2f82223d1)] - **http2**: support ALPNCallback option (ZYSzys) [#56187](nodejs/node#56187) - \[[`2616f1247a`](nodejs/node@2616f1247a)] - **http2**: fix memory leak caused by premature listener removing (ywave620) [#55966](nodejs/node#55966) - \[[`598fe048f2`](nodejs/node@598fe048f2)] - **lib**: remove redundant global regexps (Gürgün Dayıoğlu) [#56182](nodejs/node#56182) - \[[`a3c8739530`](nodejs/node@a3c8739530)] - **lib**: clean up persisted signals when they are settled (Edigleysson Silva (Edy)) [#56001](nodejs/node#56001) - \[[`11144ab158`](nodejs/node@11144ab158)] - **lib**: handle Float16Array in node:v8 serdes (Bartek Iwańczuk) [#55996](nodejs/node#55996) - \[[`81c94a32e4`](nodejs/node@81c94a32e4)] - **lib**: disable default memory leak warning for AbortSignal (Lenz Weber-Tronic) [#55816](nodejs/node#55816) - \[[`68dda61420`](nodejs/node@68dda61420)] - **lib**: add validation for options in compileFunction (Taejin Kim) [#56023](nodejs/node#56023) - \[[`d2007aec28`](nodejs/node@d2007aec28)] - **lib**: fix `fs.readdir` recursive async (Rafael Gonzaga) [#56041](nodejs/node#56041) - \[[`0571d5556f`](nodejs/node@0571d5556f)] - **lib**: avoid excluding symlinks in recursive fs.readdir with filetypes (Juan José) [#55714](nodejs/node#55714) - \[[`843943d0ce`](nodejs/node@843943d0ce)] - **meta**: bump github/codeql-action from 3.27.0 to 3.27.5 (dependabot\[bot]) [#56103](nodejs/node#56103) - \[[`1529027f03`](nodejs/node@1529027f03)] - **meta**: bump actions/checkout from 4.1.7 to 4.2.2 (dependabot\[bot]) [#56102](nodejs/node#56102) - \[[`8e265de9f5`](nodejs/node@8e265de9f5)] - **meta**: bump step-security/harden-runner from 2.10.1 to 2.10.2 (dependabot\[bot]) [#56101](nodejs/node#56101) - \[[`0fba3a3b9b`](nodejs/node@0fba3a3b9b)] - **meta**: bump actions/setup-node from 4.0.3 to 4.1.0 (dependabot\[bot]) [#56100](nodejs/node#56100) - \[[`2e3fdfdb19`](nodejs/node@2e3fdfdb19)] - **meta**: add releasers as CODEOWNERS to proposal action (Rafael Gonzaga) [#56043](nodejs/node#56043) - \[[`7cbe3de1d8`](nodejs/node@7cbe3de1d8)] - **(SEMVER-MINOR)** **module**: only emit require(esm) warning under --trace-require-module (Joyee Cheung) [#56194](nodejs/node#56194) - \[[`8a5429c9b3`](nodejs/node@8a5429c9b3)] - **module**: prevent main thread exiting before esm worker ends (Shima Ryuhei) [#56183](nodejs/node#56183) - \[[`6575b76042`](nodejs/node@6575b76042)] - **(SEMVER-MINOR)** **module**: add module.stripTypeScriptTypes (Marco Ippolito) [#55282](nodejs/node#55282) - \[[`0794861bc3`](nodejs/node@0794861bc3)] - **module**: simplify ts under node_modules check (Marco Ippolito) [#55440](nodejs/node#55440) - \[[`28a11adf14`](nodejs/node@28a11adf14)] - **module**: mark evaluation rejection in require(esm) as handled (Joyee Cheung) [#56122](nodejs/node#56122) - \[[`bacfe6d5c9`](nodejs/node@bacfe6d5c9)] - **(SEMVER-MINOR)** **net**: support blocklist in net.connect (theanarkh) [#56075](nodejs/node#56075) - \[[`566f0a1d25`](nodejs/node@566f0a1d25)] - **(SEMVER-MINOR)** **net**: add SocketAddress.parse (James M Snell) [#56076](nodejs/node#56076) - \[[`ed7eab1421`](nodejs/node@ed7eab1421)] - **(SEMVER-MINOR)** **net**: add net.BlockList.isBlockList(value) (James M Snell) [#56078](nodejs/node#56078) - \[[`b47888d390`](nodejs/node@b47888d390)] - **(SEMVER-MINOR)** **net**: support blocklist for net.Server (theanarkh) [#56079](nodejs/node#56079) - \[[`481770a38f`](nodejs/node@481770a38f)] - **node-api**: allow napi_delete_reference in finalizers (Chengzhong Wu) [#55620](nodejs/node#55620) - \[[`2beb4f1f8c`](nodejs/node@2beb4f1f8c)] - **permission**: ignore internalModuleStat on module loading (Rafael Gonzaga) [#55797](nodejs/node#55797) - \[[`ea4891856d`](nodejs/node@ea4891856d)] - **(SEMVER-MINOR)** **process**: deprecate `features.{ipv6,uv}` and `features.tls_*` (René) [#55545](nodejs/node#55545) - \[[`c907b2f358`](nodejs/node@c907b2f358)] - **quic**: update more QUIC implementation (James M Snell) [#55986](nodejs/node#55986) - \[[`43c25e2e0d`](nodejs/node@43c25e2e0d)] - **quic**: multiple updates to quic impl (James M Snell) [#55971](nodejs/node#55971) - \[[`01eb308f26`](nodejs/node@01eb308f26)] - **(SEMVER-MINOR)** **report**: fix typos in report keys and bump the version (Yuan-Ming Hsu) [#56068](nodejs/node#56068) - \[[`1cfa31fb82`](nodejs/node@1cfa31fb82)] - **sea**: only assert snapshot main function for main threads (Joyee Cheung) [#56120](nodejs/node#56120) - \[[`97c38352d0`](nodejs/node@97c38352d0)] - **(SEMVER-MINOR)** **sqlite**: aggregate constants in a single property (Edigleysson Silva (Edy)) [#56213](nodejs/node#56213) - \[[`2268c1ea8b`](nodejs/node@2268c1ea8b)] - **sqlite**: add support for custom functions (Colin Ihrig) [#55985](nodejs/node#55985) - \[[`f5c6955722`](nodejs/node@f5c6955722)] - **sqlite**: support `db.loadExtension` (Alex Yang) [#53900](nodejs/node#53900) - \[[`9a60bea6b7`](nodejs/node@9a60bea6b7)] - **sqlite**: deps include `sqlite3ext.h` (Alex Yang) [#56010](nodejs/node#56010) - \[[`b4041e554a`](nodejs/node@b4041e554a)] - **(SEMVER-MINOR)** **sqlite**: add `StatementSync.prototype.iterate` method (tpoisseau) [#54213](nodejs/node#54213) - \[[`2889e8da04`](nodejs/node@2889e8da04)] - **src**: fix outdated js2c.cc references (Chengzhong Wu) [#56133](nodejs/node#56133) - \[[`5ce020b0c9`](nodejs/node@5ce020b0c9)] - **src**: use spaceship operator in SocketAddress (James M Snell) [#56059](nodejs/node#56059) - \[[`a32fa30847`](nodejs/node@a32fa30847)] - **src**: add missing qualifiers to env.cc (Yagiz Nizipli) [#56062](nodejs/node#56062) - \[[`974b7b61ef`](nodejs/node@974b7b61ef)] - **src**: use std::string_view for process emit fns (Yagiz Nizipli) [#56086](nodejs/node#56086) - \[[`4559fac862`](nodejs/node@4559fac862)] - **src**: remove dead code in async_wrap (Gerhard Stöbich) [#56065](nodejs/node#56065) - \[[`e42e4b20be`](nodejs/node@e42e4b20be)] - **src**: avoid copy on getV8FastApiCallCount (Yagiz Nizipli) [#56081](nodejs/node#56081) - \[[`c188660e8b`](nodejs/node@c188660e8b)] - **src**: fix check fd (theanarkh) [#56000](nodejs/node#56000) - \[[`d894cb76ff`](nodejs/node@d894cb76ff)] - **src**: safely remove the last line from dotenv (Shima Ryuhei) [#55982](nodejs/node#55982) - \[[`2ca9f4b65a`](nodejs/node@2ca9f4b65a)] - **src**: fix kill signal on Windows (Hüseyin Açacak) [#55514](nodejs/node#55514) - \[[`2e3ca1bbdd`](nodejs/node@2e3ca1bbdd)] - **(SEMVER-MINOR)** **src**: add cli option to preserve env vars on dr (Rafael Gonzaga) [#55697](nodejs/node#55697) - \[[`359fff1c4e`](nodejs/node@359fff1c4e)] - **src,build**: add no user defined deduction guides of CTAD check (Chengzhong Wu) [#56071](nodejs/node#56071) - \[[`57bb983215`](nodejs/node@57bb983215)] - **(SEMVER-MINOR)** **src,lib**: stabilize permission model (Rafael Gonzaga) [#56201](nodejs/node#56201) - \[[`d352b0465a`](nodejs/node@d352b0465a)] - **stream**: commit pull-into descriptors after filling from queue (Mattias Buelens) [#56072](nodejs/node#56072) - \[[`eef9bd1bf6`](nodejs/node@eef9bd1bf6)] - **test**: remove test-sqlite-statement-sync flaky designation (Luigi Pinca) [#56051](nodejs/node#56051) - \[[`8718135a5d`](nodejs/node@8718135a5d)] - **test**: use --permission over --experimental-permission (Rafael Gonzaga) [#56239](nodejs/node#56239) - \[[`9c68d4f180`](nodejs/node@9c68d4f180)] - **test**: remove exludes for sea tests on PPC (Michael Dawson) [#56217](nodejs/node#56217) - \[[`c5d0472968`](nodejs/node@c5d0472968)] - **test**: fix test-abortsignal-drop-settled-signals flakiness (Edigleysson Silva (Edy)) [#56197](nodejs/node#56197) - \[[`4adf518689`](nodejs/node@4adf518689)] - **test**: move localizationd data from `test-icu-env` to external file (Livia Medeiros) [#55618](nodejs/node#55618) - \[[`02383b4267`](nodejs/node@02383b4267)] - **test**: update WPT for url to [`6fa3fe8`](nodejs/node@6fa3fe8a92) (Node.js GitHub Bot) [#56136](nodejs/node#56136) - \[[`0e24eebf24`](nodejs/node@0e24eebf24)] - **test**: remove `hasOpenSSL3x` utils (Antoine du Hamel) [#56164](nodejs/node#56164) - \[[`381e705385`](nodejs/node@381e705385)] - **test**: update streams wpt (Mattias Buelens) [#56072](nodejs/node#56072) - \[[`ad107ca0d9`](nodejs/node@ad107ca0d9)] - **test**: remove test-fs-utimes flaky designation (Luigi Pinca) [#56052](nodejs/node#56052) - \[[`e15c5dab79`](nodejs/node@e15c5dab79)] - **test**: ensure `cli.md` is in alphabetical order (Antoine du Hamel) [#56025](nodejs/node#56025) - \[[`d0302e7d2d`](nodejs/node@d0302e7d2d)] - **test**: update WPT for WebCryptoAPI to [`3e3374e`](nodejs/node@3e3374efde) (Node.js GitHub Bot) [#56093](nodejs/node#56093) - \[[`a0b1e8f400`](nodejs/node@a0b1e8f400)] - **test**: update WPT for WebCryptoAPI to [`76dfa54`](nodejs/node@76dfa54e5d) (Node.js GitHub Bot) [#56093](nodejs/node#56093) - \[[`211f058a12`](nodejs/node@211f058a12)] - **test**: move test-worker-arraybuffer-zerofill to parallel (Luigi Pinca) [#56053](nodejs/node#56053) - \[[`c52bc5d71c`](nodejs/node@c52bc5d71c)] - **test**: update WPT for url to [`67880a4`](nodejs/node@67880a4) (Node.js GitHub Bot) [#55999](nodejs/node#55999) - \[[`1a78bde8d4`](nodejs/node@1a78bde8d4)] - **test**: make HTTP/1.0 connection test more robust (Arne Keller) [#55959](nodejs/node#55959) - \[[`ff7b1445a0`](nodejs/node@ff7b1445a0)] - **test**: convert readdir test to use test runner (Thomas Chetwin) [#55750](nodejs/node#55750) - \[[`b296b5a4e4`](nodejs/node@b296b5a4e4)] - **test**: make x509 crypto tests work with BoringSSL (Shelley Vohr) [#55927](nodejs/node#55927) - \[[`97458ad74b`](nodejs/node@97458ad74b)] - **test**: fix determining lower priority (Livia Medeiros) [#55908](nodejs/node#55908) - \[[`bb4aa7a296`](nodejs/node@bb4aa7a296)] - **test,crypto**: update WebCryptoAPI WPT (Filip Skokan) [#55997](nodejs/node#55997) - \[[`fb98fa4967`](nodejs/node@fb98fa4967)] - **test_runner**: refactor Promise chain in run() (Colin Ihrig) [#55958](nodejs/node#55958) - \[[`18c94961f8`](nodejs/node@18c94961f8)] - **test_runner**: refactor build Promise in Suite() (Colin Ihrig) [#55958](nodejs/node#55958) - \[[`bf3967fd3a`](nodejs/node@bf3967fd3a)] - **test_runner**: simplify hook running logic (Colin Ihrig) [#55963](nodejs/node#55963) - \[[`8c065dc61e`](nodejs/node@8c065dc61e)] - **test_runner**: mark context.plan() as stable (Colin Ihrig) [#55895](nodejs/node#55895) - \[[`8ff082cf48`](nodejs/node@8ff082cf48)] - **test_runner**: mark snapshot testing as stable (Colin Ihrig) [#55897](nodejs/node#55897) - \[[`7ae125cef4`](nodejs/node@7ae125cef4)] - **tools**: fix `node:` enforcement for docs (Antoine du Hamel) [#56284](nodejs/node#56284) - \[[`0b489116a3`](nodejs/node@0b489116a3)] - **tools**: update github_reporter to 1.7.2 (Node.js GitHub Bot) [#56205](nodejs/node#56205) - \[[`5306819fac`](nodejs/node@5306819fac)] - **tools**: add REPLACEME check to workflow (Mert Can Altin) [#56251](nodejs/node#56251) - \[[`4e3cab44cb`](nodejs/node@4e3cab44cb)] - **tools**: use `github.actor` instead of bot username for release proposals (Antoine du Hamel) [#56232](nodejs/node#56232) - \[[`3e8938463a`](nodejs/node@3e8938463a)] - ***Revert*** "**tools**: disable automated libuv updates" (Luigi Pinca) [#56223](nodejs/node#56223) - \[[`98ea499e36`](nodejs/node@98ea499e36)] - **tools**: update gyp-next to 0.19.1 (Anna Henningsen) [#56111](nodejs/node#56111) - \[[`2e76cd2a8b`](nodejs/node@2e76cd2a8b)] - **tools**: fix release proposal linter to support more than 1 folk preparing (Antoine du Hamel) [#56203](nodejs/node#56203) - \[[`9fa0e41665`](nodejs/node@9fa0e41665)] - **tools**: enable linter for `tools/icu/**` (Livia Medeiros) [#56176](nodejs/node#56176) - \[[`d6e1efcc59`](nodejs/node@d6e1efcc59)] - **tools**: use commit title as PR title when creating release proposal (Antoine du Hamel) [#56165](nodejs/node#56165) - \[[`a88e4ce55e`](nodejs/node@a88e4ce55e)] - **tools**: update gyp-next to 0.19.0 (Node.js GitHub Bot) [#56158](nodejs/node#56158) - \[[`bd0760efbc`](nodejs/node@bd0760efbc)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#56099](nodejs/node#56099) - \[[`c5b1cf4b12`](nodejs/node@c5b1cf4b12)] - **tools**: improve release proposal PR opening (Antoine du Hamel) [#56161](nodejs/node#56161) - \[[`12baefb13d`](nodejs/node@12baefb13d)] - **tools**: update `create-release-proposal` workflow (Antoine du Hamel) [#56054](nodejs/node#56054) - \[[`e6e1495f1a`](nodejs/node@e6e1495f1a)] - **tools**: fix update-undici script (Michaël Zasso) [#56069](nodejs/node#56069) - \[[`ed635c90da`](nodejs/node@ed635c90da)] - **tools**: allow dispatch of `tools.yml` from forks (Antoine du Hamel) [#56008](nodejs/node#56008) - \[[`1e628d1f37`](nodejs/node@1e628d1f37)] - **tools**: fix nghttp3 updater script (Antoine du Hamel) [#56007](nodejs/node#56007) - \[[`1af3599b7e`](nodejs/node@1af3599b7e)] - **tools**: filter release keys to reduce interactivity (Antoine du Hamel) [#55950](nodejs/node#55950) - \[[`1893be4a9c`](nodejs/node@1893be4a9c)] - **tools**: update WPT updater (Antoine du Hamel) [#56003](nodejs/node#56003) - \[[`f89bd2ba8a`](nodejs/node@f89bd2ba8a)] - **tools**: add WPT updater for specific subsystems (Mert Can Altin) [#54460](nodejs/node#54460) - \[[`61901372d5`](nodejs/node@61901372d5)] - **tools**: use tokenless Codecov uploads (Michaël Zasso) [#55943](nodejs/node#55943) - \[[`312bb4dff8`](nodejs/node@312bb4dff8)] - **tools**: lint js in `doc/**/*.md` (Livia Medeiros) [#55904](nodejs/node#55904) - \[[`7b476f637c`](nodejs/node@7b476f637c)] - **tools**: add linter for release commit proposals (Antoine du Hamel) [#55923](nodejs/node#55923) - \[[`22d7017191`](nodejs/node@22d7017191)] - **tools**: fix riscv64 build failed (Lu Yahan) [#52888](nodejs/node#52888) - \[[`f4f777f4d2`](nodejs/node@f4f777f4d2)] - **tools**: bump cross-spawn from 7.0.3 to 7.0.5 in /tools/eslint (dependabot\[bot]) [#55894](nodejs/node#55894) - \[[`a648e4c44a`](nodejs/node@a648e4c44a)] - **util**: harden more built-in classes against prototype pollution (Antoine du Hamel) [#56225](nodejs/node#56225) - \[[`4a1b51b5a9`](nodejs/node@4a1b51b5a9)] - **util**: fix Latin1 decoding to return string output (Mert Can Altin) [#56222](nodejs/node#56222) - \[[`9e98e86604`](nodejs/node@9e98e86604)] - **util**: do not rely on mutable `Object` and `Function`' `constructor` prop (Antoine du Hamel) [#56188](nodejs/node#56188) - \[[`374eb415fd`](nodejs/node@374eb415fd)] - **util**: add fast path for Latin1 decoding (Mert Can Altin) [#55275](nodejs/node#55275) - \[[`bcfe9c80fc`](nodejs/node@bcfe9c80fc)] - **(SEMVER-MINOR)** **util**: add sourcemap support to getCallSites (Marco Ippolito) [#55589](nodejs/node#55589) - \[[`2aa77c8a8f`](nodejs/node@2aa77c8a8f)] - **v8,tools**: expose experimental wasm revectorize feature (Yolanda-Chen) [#54896](nodejs/node#54896) - \[[`bfd11d7661`](nodejs/node@bfd11d7661)] - **worker**: fix crash when a worker joins after exit (Stephen Belanger) [#56191](nodejs/node#56191) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.justinelmore.dev/jelmore1674/build-changelog/pulls/72 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

RafaelGSS added semver-major PRs that contain breaking changes and should be released in the next major version. notable-change PRs with changes that should be highlighted in changelogs. labels Dec 10, 2024

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Dec 10, 2024

RafaelGSS added the permission Issues and PRs related to the Permission Model label Dec 10, 2024

RafaelGSS force-pushed the move-permission-model-stable branch from 1a47bad to e1d0505 Compare December 10, 2024 03:10

anonrig approved these changes Dec 10, 2024

View reviewed changes

mertcanaltin approved these changes Dec 10, 2024

View reviewed changes

mcollina approved these changes Dec 10, 2024

View reviewed changes

santigimeno approved these changes Dec 10, 2024

View reviewed changes

marco-ippolito approved these changes Dec 10, 2024

View reviewed changes

RafaelGSS added 2 commits December 10, 2024 14:40

src,lib: stabilize permission model

bb4146a

Move permission model from 1.1 (Active Development) to 2.0 (Stable).

fixup! src,lib: stabilize permission model

b00914b

RafaelGSS force-pushed the move-permission-model-stable branch from d45ac4b to b00914b Compare December 10, 2024 17:42

RafaelGSS added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Dec 10, 2024

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Dec 10, 2024

jasnell reviewed Dec 10, 2024

View reviewed changes

test/fixtures/dotenv/node-options.env Outdated Show resolved Hide resolved

jasnell approved these changes Dec 10, 2024

View reviewed changes

aduh95 reviewed Dec 10, 2024

View reviewed changes

doc/api/cli.md Outdated Show resolved Hide resolved

RafaelGSS added a commit to RafaelGSS/node that referenced this pull request Dec 12, 2024

src: drop --experimental-permission in favour of --permission

6d7dfa8

Refs: nodejs#56201

github-actions bot mentioned this pull request Dec 18, 2024

2024-12-19, Version 23.5.0 (Current) #56310

Merged

ruyadorno mentioned this pull request Dec 20, 2024

2025-01-07, Version 22.13.0 'Jod' (LTS) #56329

Merged

This comment was marked as spam.

Sign in to view

RafaelGSS added a commit to RafaelGSS/node that referenced this pull request Jan 2, 2025

src: drop --experimental-permission in favour of --permission

5e8003d

Refs: nodejs#56201

marco-ippolito added the dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. label Jan 13, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

src,lib: stabilize permission model #56201

src,lib: stabilize permission model #56201

RafaelGSS commented Dec 10, 2024 •

edited

Loading

nodejs-github-bot commented Dec 10, 2024

github-actions bot commented Dec 10, 2024

codecov bot commented Dec 10, 2024 •

edited

Loading

mertcanaltin left a comment

targos commented Dec 10, 2024

mcollina left a comment

nodejs-github-bot commented Dec 10, 2024

nodejs-github-bot commented Dec 10, 2024

This comment was marked as spam.

src,lib: stabilize permission model #56201

src,lib: stabilize permission model #56201

Conversation

RafaelGSS commented Dec 10, 2024 • edited Loading

nodejs-github-bot commented Dec 10, 2024

github-actions bot commented Dec 10, 2024

codecov bot commented Dec 10, 2024 • edited Loading

Codecov Report

mertcanaltin left a comment

Choose a reason for hiding this comment

targos commented Dec 10, 2024

mcollina left a comment

Choose a reason for hiding this comment

nodejs-github-bot commented Dec 10, 2024

nodejs-github-bot commented Dec 10, 2024

This comment was marked as spam.

RafaelGSS commented Dec 10, 2024 •

edited

Loading

codecov bot commented Dec 10, 2024 •

edited

Loading