GeezerVison

View reviewed changes

mcollina left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mcollina added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label

CI: https://ci.nodejs.org/job/node-test-pull-request/69381/

nodejs-github-bot commented Sep 26, 2025

Copy link

Copy Markdown

Collaborator

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cjihrig approved these changes

View reviewed changes

lpinca added the semver-major PRs that contain breaking changes and should be released in the next major version. label

lpinca reviewed

CI: https://ci.nodejs.org/job/node-test-pull-request/69976/

View reviewed changes

Comment thread

test/parallel/test-http-upgrade-server-with-body.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

lpinca commented Sep 26, 2025

Copy link

Copy Markdown

Member

See also de4600e. It is an old fix for upgrade responses, but I think it is related because the behavior should be the same?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry commented Sep 29, 2025

Copy link

Copy Markdown

Member Author

See also de4600e. It is an old fix for upgrade responses, but I think it is related because the behavior should be the same?

@lpinca that bug is related to client parsing of server responses, whereas this change is only for server parsing of requests, so they're not directly related, and I'm not really sure how the same issue would apply in this scenario. There's no case where the server should receive the upgraded protocol data before it has handled the request and responded anyway (because you have to wait for the 101 response to confirm the upgrade).

In general, the behaviour should not actually be the same for body parsing in these two cases. When a server is parsing a client upgrade request, there could possibly be a body, because any HTTP request of any kind could include upgrade headers. When a client is parsing a 101 response though, there can never be a body (1XX never include a body), which is why telling the parser to skip the body is correct in that fix. That previous bug seems to occur because the headers imply there is a body (transfer-encoding: chunked) even though it's not actually allowed and no valid chunk is actually sent.

Maybe I'm missing something though - can you describe the kind of request that this change would parse wrong? I have tried tweaking the test here, and it works fine when using transfer-encoding: chunked and changing the first byte to be >127.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry marked this pull request as draft

September 30, 2025 07:45

pimterry force-pushed the upgrade-with-body branch from fabde34 to db9387a Compare

October 7, 2025 12:43

pimterry marked this pull request as ready for review

October 7, 2025 12:48

pimterry force-pushed the upgrade-with-body branch from db9387a to 00202ef Compare

October 7, 2025 12:53

pimterry commented Oct 7, 2025

Copy link

Copy Markdown

Member Author

I've just pushed a new commit to fix the issue discussed above, and also rebased onto main.

With this 2nd commit, this change now subtly changes the semantics of 'upgrade' but I think it's unavoidable while fixing this bug, and the previous behaviour was clearly broken.

The issue comes when a request body is sent slowly. Previously, we always emitted 'upgrade' as soon as the headers were sent. If you do though while allowing request bodies, that means the upgrade event can happen while the body is still being processed, which means the first data you see on the socket might be the request body not the upgraded stream that you're interested in, at the same time that that data will also appear in the request body stream itself.

This is very confusing and unhelpful. It's an edge case (most upgrade requests won't have a body, especially for the common case of websockets) but it's a perfectly valid one. The only reasonable solution I can see is to defer the 'upgrade' event until the request body is done. With the change here, the server upgrade event now emits when the request has been fully received, so all data on the socket is always from the upgraded stream, and the request body only appears on the request itself.

The updated test covers this case. To compare that to the same scenario on current node, right now we fire upgrade immediately, and the request body appears split between head (for the first part) and data subsequently emitted by the socket as part of the upgrade stream. I can't see another way to fix that without changing these semantics slightly. What do you think @lpinca?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lpinca commented Oct 7, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

The only reasonable solution I can see is to defer the 'upgrade' event until the request body is done. With the change here, the server upgrade event now emits when the request has been fully received, so all data on the socket is always from the upgraded stream, and the request body only appears on the request itself.

If I understand correctly, the issue here is that you can't read the request body until the 'upgrade' event is emitted, but the event is emitted after all data is read so there is no way for the stream to flow. The client can send a lot of data in the request body until the stream is paused on the server, but it can't be read/resumed on the server because it is not returned to the user. Am I missing something?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry commented Oct 8, 2025

Copy link

Copy Markdown

Member Author

If I understand correctly, the issue here is that you can't read the request body until the 'upgrade' event is emitted, but the event is emitted after all data is read so there is no way for the stream to flow. The client can send a lot of data in the request body until the stream is paused on the server, but it can't be read/resumed on the server because it is not returned to the user. Am I missing something?

Yes, for some reason I thought that would be fine and the parser would buffer this somehow, but I did more testing and that does indeed run into issues. Past a certain point (about 85KB on my machine) the stream stops flowing, presumably because the buffers are full, so the body never completes and upgrade never fires.

Not really sure how to resolve this:

We can't emit the current event before the body is done, because it's really not usable in this case - you can't separate the request body from post-request data stream when reading from the socket.
But we can't wait until after the body is done, because we might run out of buffer and never emit at all.

Some options I can see:

We actively ignore the request body on upgrades - we dump it during parsing, so it gets fully processed (technically resolving this bug) but you can never access it.
We could set a limit on upgrade request body size, buffer to that point and then throw/reject the request/dump the body/something else.
We buffer the request body separately, and provide it as a 4th arg on this 'upgrade' event. Weird but workable. Still needs an upper limit really.
We redesign the event itself, and deprecate this one, so that you don't get access to the socket directly somehow.
- Maybe we pass an upgrade stream as arg 2, instead of the socket itself. That could be a duplex that only produces the readable data after the request body finishes. Could still have .socket to get the raw socket where required, but that would at least solve the footgun. But requires a new event, or a very significant breaking change.
Any other ideas?

It's very tempting to ignore the request body entirely (option 1) and for websockets (easily the most common case) it's irrelevant. Technically though you could upgrade to any protocol you want, and the RFC expects you to then handle the original request (implicitly including its body) as if it was sent over the new protocol, so it's not unreasonable to actually be able to access the request body somehow.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lpinca commented Oct 8, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

I don't know. Discarding the data without being able to access it, does not seem good. It is worse than the current behavior. Currently the user can read the request body. For example, the user can check the Content-Length header and if it is set read the specified number of bytes from the socket as the request body and then proceed with the upgrade. Something similar can also be done for chunked encoding, but yes, it requires explicit handling.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry commented Oct 9, 2025

Copy link

Copy Markdown

Member Author

For example, the user can check the Content-Length header and if it is set read the specified number of bytes from the socket as the request body and then proceed with the upgrade.

Nobody does this though. WS for example inherits the equivalent bug - if I send a websocket upgrade request with a body, WS will parses the request body as part of websocket stream, and fails to start the connection. Nobody should send that request, since it's a GET with a body, but it's as valid as any other GET-with-body and people do weird things.

I think I've reduced my options to:

Buffer everything before emitting upgrade, probably add an option like maxUpgradeBodySize to the server (default?) so you can limit/disable this if you don't want it. If the request body hits the max size the whole thing gets dumped and maybe we log a warning. This is easy and solves the problem. It mildly changes semantics for the affected case by waiting before emitting (but the previous behaviour for this case is broken) and adds risk of memory consumption due to automatic buffering.
Or, we use some kind of proxy setup to wrap a separate stream around socket, so that reading skips the request body data, and only emits the upgraded stream's data. This is complicated but seems possible, sort-of similar to how HTTP/2 uses proxies in the compat API to expose 'socket' data on top of an H2 stream. This is more complicated to do well, and probably has some small perf implications by adding another stream around the socket, but they should be minimal and we can ensure they only apply to this one case (by only using the proxy stream if there's a request body). The only scenario where it's a breaking change is cases where you're manually working around this bug by parsing the body from the socket yourself, and the fix is easy: just remove that parsing and read directly.

I'm leaning towards option 2 I think - it's more complicated, but cleaner and more effective, and gives us a sensible API: you listen for upgrade, it fires immediately when the request arrives, and then you have two separate streams (req/socket) to listen for request body data and upgrade stream data respectively. Opinions very welcome.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry commented Oct 9, 2025

Copy link

Copy Markdown

Member Author

It'd be especially interesting to know what @mscdex thinks about these solution options, since the original report in #58394 is the only concrete example of this I've seen in the wild.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lpinca commented Oct 9, 2025

Copy link

Copy Markdown

Member

Nobody does this though. WS for example inherits the equivalent bug - if I send a websocket upgrade request with a body, WS will parses the request body as part of websocket stream, and fails to start the connection. Nobody should send that request, since it's a GET with a body, but it's as valid as any other GET-with-body and people do weird things.

Yes, but it can be done. The data is accessible. By properly inspecting the request headers the developer can ignore the whole request body. WS implementations do not care much because exchanging data before the opening handshake completes is forbidden by the spec.

I have no opinions, but keeping the raw socket and the ability to read it directly seems sensible.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry commented Oct 20, 2025

Copy link

Copy Markdown

Member Author

@lpinca I'm reasonably confident I now have a plan that fixes everything 🤞

The current state of things:

We return 0 from parserOnIncoming for upgrades, which allows the request body to be parsed, if present (if content-length or transfer-encoding: chunked are set)
In parserOnExecuteCommon, after the headers finish & we know we have an upgrade, we check if the parser considers the request to already be completed (i.e. there was no request body at all, or the whole request body was already received).
If it's not completed, then we wrap the socket in an UpgradeStream before emitting the event immediately (not waiting for the request body - just like the existing API)
This UpgradeStream is effectively a passthrough duplex stream, but which doesn't start passing through until the request body finishes, and which uses a Proxy so that it appears identical to the underlying socket.
When the request does complete, if we already emitted with the upgrade stream, we don't emit again - we detach the parser etc as normal, but then just switch over the behaviour in the already-emitted stream to pass everything through (including unshifting any after-body data here).

I think this preserves existing behaviour in all cases without request bodies, exactly as it was.

In the rare cases where you do have a request body, this does change the data you'll see on the socket (which is the point - this fixes the bug). It does not buffer indefinitely or block until you stream the request body though - instead, at the moment you start reading the upgrade stream, it starts the request body flowing automatically. That means if you just read the upgrade stream and ignore the request body (probably common) everything will work as expected. If you try to read both, everything will still work as expected. The only bad case is if you try to start streaming the upgrade stream immediately, but then stream the request body later on - you'll find it's already gone. I think this is a) unavoidable and b) doesn't work in the current implementation anyway, so nobody will be doing that successfully today.

I've bulked up the new with-body test to cover various different cases here as well. To try to make sure this is non-breaking, I've also manually tested enabled UpgradeStream locally even on the already-completed case, so it's applied in all cases, and this transparently works for almost all the existing upgrade tests as well (everything passes except the listenerCount checks in test-http-connect, which seems unconcerning). Like so:

--- a/lib/_http_server.js
+++ b/lib/_http_server.js
@@ -1076,7 +1076,9 @@ function onParserExecuteCommon(server, socket, parser, state, ret, d) {
 
-      // If the request is complete (no body, or all body read upfront) then
-      // we just emit the socket directly as the upgrade stream.
-      upgradeStream = socket;
+      upgradeStream = new UpgradeStream(socket, req);
+      upgradeStream.requestBodyCompleted(undefined);

What do you think?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry force-pushed the upgrade-with-body branch from 6fb8e66 to 0a97dda Compare

October 21, 2025 08:00

pimterry commented Oct 21, 2025

Copy link

Copy Markdown

Member Author

Force pushed to rebase & resolve conflicts with latest main

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

lpinca reviewed

Oct 21, 2025

View reviewed changes

Comment thread

doc/api/http.md Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

lib/_http_server.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

test/parallel/test-http-upgrade-server-with-body.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

test/parallel/test-http-upgrade-server-with-body.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

test/parallel/test-http-upgrade-server-with-body.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

lib/_http_server.js

		}

		_write(chunk, encoding, callback) {
		this[kSocket].write(chunk, encoding, callback);

lpinca Oct 21, 2025

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I remember correctly the callback is always called asynchronously even if the write is synchronous so there will be a small overhead over a raw net.Socket in case of multiple consecutive sync writes.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

pimterry Oct 22, 2025

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, there is definitely a small performance hit here. I doubt it will be significant for most cases, but it's not zero.

I'm open to ideas to improve that perf, but I think it's worth it for the correctness in this case, and the intention is that it only applies in this upgrade-with-body case, so it doesn't affect any non-body upgrade requests at all.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

test/parallel/test-http-upgrade-server-with-body.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

lpinca reviewed

Oct 21, 2025

View reviewed changes

Comment thread

lib/_http_server.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

pimterry requested a review from lpinca

October 22, 2025 09:36

nodejs-github-bot commented Oct 31, 2025

Copy link

Copy Markdown

Collaborator

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry commented Nov 3, 2025

Copy link

Copy Markdown

Member Author

@nodejs/tsc: as semver-major, this needs two approvals to confirm the API-breaking fix we've settled on here. The PR description is a reasonable summary, my last comment covers the likely breakage in practice.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

RafaelGSS approved these changes

View reviewed changes

RafaelGSS left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mcollina approved these changes

View reviewed changes

mcollina left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mcollina requested changes

View reviewed changes

mcollina left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding a request change here because I fear this would add significant overhead to all websockets.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mcollina reviewed

View reviewed changes

Comment thread

lib/_http_server.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

lpinca commented Nov 3, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

There is no impact for WebSocket implementations as they continue to receive a raw socket. The spec specifies that no data should be exchanged until the handshake is complete. Only implementations where the initial GET request has a body and the Content-Length or Transfer-Encoding: chunked header are affected but a strict compliant server should reject those connections anyway.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

mcollina approved these changes

View reviewed changes

mcollina left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pimterry reacted with heart emoji

All reactions

❤️ 1 reaction

mcollina added commit-queue

PRs queued for automated landing through the Commit Queue.

author ready PRs with CI started, the required approvals, and no outstanding review comments. and removed needs-ci PRs that need a full CI run. labels

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label

nodejs-github-bot merged commit 4346c0f into nodejs:main

32 checks passed

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot commented Nov 3, 2025

Copy link

Copy Markdown

Collaborator

Landed in 4346c0f

pimterry reacted with hooray emoji

All reactions

🎉 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

RafaelGSS mentioned this pull request

2026-05-05, Version 26.0.0 (Current) #62526

Merged

RafaelGSS added a commit that referenced this pull request


          2026-04-28, Version 26.0.0 (Current)

44a39d9

assert:
  * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) #58849
build:
  * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) #61898
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #61898
  * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) #62296
  * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) #61177
  * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) #60863
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60488
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60111
build,test:
  * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) #61898
crypto:
  * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
  * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453
  * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) #62348
  * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) #62178
  * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) #61084
  * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) #60830
deps:
  * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) #61898
  * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) #61898
  * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) #61898
  * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) #61898
  * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) #61898
  * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) #61898
  * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) #61898
  * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) #61898
  * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) #61898
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #61898
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #61898
  * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #61898
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) #62384
  * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) #60488
  * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) #60488
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077
  * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) #60488
  * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) #60111
  * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) #60111
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077
  * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) #60111
diagnostics_channel:
  * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) #61766
doc:
  * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) #62176
  * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) #61973
  * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) #61005
http:
  * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) #60635
  * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) #60016
lib:
  * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) #61333
lib,src:
  * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) #62293
module:
  * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) #62401
  * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) #61803
src:
  * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) #61898
  * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) #61898
  * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) #61898
  * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) #61898
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) #60488
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) #60488
  * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) #60496
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) #60111
stream:
  * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) #62173
  * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) #60657
  * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) #60441
  * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) #59873
test:
  * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) #61898
  * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) #61898
  * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) #61898
  * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) #60488
tools:
  * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) #61898
  * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) #61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) #61898
util:
  * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) #61029
  * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) #60339

PR-URL: #62526

RafaelGSS added a commit that referenced this pull request


          2026-04-28, Version 26.0.0 (Current)

e2d66df

assert:
  * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) #58849
build:
  * (SEMVER-MAJOR) bump GCC requirement to 13.2 (Michaël Zasso) #62555
  * (SEMVER-MAJOR) enable Temporal by default (Richard Lau) #61806
  * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) #61898
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #61898
  * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) #62296
  * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) #61177
  * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) #60863
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60488
  * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60111
build,test:
  * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) #61898
build,win:
  * (SEMVER-MAJOR) fix Temporal build (StefanStojanovic) #61806
crypto:
  * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
  * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453
  * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) #62348
  * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) #62178
  * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) #61084
  * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) #60830
deps:
  * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) #61898
  * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) #61898
  * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) #61898
  * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) #61898
  * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) #61898
  * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) #61898
  * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) #61898
  * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) #61898
  * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) #61898
  * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) #61898
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #61898
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #61898
  * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #61898
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) #62384
  * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) #60488
  * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) #60488
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077
  * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) #60488
  * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) #60111
  * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) #60111
  * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805
  * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070
  * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070
  * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077
  * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) #60111
diagnostics_channel:
  * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) #61766
doc:
  * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) #62176
  * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) #61973
  * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) #61005
http:
  * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) #60635
  * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) #60016
lib:
  * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) #61333
lib,src:
  * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) #62293
module:
  * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) #62401
  * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) #61803
src:
  * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) #61898
  * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) #61898
  * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) #61898
  * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) #61898
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) #60488
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) #60488
  * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) #60496
  * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) #60111
stream:
  * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) #62173
  * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) #60657
  * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) #60441
  * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) #59873
test:
  * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) #61898
  * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) #61898
  * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) #61898
  * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) #60488
tools:
  * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) #61898
  * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) #61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) #61898
  * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) #61898
util:
  * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) #61029
  * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) #60339

PR-URL: #62526

RafaelGSS added a commit that referenced this pull request