GeezerVison

Ensure destroying one side of a duplexPair triggers destruction of the
other side via process.nextTick(). Only the destruction signal is sent
to avoid breaking changes.

Fixes: #61015
PR-URL: #61098
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: René <[email protected]>

Notable changes:

buffer:
  * (SEMVER-MINOR) add `end` parameter (Robert Nagy) #62390
crypto:
  * (SEMVER-MINOR) accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) #62527
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) #62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) #57775
  * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) #62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) #63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) #62541
lib,src,test,doc:
  * (SEMVER-MINOR) add `node:ffi` module (Colin Ihrig) #62072
process:
  * (SEMVER-MINOR) throw on `execve(2)` failure instead of aborting (Bryan English) #62878
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) #61610
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) #61098
test_runner:
  * (SEMVER-MINOR) align mock timeout api (sangwook) #62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) #60751
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) #61747
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) #61556

PR-URL: #63137

Notable changes:

buffer:
  * (SEMVER-MINOR) add `end` parameter (Robert Nagy) #62390
crypto:
  * (SEMVER-MINOR) accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) #62527
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) #62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) #57775
  * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) #62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) #63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) #62541
lib,src,test,doc:
  * (SEMVER-MINOR) add `node:ffi` module (Colin Ihrig) #62072
process:
  * (SEMVER-MINOR) throw on `execve(2)` failure instead of aborting (Bryan English) #62878
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) #61610
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) #61098
test_runner:
  * (SEMVER-MINOR) align mock timeout api (sangwook) #62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) #60751
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) #61747
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) #61556

PR-URL: #63137

Notable changes:

buffer:
  * (SEMVER-MINOR) add `end` parameter (Robert Nagy) #62390
crypto:
  * (SEMVER-MINOR) accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) #62527
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) #62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) #57775
  * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) #62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) #63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) #62541
lib,src,test,doc:
  * (SEMVER-MINOR) add `node:ffi` module (Colin Ihrig) #62072
process:
  * (SEMVER-MINOR) throw on `execve(2)` failure instead of aborting (Bryan English) #62878
src:
  * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) #61610
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) #61098
test_runner:
  * (SEMVER-MINOR) align mock timeout api (sangwook) #62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) #60751
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) #61747
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) #61556

PR-URL: #63137

Ensure destroying one side of a duplexPair triggers destruction of the
other side via process.nextTick(). Only the destruction signal is sent
to avoid breaking changes.

Fixes: #61015
PR-URL: #61098
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: René <[email protected]>

Notable changes:

crypto:
  * (SEMVER-MINOR) implement randomUUIDv7() (nabeel378) #62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713
fs:
  * (SEMVER-MINOR) add signal option to fs.stat() (Mert Can Altin) #57775
  * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) #62277
http:
  * (SEMVER-MINOR) harden ClientRequest options merge (Matteo Collina) #63082
  * (SEMVER-MINOR) add req.signal to IncomingMessage (Akshat) #62541
stream:
  * (SEMVER-MINOR) propagate destruction in duplexPair (Ahmed Elhor) #61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) #61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) #62820
  * (SEMVER-MINOR) add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) #61556

PR-URL: #63263

Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) #62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) #57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) #62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) #63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) #62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) #61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) #61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) #62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) #60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) #61556

PR-URL: #63263

Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) #62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) #57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) #62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) #63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) #62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) #61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) #61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) #62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) #60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) #61556

PR-URL: #63263

#831)

## Problem

`[email protected]` (via `[email protected]` / `[email protected]`) hangs on
Node.js 24.16.0+ due to a stream regression
([nodejs/node#63487](nodejs/node#63487)). The
root cause is PR
[nodejs/node#61098](nodejs/node#61098) ("stream:
propagate destruction in duplexPair") which interacts badly with
`fd-slicer`'s old-style stream implementation.

This caused `craft publish` to silently exit with code 0 after
downloading artifacts, without actually publishing anything. The issue
also affects Node.js >=26.1.0.

Affected ecosystem: extract-zip, Playwright, Puppeteer, Electron Forge,
Cypress — all of which have had to work around or replace `extract-zip`.

## Fix

Replace `extract-zip` with
[`[email protected]`](https://github.com/antelle/node-stream-zip):
- **Zero dependencies** (vs extract-zip's 5 transitive deps including
the broken yauzl/fd-slicer)
- Ships its own TypeScript types
- Maintained and works correctly on Node 22.x, 24.x (including
24.16.0+), and 26.x
- Simple async API: `StreamZip.async`

## Changes

| File | Change |
|---|---|
| `src/utils/system.ts` | Replaced `extract-zip` import with
`node-stream-zip`; rewrote `extractZipArchive()` to use
`StreamZip.async` with `mkdir` (extract-zip created the output dir
automatically, node-stream-zip doesn't) and `try/finally` for cleanup |
| `package.json` | Removed `extract-zip`, `@types/extract-zip`
(deprecated stub); added `node-stream-zip@^1.15.0` |

Net result: **-9 packages, +1 package**. All 24 system tests pass.

This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [node](https://github.com/nodejs/node) | stage | minor | `24.15.0-trixie` → `24.16.0-trixie` | `24.17.0-trixie` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.16.0`](https://github.com/nodejs/node/releases/tag/v24.16.0): 2026-05-21, Version 24.16.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.15.0...v24.16.0)

##### Notable Changes

- \[[`b267f6bca3`](nodejs/node@b267f6bca3)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#&#8203;62553](nodejs/node#62553)
- \[[`ec2451b9cd`](nodejs/node@ec2451b9cd)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#&#8203;62713](nodejs/node#62713)
- \[[`9705f628d9`](nodejs/node@9705f628d9)] - **(SEMVER-MINOR)** **fs**: add signal option to `fs.stat()` (Mert Can Altin) [#&#8203;57775](nodejs/node#57775)
- \[[`40ccfdecf9`](nodejs/node@40ccfdecf9)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#&#8203;62277](nodejs/node#62277)
- \[[`d7188af5c9`](nodejs/node@d7188af5c9)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#&#8203;63082](nodejs/node#63082)
- \[[`aa1d8a9afc`](nodejs/node@aa1d8a9afc)] - **(SEMVER-MINOR)** **http**: add `req.signal` to `IncomingMessage` (Akshat) [#&#8203;62541](nodejs/node#62541)
- \[[`6f37f7e240`](nodejs/node@6f37f7e240)] - **(SEMVER-MINOR)** **stream**: propagate destruction in `duplexPair` (Ahmed Elhor) [#&#8203;61098](nodejs/node#61098)
- \[[`d14029be7f`](nodejs/node@d14029be7f)] - **(SEMVER-MINOR)** **test\_runner**: support test order randomization (Pietro Marchini) [#&#8203;61747](nodejs/node#61747)
- \[[`d142c584cd`](nodejs/node@d142c584cd)] - **(SEMVER-MINOR)** **test\_runner**: align mock timeout api (sangwook) [#&#8203;62820](nodejs/node#62820)
- \[[`01a9552585`](nodejs/node@01a9552585)] - **(SEMVER-MINOR)** **test\_runner**: add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) [#&#8203;60751](nodejs/node#60751)
- \[[`00705a459a`](nodejs/node@00705a459a)] - **(SEMVER-MINOR)** **util**: colorize text with hex colors (Guilherme Araújo) [#&#8203;61556](nodejs/node#61556)

##### Commits

- \[[`dd72df060d`](nodejs/node@dd72df060d)] - **assert,util**: fix stale nested cycle memo entries (Ruben Bridgewater) [#&#8203;62509](nodejs/node#62509)
- \[[`add94f4bc3`](nodejs/node@add94f4bc3)] - **build**: track PDL files as inputs in inspector GN build (Robo) [#&#8203;62888](nodejs/node#62888)
- \[[`1b1eb9e334`](nodejs/node@1b1eb9e334)] - **build**: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) [#&#8203;62667](nodejs/node#62667)
- \[[`8752b604ec`](nodejs/node@8752b604ec)] - **crypto**: deduplicate and canonicalize CryptoKey usages (Filip Skokan) [#&#8203;62902](nodejs/node#62902)
- \[[`341947e7fd`](nodejs/node@341947e7fd)] - **crypto**: reject unintended raw key format string input (Filip Skokan) [#&#8203;62974](nodejs/node#62974)
- \[[`28a78747fc`](nodejs/node@28a78747fc)] - **crypto**: remove Argon2 KDF derivation from its job setup (Filip Skokan) [#&#8203;62863](nodejs/node#62863)
- \[[`16e8c2b54d`](nodejs/node@16e8c2b54d)] - **crypto**: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) [#&#8203;62839](nodejs/node#62839)
- \[[`eeae754a87`](nodejs/node@eeae754a87)] - **crypto**: reject inherited key type names (Jonathan Lopes) [#&#8203;62875](nodejs/node#62875)
- \[[`9dd5540325`](nodejs/node@9dd5540325)] - **crypto**: add memory tracking for secureContext openssl objects (Mert Can Altin) [#&#8203;59051](nodejs/node#59051)
- \[[`b267f6bca3`](nodejs/node@b267f6bca3)] - **(SEMVER-MINOR)** **crypto**: implement randomUUIDv7() (nabeel378) [#&#8203;62553](nodejs/node#62553)
- \[[`7597d204c1`](nodejs/node@7597d204c1)] - **crypto**: add support for [`Ed25519`](nodejs/node@Ed25519) context parameter (Filip Skokan) [#&#8203;62474](nodejs/node#62474)
- \[[`4bf85845da`](nodejs/node@4bf85845da)] - **debugger**: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) [#&#8203;63013](nodejs/node#63013)
- \[[`ec2451b9cd`](nodejs/node@ec2451b9cd)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#&#8203;62713](nodejs/node#62713)
- \[[`83e98f77b7`](nodejs/node@83e98f77b7)] - **deps**: update corepack to 0.35.0 (Node.js GitHub Bot) [#&#8203;63375](nodejs/node#63375)
- \[[`ec8c6b939a`](nodejs/node@ec8c6b939a)] - **deps**: V8: cherry-pick [`657d8de`](nodejs/node@657d8de27427) (Guy Bedford) [#&#8203;62784](nodejs/node#62784)
- \[[`722c0c3274`](nodejs/node@722c0c3274)] - **deps**: update nghttp3 to 1.14.0 (Node.js GitHub Bot) [#&#8203;61187](nodejs/node#61187)
- \[[`5304db93d3`](nodejs/node@5304db93d3)] - **deps**: update nghttp3 to 1.13.1 (Node.js GitHub Bot) [#&#8203;60046](nodejs/node#60046)
- \[[`e073b3811d`](nodejs/node@e073b3811d)] - **deps**: update nghttp3 to 1.11.0 (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`1d00313fb2`](nodejs/node@1d00313fb2)] - **deps**: update ngtcp2 to 1.14.0 (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`8b3a4fc18f`](nodejs/node@8b3a4fc18f)] - **deps**: update amaro to 1.1.9 (Node.js GitHub Bot) [#&#8203;63090](nodejs/node#63090)
- \[[`62fe0cfcd1`](nodejs/node@62fe0cfcd1)] - **deps**: update llhttp to 9.4.1 (Node.js GitHub Bot) [#&#8203;63045](nodejs/node#63045)
- \[[`137e09c8e9`](nodejs/node@137e09c8e9)] - **deps**: update corepack to 0.34.7 (Node.js GitHub Bot) [#&#8203;62810](nodejs/node#62810)
- \[[`14a4cb8fbc`](nodejs/node@14a4cb8fbc)] - **deps**: update timezone to 2026b (Node.js GitHub Bot) [#&#8203;62962](nodejs/node#62962)
- \[[`3e1036583a`](nodejs/node@3e1036583a)] - **deps**: upgrade npm to 11.13.0 (npm team) [#&#8203;62898](nodejs/node#62898)
- \[[`01dfe5961c`](nodejs/node@01dfe5961c)] - **deps**: cherry-pick [libuv/libuv@`439a54b`](libuv/libuv@439a54b) (skooch) [#&#8203;62881](nodejs/node#62881)
- \[[`6cd368b10c`](nodejs/node@6cd368b10c)] - **deps**: update sqlite to 3.53.0 (Node.js GitHub Bot) [#&#8203;62699](nodejs/node#62699)
- \[[`f218a4f553`](nodejs/node@f218a4f553)] - **deps**: update nbytes to 0.1.4 (Node.js GitHub Bot) [#&#8203;62698](nodejs/node#62698)
- \[[`b47688524a`](nodejs/node@b47688524a)] - **deps**: update archs files for openssl-3.5.6 (Node.js GitHub Bot) [#&#8203;62629](nodejs/node#62629)
- \[[`d202e2d343`](nodejs/node@d202e2d343)] - **deps**: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) [#&#8203;62629](nodejs/node#62629)
- \[[`2faba66341`](nodejs/node@2faba66341)] - **deps**: update minimatch to 10.2.5 (Node.js GitHub Bot) [#&#8203;62594](nodejs/node#62594)
- \[[`fa46c90c5d`](nodejs/node@fa46c90c5d)] - **deps**: update googletest to [`d72f9c8`](nodejs/node@d72f9c8) (Node.js GitHub Bot) [#&#8203;62593](nodejs/node#62593)
- \[[`099ded5713`](nodejs/node@099ded5713)] - **deps**: update simdjson to 4.6.1 (Node.js GitHub Bot) [#&#8203;62592](nodejs/node#62592)
- \[[`7ce95afe96`](nodejs/node@7ce95afe96)] - **deps**: libuv: cherry-pick [`aabb765`](nodejs/node@aabb7651de) (Santiago Gimeno) [#&#8203;62561](nodejs/node#62561)
- \[[`57ef845623`](nodejs/node@57ef845623)] - **deps**: update icu to 78.3 (Node.js GitHub Bot) [#&#8203;62324](nodejs/node#62324)
- \[[`493ac40e12`](nodejs/node@493ac40e12)] - **deps**: update libuv to 1.52.1 (Node.js GitHub Bot) [#&#8203;61829](nodejs/node#61829)
- \[[`b39508b368`](nodejs/node@b39508b368)] - **deps**: update undici to 7.25.0 (Node.js GitHub Bot) [#&#8203;63011](nodejs/node#63011)
- \[[`cb67a925e9`](nodejs/node@cb67a925e9)] - **deps**: use npm undici\@&#8203;seven tag in `update-undici.sh` (Matteo Collina) [#&#8203;62739](nodejs/node#62739)
- \[[`aa1e0bc28b`](nodejs/node@aa1e0bc28b)] - **doc**: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) [#&#8203;62828](nodejs/node#62828)
- \[[`f2a1735ed9`](nodejs/node@f2a1735ed9)] - **doc**: fix duplicate word "to to" in util.styleText (Daijiro Wachi) [#&#8203;62917](nodejs/node#62917)
- \[[`b6378e215c`](nodejs/node@b6378e215c)] - **doc**: fix node-config-schema (Сковорода Никита Андреевич) [#&#8203;61596](nodejs/node#61596)
- \[[`233894a9ce`](nodejs/node@233894a9ce)] - **doc**: fix the TypeScript Execute (tsx) project link (David Thornton) [#&#8203;63093](nodejs/node#63093)
- \[[`5d97919f8f`](nodejs/node@5d97919f8f)] - **doc**: correct diagnostics\_channel built-in channel names (Bryan English) [#&#8203;62995](nodejs/node#62995)
- \[[`2a9ccc927e`](nodejs/node@2a9ccc927e)] - **doc**: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) [#&#8203;62884](nodejs/node#62884)
- \[[`ef413b5358`](nodejs/node@ef413b5358)] - **doc**: fix typo in test.md (Rich Trott) [#&#8203;62960](nodejs/node#62960)
- \[[`76f21c5070`](nodejs/node@76f21c5070)] - **doc**: correct typo in PR contribution instructions (Mike McCready) [#&#8203;62738](nodejs/node#62738)
- \[[`ca02af1f7d`](nodejs/node@ca02af1f7d)] - **doc**: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) [#&#8203;62917](nodejs/node#62917)
- \[[`46c99ed526`](nodejs/node@46c99ed526)] - **doc**: fix duplicate word "for for" in compile cache (Daijiro Wachi) [#&#8203;62917](nodejs/node#62917)
- \[[`1a60851734`](nodejs/node@1a60851734)] - **doc**: fix typo in dns.lookup options description (Daijiro Wachi) [#&#8203;62882](nodejs/node#62882)
- \[[`169b5ea2ed`](nodejs/node@169b5ea2ed)] - **doc**: fix Argon2 parameter bounds (Tobias Nießen) [#&#8203;62868](nodejs/node#62868)
- \[[`9a3a190f4e`](nodejs/node@9a3a190f4e)] - **doc**: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) [#&#8203;62205](nodejs/node#62205)
- \[[`0fba9e87d6`](nodejs/node@0fba9e87d6)] - **doc**: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) [#&#8203;62841](nodejs/node#62841)
- \[[`9c700f3446`](nodejs/node@9c700f3446)] - **doc**: clarify dns.lookup() callback signature when all is true (eungi) [#&#8203;62800](nodejs/node#62800)
- \[[`6b7280bc17`](nodejs/node@6b7280bc17)] - **doc**: add experimental modules lifetime policy (Paolo Insogna) [#&#8203;62753](nodejs/node#62753)
- \[[`ce47ea31c9`](nodejs/node@ce47ea31c9)] - **doc**: clarify process.\_debugProcess() in Permission Model (Fahad Khan) [#&#8203;62537](nodejs/node#62537)
- \[[`ba01633757`](nodejs/node@ba01633757)] - **doc**: fix typo in devcontainer guide (Rohan Santhosh Kumar) [#&#8203;62687](nodejs/node#62687)
- \[[`70b4d5839b`](nodejs/node@70b4d5839b)] - **doc**: clarify Backport-PR-URL metadata added automatically (Mike McCready) [#&#8203;62668](nodejs/node#62668)
- \[[`8126d1c3eb`](nodejs/node@8126d1c3eb)] - **doc**: update WPT test runner README.md (Filip Skokan) [#&#8203;62680](nodejs/node#62680)
- \[[`978afea4b5`](nodejs/node@978afea4b5)] - **doc**: fix spelling in release announcement guidance (Rohan Santhosh Kumar) [#&#8203;62663](nodejs/node#62663)
- \[[`1684ab8ff8`](nodejs/node@1684ab8ff8)] - **doc**: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) [#&#8203;62600](nodejs/node#62600)
- \[[`86d4f07930`](nodejs/node@86d4f07930)] - **doc**: update bug bounty program (Rafael Gonzaga) [#&#8203;62590](nodejs/node#62590)
- \[[`736ed8a08f`](nodejs/node@736ed8a08f)] - **doc**: document TransformStream transformer.cancel option (Tom Pereira) [#&#8203;62566](nodejs/node#62566)
- \[[`938af9be01`](nodejs/node@938af9be01)] - **doc**: mention test runner retry attemp is zero based (Moshe Atlow) [#&#8203;62504](nodejs/node#62504)
- \[[`94433e450f`](nodejs/node@94433e450f)] - **doc,src,test**: fix dead inspector help URL (semimikoh) [#&#8203;62745](nodejs/node#62745)
- \[[`ddf1f01659`](nodejs/node@ddf1f01659)] - **esm**: add `ERR_REQUIRE_ESM_RACE_CONDITION` (Antoine du Hamel) [#&#8203;62462](nodejs/node#62462)
- \[[`4a506acd16`](nodejs/node@4a506acd16)] - **fs**: add followSymlinks option to glob (Matteo Collina) [#&#8203;62695](nodejs/node#62695)
- \[[`f4ea495f9b`](nodejs/node@f4ea495f9b)] - **fs**: restore fs patchability in ESM loader (Joyee Cheung) [#&#8203;62835](nodejs/node#62835)
- \[[`63c111cd60`](nodejs/node@63c111cd60)] - **fs**: validate position argument before length === 0 early return (Edy Silva) [#&#8203;62674](nodejs/node#62674)
- \[[`9705f628d9`](nodejs/node@9705f628d9)] - **(SEMVER-MINOR)** **fs**: add signal option to fs.stat() (Mert Can Altin) [#&#8203;57775](nodejs/node#57775)
- \[[`40ccfdecf9`](nodejs/node@40ccfdecf9)] - **(SEMVER-MINOR)** **fs**: expose frsize field in statfs (Jinho Jang) [#&#8203;62277](nodejs/node#62277)
- \[[`717476a24e`](nodejs/node@717476a24e)] - **http**: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) [#&#8203;62936](nodejs/node#62936)
- \[[`d7188af5c9`](nodejs/node@d7188af5c9)] - **(SEMVER-MINOR)** **http**: harden ClientRequest options merge (Matteo Collina) [#&#8203;63082](nodejs/node#63082)
- \[[`64f15c274a`](nodejs/node@64f15c274a)] - **http**: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) [#&#8203;62872](nodejs/node#62872)
- \[[`5c4798d799`](nodejs/node@5c4798d799)] - **http**: fix no\_proxy leading-dot suffix matching (Daijiro Wachi) [#&#8203;62333](nodejs/node#62333)
- \[[`9f3bc70ae5`](nodejs/node@9f3bc70ae5)] - **http**: cleanup pipeline queue (Robert Nagy) [#&#8203;62534](nodejs/node#62534)
- \[[`aa1d8a9afc`](nodejs/node@aa1d8a9afc)] - **(SEMVER-MINOR)** **http**: add req.signal to IncomingMessage (Akshat) [#&#8203;62541](nodejs/node#62541)
- \[[`900dc758ff`](nodejs/node@900dc758ff)] - **http2**: expose writable stream state on compat response (T) [#&#8203;63003](nodejs/node#63003)
- \[[`b3bfe35912`](nodejs/node@b3bfe35912)] - **inspector**: coerce key and value to string in webstorage events (Ali Hassan) [#&#8203;62616](nodejs/node#62616)
- \[[`3dc3fb6ad8`](nodejs/node@3dc3fb6ad8)] - **inspector**: return errors when CDP protocol event emission fails (Ryuhei Shima) [#&#8203;62162](nodejs/node#62162)
- \[[`4f3f21bd7c`](nodejs/node@4f3f21bd7c)] - **inspector**: auto collect webstorage data (Ryuhei Shima) [#&#8203;62145](nodejs/node#62145)
- \[[`36cc04189d`](nodejs/node@36cc04189d)] - **inspector**: initial support storage inspection (Ryuhei Shima) [#&#8203;61139](nodejs/node#61139)
- \[[`1718bc3b9b`](nodejs/node@1718bc3b9b)] - **inspector**: fix absolute URLs in network http (bugyaluwang) [#&#8203;62955](nodejs/node#62955)
- \[[`97e32c7a74`](nodejs/node@97e32c7a74)] - **lib**: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) [#&#8203;62914](nodejs/node#62914)
- \[[`25d2e999de`](nodejs/node@25d2e999de)] - **lib**: harden kKeyOps lookup with null prototype (Filip Skokan) [#&#8203;62877](nodejs/node#62877)
- \[[`37d3913c8f`](nodejs/node@37d3913c8f)] - **lib**: short-circuit WebIDL BufferSource SAB check (Filip Skokan) [#&#8203;62833](nodejs/node#62833)
- \[[`430c69d25f`](nodejs/node@430c69d25f)] - **lib**: use js-only implementation of `isDataView()` (René) [#&#8203;62780](nodejs/node#62780)
- \[[`3ba0add6a0`](nodejs/node@3ba0add6a0)] - **lib**: fix lint in internal/webstreams/util.js (Filip Skokan) [#&#8203;62806](nodejs/node#62806)
- \[[`9b95c41398`](nodejs/node@9b95c41398)] - **lib**: fix sequence argument handling in Blob constructor (Ms2ger) [#&#8203;62179](nodejs/node#62179)
- \[[`314dacdbee`](nodejs/node@314dacdbee)] - **lib**: improve Web Cryptography key validation ordering (Filip Skokan) [#&#8203;62749](nodejs/node#62749)
- \[[`3d18162430`](nodejs/node@3d18162430)] - **lib**: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) [#&#8203;62632](nodejs/node#62632)
- \[[`ada3ce879d`](nodejs/node@ada3ce879d)] - **lib**: defer AbortSignal.any() following (sangwook) [#&#8203;62367](nodejs/node#62367)
- \[[`b2981ec7eb`](nodejs/node@b2981ec7eb)] - **meta**: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot\[bot]) [#&#8203;62549](nodejs/node#62549)
- \[[`7cd20667b5`](nodejs/node@7cd20667b5)] - **meta**: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot\[bot]) [#&#8203;63074](nodejs/node#63074)
- \[[`91a07cfe9f`](nodejs/node@91a07cfe9f)] - **meta**: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot\[bot]) [#&#8203;63073](nodejs/node#63073)
- \[[`09e17fe47c`](nodejs/node@09e17fe47c)] - **meta**: add automation policy (Chengzhong Wu) [#&#8203;62871](nodejs/node#62871)
- \[[`59e7fb7986`](nodejs/node@59e7fb7986)] - **meta**: move VoltrexKeyva to emeritus (Matteo Collina) [#&#8203;62895](nodejs/node#62895)
- \[[`1e2915cfa6`](nodejs/node@1e2915cfa6)] - **meta**: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot\[bot]) [#&#8203;62845](nodejs/node#62845)
- \[[`0253c6e2be`](nodejs/node@0253c6e2be)] - **meta**: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot\[bot]) [#&#8203;62844](nodejs/node#62844)
- \[[`f503675b86`](nodejs/node@f503675b86)] - **meta**: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot\[bot]) [#&#8203;62842](nodejs/node#62842)
- \[[`5e14e4d26e`](nodejs/node@5e14e4d26e)] - **meta**: broaden stale bot (Aviv Keller) [#&#8203;62658](nodejs/node#62658)
- \[[`795db76f87`](nodejs/node@795db76f87)] - **meta**: pass release version to release worker (flakey5) [#&#8203;62777](nodejs/node#62777)
- \[[`ef384fe39f`](nodejs/node@ef384fe39f)] - **meta**: add QUIC to CODEOWNERS (Tim Perry) [#&#8203;62652](nodejs/node#62652)
- \[[`67e0ac568d`](nodejs/node@67e0ac568d)] - **meta**: move Michael to emeritus (Michael Dawson) [#&#8203;62536](nodejs/node#62536)
- \[[`5dad616393`](nodejs/node@5dad616393)] - **meta**: populate apt list for slim runner in update-openssl workflow (René) [#&#8203;62628](nodejs/node#62628)
- \[[`a869d25d8a`](nodejs/node@a869d25d8a)] - **meta**: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot\[bot]) [#&#8203;62550](nodejs/node#62550)
- \[[`769efc0403`](nodejs/node@769efc0403)] - **meta**: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot\[bot]) [#&#8203;62548](nodejs/node#62548)
- \[[`73fcc2b055`](nodejs/node@73fcc2b055)] - **meta**: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot\[bot]) [#&#8203;62547](nodejs/node#62547)
- \[[`6c001246fe`](nodejs/node@6c001246fe)] - **meta**: bump codecov/codecov-action from 5.5.2 to 6.0.0 (dependabot\[bot]) [#&#8203;62545](nodejs/node#62545)
- \[[`5ee40d6a03`](nodejs/node@5ee40d6a03)] - **meta**: bump actions/cache from 5.0.3 to 5.0.4 (dependabot\[bot]) [#&#8203;62543](nodejs/node#62543)
- \[[`ca16ad8a05`](nodejs/node@ca16ad8a05)] - **meta**: require DCO signoff in commit message guidelines (James M Snell) [#&#8203;62510](nodejs/node#62510)
- \[[`db9497fc41`](nodejs/node@db9497fc41)] - **meta**: expand memory leak DoS criteria to all DoS (Joyee Cheung) [#&#8203;62505](nodejs/node#62505)
- \[[`13b7d08b8d`](nodejs/node@13b7d08b8d)] - **module**: remove duplicated checks from `_resolveFilename` (Antoine du Hamel) [#&#8203;62729](nodejs/node#62729)
- \[[`6b53efb53a`](nodejs/node@6b53efb53a)] - **module,win**: fix long subpath import (Stefan Stojanovic) [#&#8203;62101](nodejs/node#62101)
- \[[`841dfbf6fc`](nodejs/node@841dfbf6fc)] - **node-api**: update libuv ABI stability note (Chengzhong Wu) [#&#8203;62789](nodejs/node#62789)
- \[[`01090f2aa1`](nodejs/node@01090f2aa1)] - **node-api**: add napi\_create\_external\_sharedarraybuffer (Ben Noordhuis) [#&#8203;62623](nodejs/node#62623)
- \[[`87443b4355`](nodejs/node@87443b4355)] - **node-api**: execute tsfn finalizer after queue drains when aborted (Kevin Eady) [#&#8203;61956](nodejs/node#61956)
- \[[`e95570c054`](nodejs/node@e95570c054)] - **process**: handle rejections only when needed (Gürgün Dayıoğlu) [#&#8203;62919](nodejs/node#62919)
- \[[`37d49f3219`](nodejs/node@37d49f3219)] - **process**: optimize asyncHandledRejections by using FixedQueue (Gürgün Dayıoğlu) [#&#8203;60854](nodejs/node#60854)
- \[[`f697c55e38`](nodejs/node@f697c55e38)] - **quic**: add QuicEndpoint.listening & QuicStream.destroy() and tests (Tim Perry) [#&#8203;62648](nodejs/node#62648)
- \[[`c128942b69`](nodejs/node@c128942b69)] - **quic**: fixup token verification to handle zero expiration (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`abb881ec92`](nodejs/node@abb881ec92)] - **quic**: support multiple ALPN negotiation (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`476926c2ad`](nodejs/node@476926c2ad)] - **quic**: apply multiple TLS context improvements and SNI support (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`76d9c24b95`](nodejs/node@76d9c24b95)] - **quic**: implement rapidhash for hashing improvements (James M Snell) [#&#8203;62620](nodejs/node#62620)
- \[[`08726cd43d`](nodejs/node@08726cd43d)] - **quic**: move quic behind compile time flag (Matteo Collina) [#&#8203;61444](nodejs/node#61444)
- \[[`ea4f19aaa7`](nodejs/node@ea4f19aaa7)] - **quic**: use arena allocation for packets (James M Snell) [#&#8203;62589](nodejs/node#62589)
- \[[`21e9239e2a`](nodejs/node@21e9239e2a)] - **quic**: fixup linting/formatting issues (James M Snell) [#&#8203;62387](nodejs/node#62387)
- \[[`edeed4303b`](nodejs/node@edeed4303b)] - **quic**: update http3 impl details (James M Snell) [#&#8203;62387](nodejs/node#62387)
- \[[`7f3a85e6aa`](nodejs/node@7f3a85e6aa)] - **quic**: fix a handful of bugs and missing functionality (James M Snell) [#&#8203;62387](nodejs/node#62387)
- \[[`45c1ebddf8`](nodejs/node@45c1ebddf8)] - **quic**: copy options.certs buffer instead of detaching (Chengzhong Wu) [#&#8203;61403](nodejs/node#61403)
- \[[`a31a8ee680`](nodejs/node@a31a8ee680)] - **quic**: reduce boilerplate and other minor cleanups (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`3be70ff43a`](nodejs/node@3be70ff43a)] - **quic**: multiple fixups and updates (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`b91a93444c`](nodejs/node@b91a93444c)] - **quic**: update more of the quic to the new compile guard (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`ca0080c164`](nodejs/node@ca0080c164)] - **quic**: few additional small comment edits in cid.h (James M Snell) [#&#8203;59342](nodejs/node#59342)
- \[[`6553202d83`](nodejs/node@6553202d83)] - **quic**: fixup NO\_ERROR macro conflict on windows (James M Snell) [#&#8203;59381](nodejs/node#59381)
- \[[`6df1508ac2`](nodejs/node@6df1508ac2)] - **quic**: fixup windows coverage compile error (James M Snell) [#&#8203;59381](nodejs/node#59381)
- \[[`b2b0bf8b04`](nodejs/node@b2b0bf8b04)] - **quic**: update the guard to check openssl version (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`5556b154bd`](nodejs/node@5556b154bd)] - **quic**: start re-enabling quic with openssl 3.5 (James M Snell) [#&#8203;59249](nodejs/node#59249)
- \[[`2ca42c8263`](nodejs/node@2ca42c8263)] - **repl**: keep reference count for `process.on('newListener')` (Anna Henningsen) [#&#8203;61895](nodejs/node#61895)
- \[[`2f37f9177f`](nodejs/node@2f37f9177f)] - **sqlite**: use OneByte for ASCII text and internalize col names (Ali Hassan) [#&#8203;61954](nodejs/node#61954)
- \[[`3c96ae1b2f`](nodejs/node@3c96ae1b2f)] - **sqlite**: add serialize() and deserialize() (Ali Hassan) [#&#8203;62579](nodejs/node#62579)
- \[[`be4d2f3a4c`](nodejs/node@be4d2f3a4c)] - **sqlite**: enable Percentile extension (Jurj Andrei George) [#&#8203;61295](nodejs/node#61295)
- \[[`dafed453b2`](nodejs/node@dafed453b2)] - **src**: clean up experimental flag variables (Antoine du Hamel) [#&#8203;62759](nodejs/node#62759)
- \[[`dca1e6aeea`](nodejs/node@dca1e6aeea)] - **src**: expose help texts into node-config-schema.json (Pietro Marchini) [#&#8203;58680](nodejs/node#58680)
- \[[`28c4f44eb1`](nodejs/node@28c4f44eb1)] - **src**: add permission support to config file (Marco Ippolito) [#&#8203;60746](nodejs/node#60746)
- \[[`f49175b220`](nodejs/node@f49175b220)] - **src**: fix small compile warning in quic/streams.cc (James M Snell) [#&#8203;60118](nodejs/node#60118)
- \[[`c9d4a446d8`](nodejs/node@c9d4a446d8)] - **src**: cleanup quic TransportParams class (James M Snell) [#&#8203;59884](nodejs/node#59884)
- \[[`99bb02fd9e`](nodejs/node@99bb02fd9e)] - **src**: swap dotenv and config file parsing order (Marco Ippolito) [#&#8203;63035](nodejs/node#63035)
- \[[`ecb4d49b7b`](nodejs/node@ecb4d49b7b)] - **src**: add missing \<cstdlib> for abort() declaration (Charles Kerr) [#&#8203;63001](nodejs/node#63001)
- \[[`b6219b6362`](nodejs/node@b6219b6362)] - **src**: fix crash in GetErrorSource() for invalid using syntax (semimikoh) [#&#8203;62770](nodejs/node#62770)
- \[[`b5ca5ad4c5`](nodejs/node@b5ca5ad4c5)] - **src**: simplify `TCPWrap::Connect` signature (Anna Henningsen) [#&#8203;62929](nodejs/node#62929)
- \[[`ef7ffce7cf`](nodejs/node@ef7ffce7cf)] - **src**: use DCHECK in AsyncWrap::MakeCallback instead emiting a warning (Gerhard Stöbich) [#&#8203;62795](nodejs/node#62795)
- \[[`cd9890a5ab`](nodejs/node@cd9890a5ab)] - **src**: fix MaybeStackBuffer char\_traits deprecation warning (om-ghante) [#&#8203;62507](nodejs/node#62507)
- \[[`c70ff44aee`](nodejs/node@c70ff44aee)] - **src**: use context-free V8 message column getters (René) [#&#8203;62778](nodejs/node#62778)
- \[[`06c405f1d7`](nodejs/node@06c405f1d7)] - **src**: coerce `spawnSync` args to string once (Antoine du Hamel) [#&#8203;62633](nodejs/node#62633)
- \[[`6151999ad6`](nodejs/node@6151999ad6)] - **src**: use stack allocation for small string encoding (Ali Hassan) [#&#8203;62431](nodejs/node#62431)
- \[[`a71a4ac7a3`](nodejs/node@a71a4ac7a3)] - **src**: add contextify interceptor debug logs (Chengzhong Wu) [#&#8203;62460](nodejs/node#62460)
- \[[`ad9a2909c2`](nodejs/node@ad9a2909c2)] - **src**: workaround AIX libc++ std::filesystem bug (Richard Lau) [#&#8203;62788](nodejs/node#62788)
- \[[`7792f1ae47`](nodejs/node@7792f1ae47)] - **stream**: copyedit `webstreams/adapter.js` (Antoine du Hamel) [#&#8203;63034](nodejs/node#63034)
- \[[`1397d8ce5c`](nodejs/node@1397d8ce5c)] - **stream**: remove duplicated utility (Antoine du Hamel) [#&#8203;63031](nodejs/node#63031)
- \[[`ff86b1d64f`](nodejs/node@ff86b1d64f)] - **stream**: simplify `setPromiseHandled` utility (Antoine du Hamel) [#&#8203;63032](nodejs/node#63032)
- \[[`24a078149a`](nodejs/node@24a078149a)] - **stream**: validate ReadableStream.from iterator objects (Daeyeon Jeong) [#&#8203;62911](nodejs/node#62911)
- \[[`cfb1fa9680`](nodejs/node@cfb1fa9680)] - **stream**: reject duplicate nested transferables (Daeyeon Jeong) [#&#8203;62831](nodejs/node#62831)
- \[[`d0c913758a`](nodejs/node@d0c913758a)] - **stream**: ensuring cross-destruction in \_duplexify to prevent leaks (Daijiro Wachi) [#&#8203;62824](nodejs/node#62824)
- \[[`978f5c15d7`](nodejs/node@978f5c15d7)] - **stream**: simplify `readableStreamFromIterable` (Antoine du Hamel) [#&#8203;62651](nodejs/node#62651)
- \[[`3527646ba5`](nodejs/node@3527646ba5)] - **stream**: fix nested compose error propagation (Matteo Collina) [#&#8203;62556](nodejs/node#62556)
- \[[`dfb9edef4f`](nodejs/node@dfb9edef4f)] - **stream**: allow shared array buffer sources in writable webstream adapter (René) [#&#8203;62163](nodejs/node#62163)
- \[[`f00cdab627`](nodejs/node@f00cdab627)] - **stream**: simplify `createPromiseCallback` (Antoine du Hamel) [#&#8203;62650](nodejs/node#62650)
- \[[`3ed783535f`](nodejs/node@3ed783535f)] - **stream**: fix writev unhandled rejection in fromWeb (sangwook) [#&#8203;62297](nodejs/node#62297)
- \[[`29b196694c`](nodejs/node@29b196694c)] - **stream**: noop pause/resume on destroyed streams (Robert Nagy) [#&#8203;62557](nodejs/node#62557)
- \[[`d73dbb9fc8`](nodejs/node@d73dbb9fc8)] - **stream**: refactor duplexify to be less suceptible to prototype pollution (Antoine du Hamel) [#&#8203;62559](nodejs/node#62559)
- \[[`6f37f7e240`](nodejs/node@6f37f7e240)] - **(SEMVER-MINOR)** **stream**: propagate destruction in duplexPair (Ahmed Elhor) [#&#8203;61098](nodejs/node#61098)
- \[[`b8816580e9`](nodejs/node@b8816580e9)] - **test**: generate `localstorage.db` in a temp dir (Chengzhong Wu) [#&#8203;62660](nodejs/node#62660)
- \[[`31a863fd29`](nodejs/node@31a863fd29)] - **test**: update WPT for url to [`258f285`](nodejs/node@258f285de0) (Node.js GitHub Bot) [#&#8203;63087](nodejs/node#63087)
- \[[`d0d19bd8e3`](nodejs/node@d0d19bd8e3)] - **test**: update WPT for streams to [`f8f26a3`](nodejs/node@f8f26a372f) (Node.js GitHub Bot) [#&#8203;62864](nodejs/node#62864)
- \[[`f50ac5bc78`](nodejs/node@f50ac5bc78)] - **test**: improve config-file permission test coverage (Rafael Gonzaga) [#&#8203;60929](nodejs/node#60929)
- \[[`a0f90000f4`](nodejs/node@a0f90000f4)] - **test**: export isRiscv64 from common module (Jamie Magee) [#&#8203;62609](nodejs/node#62609)
- \[[`da4dd8646f`](nodejs/node@da4dd8646f)] - **test**: normalize known inspector crash as completion (Joyee Cheung) [#&#8203;62851](nodejs/node#62851)
- \[[`b7fdd94a4c`](nodejs/node@b7fdd94a4c)] - **test**: account for RFC 7919 FFDHE negotiation in OpenSSL 4.0 (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`375a993aaf`](nodejs/node@375a993aaf)] - **test**: skip tls-deprecated secp256k1 on OpenSSL 4.0 (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`698d8287d1`](nodejs/node@698d8287d1)] - **test**: use an always invalid cipher and cover OpenSSL 4.0 behaviours (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`036bc6f300`](nodejs/node@036bc6f300)] - **test**: use valid DER OCSP responses (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`3aa9938da8`](nodejs/node@3aa9938da8)] - **test**: skip test-tls-error-stack when engines are unsupported (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`947f1ae246`](nodejs/node@947f1ae246)] - **test**: accept renamed OpenSSL 4.0 error code and reason (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`afdd355622`](nodejs/node@afdd355622)] - **test**: update test/addons/openssl-binding for OpenSSL 4.0 (Filip Skokan) [#&#8203;62805](nodejs/node#62805)
- \[[`8637524a99`](nodejs/node@8637524a99)] - **test**: mark test-snapshot-reproducible flaky (Filip Skokan) [#&#8203;62808](nodejs/node#62808)
- \[[`c22d34134b`](nodejs/node@c22d34134b)] - **test**: check contextify contextual store behavior in strict mode (René) [#&#8203;62571](nodejs/node#62571)
- \[[`0b4e0d3c94`](nodejs/node@0b4e0d3c94)] - **test**: update tls junk data error expectations (Filip Skokan) [#&#8203;62629](nodejs/node#62629)
- \[[`85d83c2cdb`](nodejs/node@85d83c2cdb)] - **test**: ensure WPT report is in out/wpt (Filip Skokan) [#&#8203;62637](nodejs/node#62637)
- \[[`9e21711c60`](nodejs/node@9e21711c60)] - **test**: improve WPT runner summary (Filip Skokan) [#&#8203;62636](nodejs/node#62636)
- \[[`e04e2c9ac1`](nodejs/node@e04e2c9ac1)] - **test**: skip url WPT subtests instead of modifying test script (Filip Skokan) [#&#8203;62635](nodejs/node#62635)
- \[[`7b1211f88c`](nodejs/node@7b1211f88c)] - **test**: capture negative utimes mtime at call time (Yuya Inoue) [#&#8203;62490](nodejs/node#62490)
- \[[`f1a6e9fcc7`](nodejs/node@f1a6e9fcc7)] - **test**: allow skipping individual WPT subtests (Filip Skokan) [#&#8203;62517](nodejs/node#62517)
- \[[`23f927542e`](nodejs/node@23f927542e)] - **test**: use on-disk fixture for test-npm-install (Joyee Cheung) [#&#8203;62584](nodejs/node#62584)
- \[[`4739c45879`](nodejs/node@4739c45879)] - **test**: update WPT for url to [`7a3645b`](nodejs/node@7a3645b79a) (Node.js GitHub Bot) [#&#8203;62591](nodejs/node#62591)
- \[[`f68189b839`](nodejs/node@f68189b839)] - **test\_runner**: add `testId` to test events (Moshe Atlow) [#&#8203;62772](nodejs/node#62772)
- \[[`5c2770446e`](nodejs/node@5c2770446e)] - **test\_runner**: publish to TracingChannel for OTel instrumentation (Moshe Atlow) [#&#8203;62502](nodejs/node#62502)
- \[[`d14029be7f`](nodejs/node@d14029be7f)] - **(SEMVER-MINOR)** **test\_runner**: support test order randomization (Pietro Marchini) [#&#8203;61747](nodejs/node#61747)
- \[[`3f74a58979`](nodejs/node@3f74a58979)] - **test\_runner**: update node-config-schema (Pietro Marchini) [#&#8203;58680](nodejs/node#58680)
- \[[`60c83f6199`](nodejs/node@60c83f6199)] - **test\_runner**: fix failing suite hooks when marked with `todo` (Moshe Atlow) [#&#8203;63097](nodejs/node#63097)
- \[[`d142c584cd`](nodejs/node@d142c584cd)] - **(SEMVER-MINOR)** **test\_runner**: align mock timeout api (sangwook) [#&#8203;62820](nodejs/node#62820)
- \[[`3e72065ed6`](nodejs/node@3e72065ed6)] - **test\_runner**: fix suite rerun edge case (Moshe Atlow) [#&#8203;62860](nodejs/node#62860)
- \[[`01a9552585`](nodejs/node@01a9552585)] - **(SEMVER-MINOR)** **test\_runner**: add mock-timers support for AbortSignal.timeout (DeveloperViraj) [#&#8203;60751](nodejs/node#60751)
- \[[`dd43efffa6`](nodejs/node@dd43efffa6)] - **test\_runner**: add passed, attempt, and diagnostic to SuiteContext (Moshe Atlow) [#&#8203;62504](nodejs/node#62504)
- \[[`a12dc445cc`](nodejs/node@a12dc445cc)] - **tools**: add a check for clean git tree after tests (Antoine du Hamel) [#&#8203;62661](nodejs/node#62661)
- \[[`5b49178375`](nodejs/node@5b49178375)] - **tools**: use LTS Node.js in notify-on-push workflow (Nenad Spasenic) [#&#8203;63084](nodejs/node#63084)
- \[[`5a93bde5bb`](nodejs/node@5a93bde5bb)] - **tools**: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) [#&#8203;63065](nodejs/node#63065)
- \[[`b133019d19`](nodejs/node@b133019d19)] - **tools**: simplify `update-undici.sh` (Antoine du Hamel) [#&#8203;63044](nodejs/node#63044)
- \[[`04d3538074`](nodejs/node@04d3538074)] - **tools**: do not run `test-linux` on unrelated tools changes (Antoine du Hamel) [#&#8203;63037](nodejs/node#63037)
- \[[`4d396ac4a5`](nodejs/node@4d396ac4a5)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#&#8203;62848](nodejs/node#62848)
- \[[`9354bf40e7`](nodejs/node@9354bf40e7)] - **tools**: update gyp-next to 0.22.1 (Node.js GitHub Bot) [#&#8203;62961](nodejs/node#62961)
- \[[`c23db1ca85`](nodejs/node@c23db1ca85)] - **tools**: fix commit linter for semver-major release proposals (Antoine du Hamel) [#&#8203;62993](nodejs/node#62993)
- \[[`6e097ee3f1`](nodejs/node@6e097ee3f1)] - **tools**: consolidate and simplify .editorconfig deps section (Daijiro Wachi) [#&#8203;62887](nodejs/node#62887)
- \[[`a47ea6d6ea`](nodejs/node@a47ea6d6ea)] - **tools**: set bot as author of tools-deps-update PRs (Antoine du Hamel) [#&#8203;62856](nodejs/node#62856)
- \[[`00e86f0471`](nodejs/node@00e86f0471)] - **tools**: bump brace-expansion from 5.0.4 to 5.0.5 in /tools/eslint (dependabot\[bot]) [#&#8203;62458](nodejs/node#62458)
- \[[`cd7e262e75`](nodejs/node@cd7e262e75)] - **tools**: bump brace-expansion in /tools/clang-format (dependabot\[bot]) [#&#8203;62467](nodejs/node#62467)
- \[[`bfc1319bc8`](nodejs/node@bfc1319bc8)] - **tools**: exclude [@&#8203;node-core/doc-kit](https://github.com/node-core/doc-kit) from dependabot cooldown (Levi Zim) [#&#8203;62775](nodejs/node#62775)
- \[[`a932fbd10b`](nodejs/node@a932fbd10b)] - **tools**: re-enable undici WPTs in daily wpt.fyi job (Filip Skokan) [#&#8203;62677](nodejs/node#62677)
- \[[`f7bd9e3055`](nodejs/node@f7bd9e3055)] - **tools**: update gyp-next to 0.22.0 (Node.js GitHub Bot) [#&#8203;62697](nodejs/node#62697)
- \[[`c400d46d87`](nodejs/node@c400d46d87)] - **tools**: improve backport review script (Antoine du Hamel) [#&#8203;62573](nodejs/node#62573)
- \[[`be23b75814`](nodejs/node@be23b75814)] - **tools**: improve output for unexpected passes in WTP tests (Antoine du Hamel) [#&#8203;62587](nodejs/node#62587)
- \[[`609c013ece`](nodejs/node@609c013ece)] - **tools**: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) [#&#8203;62627](nodejs/node#62627)
- \[[`81bac1ebfd`](nodejs/node@81bac1ebfd)] - **tools**: bump the eslint group in /tools/eslint with 2 updates (dependabot\[bot]) [#&#8203;62552](nodejs/node#62552)
- \[[`1fee26522d`](nodejs/node@1fee26522d)] - **tools**: allow triagers to queue a PR for CI until it's reviewed (Antoine du Hamel) [#&#8203;62524](nodejs/node#62524)
- \[[`332088f929`](nodejs/node@332088f929)] - **tools**: do not run `commit-lint` on release proposals (Antoine du Hamel) [#&#8203;62523](nodejs/node#62523)
- \[[`9a25fc8a4d`](nodejs/node@9a25fc8a4d)] - **url**: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) [#&#8203;62574](nodejs/node#62574)
- \[[`7bd08ff60a`](nodejs/node@7bd08ff60a)] - **url**: optimize URLSearchParams set/delete duplicate handling (Gürgün Dayıoğlu) [#&#8203;62266](nodejs/node#62266)
- \[[`2d636388fa`](nodejs/node@2d636388fa)] - **url**: align default argument handling for URLPattern with webidl (Filip Skokan) [#&#8203;62719](nodejs/node#62719)
- \[[`00705a459a`](nodejs/node@00705a459a)] - **(SEMVER-MINOR)** **util**: colorize text with hex colors (Guilherme Araújo) [#&#8203;61556](nodejs/node#61556)
- \[[`0e2adb3e45`](nodejs/node@0e2adb3e45)] - **watch**: track worker entry files in watch mode (SudhansuBandha) [#&#8203;62368](nodejs/node#62368)
- \[[`c58fe38211`](nodejs/node@c58fe38211)] - **watch**: fix --env-file-if-exists crashing on linux if the file is missing (Efe) [#&#8203;61870](nodejs/node#61870)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/480

* stream: copyedit `webstreams/adapter.js`

- Simplify `ZLIB_FAILURES` creation.
- Cache `cause.code` in `handleKnownInternalErrors` in case of a getter.
- Replace `SafePromiseAll` with `SafePromiseAllReturnVoid` to reduce the
  number of allocated promises.

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63034
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* build: track PDL files as inputs in inspector GN build

The `node_protocol_generated_sources` action
was missing `gypi_values.node_pdl_files` from its inputs, causing Ninja
to skip regeneration when PDL domain files changed.

PR-URL: https://github.com/nodejs/node/pull/62888
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Kohei Ueno <[email protected]>

* tools: use LTS Node.js in notify-on-push workflow

Without pinning Node.js, the runner defaults to Node 20 and npx falls
back to [email protected] instead of 6.0.0 (requires
Node 22+). Version 5 does not recognise the ffi subsystem, causing
false invalid-commit alerts.

Signed-off-by: Nenad Spasenic <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63084
Fixes: https://github.com/nodejs/node/issues/63070
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

* deps: update amaro to 1.1.9

PR-URL: https://github.com/nodejs/node/pull/63090
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* test_runner: fix failing suite hooks when marked with `todo`

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63097
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

* doc: fix the TypeScript Execute (tsx) project link

Signed-off-by: David Thornton <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63093
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: René <[email protected]>

* quic: start re-enabling quic with openssl 3.5

Start working on re-enabling QUIC support with the availability
of OpenSSL 3.5. This will be a multi-step process.

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* deps: update ngtcp2 to 1.14.0

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* deps: update nghttp3 to 1.11.0

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* quic: update the guard to check openssl version

Since we need to be able to use the openssl adapter provided
by the ngtcp2 library, and because that adapter does not include
any compile guards to ensure that OpenSSL 3.5 is being used and
that the APIs are actually available, we need to add a compile
time check for the openssl version in order to conditionally
include the adapter to avoid build errors when using a shared
openssl library that is not OpenSSL 3.5.

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59249
Reviewed-By: Matteo Collina <[email protected]>

* quic: fixup windows coverage compile error

PR-URL: https://github.com/nodejs/node/pull/59381
Fixes: https://github.com/nodejs/node/issues/59369
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

* quic: fixup NO_ERROR macro conflict on windows

PR-URL: https://github.com/nodejs/node/pull/59381
Fixes: https://github.com/nodejs/node/issues/59369
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

* quic: few additional small comment edits in cid.h

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* quic: update more of the quic to the new compile guard

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* quic: multiple fixups and updates

Signed-off-by: James M Snell <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* quic: reduce boilerplate and other minor cleanups

While I get that macros aren't the most loved thing in
the world, they do help reduce boilerplate, and there's
a lot of boilerplate in the QUIC code. This commit cleans
up some of that boilerplate, particularly around the
use of v8 APIs.

PR-URL: https://github.com/nodejs/node/pull/59342
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

* src: cleanup quic TransportParams class

PR-URL: https://github.com/nodejs/node/pull/59884
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* src: fix small compile warning in quic/streams.cc

Fixes: https://github.com/nodejs/node/issues/60110
PR-URL: https://github.com/nodejs/node/pull/60118
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

* deps: update nghttp3 to 1.13.1

PR-URL: https://github.com/nodejs/node/pull/60046
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* deps: update nghttp3 to 1.14.0

PR-URL: https://github.com/nodejs/node/pull/61187
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* quic: copy options.certs buffer instead of detaching

The certs could be allocated in a pooled buffer, like `Buffer.from`, and
`Buffer.allocUnsafe` (used by `fs.readFileSync`, etc).

PR-URL: https://github.com/nodejs/node/pull/61403
Refs: https://github.com/nodejs/node/pull/61372
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

* quic: fix a handful of bugs and missing functionality

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <[email protected]>

* quic: update http3 impl details

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <[email protected]>

* quic: fixup linting/formatting issues

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode/Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62387
Reviewed-By: Stephen Belanger <[email protected]>

* quic: use arena allocation for packets

Previously Packets were ReqWrap objects with a shared
free-list. This commit changes to a per-Endpoint arena
with no v8 involvement. This is the design I originally
had in mind but I initially went with the simpler
freelist approach to get something working. There's
too much overhead in the reqrap/freelist approach and
individual packets do not really need to be observable
via async hooks.

This design should eliminate the risk of memory fragmentation
and eliminate a significant bottleneck in the hot path.

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62589
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

* quic: move quic behind compile time flag

Move node:quic behind a compile-time flag, disabled by default.
Use --experimental-quic at configure time to enable.

- Add --experimental-quic flag to configure.py
- Add node_use_quic variable and HAVE_QUIC define
- Make QUIC sources conditional in node.gyp
- Move ngtcp2/nghttp3 deps under QUIC condition in node.gypi
- Update C++ guards to check HAVE_QUIC
- Update process.features.quic to check node_use_quic

PR-URL: https://github.com/nodejs/node/pull/61444
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

* quic: implement rapidhash for hashing improvements

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* src: add permission support to config file

PR-URL: https://github.com/nodejs/node/pull/60746
Backport-PR-URL: https://github.com/nodejs/node/pull/62760
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>

* test: improve config-file permission test coverage

Refs: https://github.com/nodejs/node/pull/60746#pullrequestreview-3470430664
PR-URL: https://github.com/nodejs/node/pull/60929
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* src: expose help texts into node-config-schema.json

PR-URL: https://github.com/nodejs/node/pull/58680
Reviewed-By: Marco Ippolito <[email protected]>

* test_runner: update node-config-schema

PR-URL: https://github.com/nodejs/node/pull/58680
Reviewed-By: Marco Ippolito <[email protected]>

* doc: fix node-config-schema

PR-URL: https://github.com/nodejs/node/pull/61596
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* meta: bump actions/download-artifact from 8.0.0 to 8.0.1

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62549
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* quic: apply multiple TLS context improvements and SNI support

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* quic: support multiple ALPN negotiation

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* quic: fixup token verification to handle zero expiration

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6
PR-URL: https://github.com/nodejs/node/pull/62620
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Tim Perry <[email protected]>

* util: colorize text with hex colors

PR-URL: https://github.com/nodejs/node/pull/61556
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Claudio Wunder <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* quic: add QuicEndpoint.listening & QuicStream.destroy() and tests

Starting to explore and cover the existing implementation, this covers
the basic endpoint & stream lifecycle and the exposed properties.
Added endpoint.listening to match net.Server and round out endpoint
properties, and stream.destroy() which is already called by
quicSession.destroy() and documented, but didn't actually exist.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62648
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* tools: add a check for clean git tree after tests

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62661
Refs: https://github.com/nodejs/node/issues/62646
Reviewed-By: Juan José Arboleda <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

* src: clean up experimental flag variables

- `fetch` is no longer disable by a CLI flag
- `node:sqlite` requires SQLite, obviously

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62759
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Geoffrey Booth <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Xuguang Mei <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

* fs: add followSymlinks option to glob

PR-URL: https://github.com/nodejs/node/pull/62695
Reviewed-By: Moshe Atlow <[email protected]>

* doc: fix duplicate word "to to" in util.styleText

PR-URL: https://github.com/nodejs/node/pull/62917
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>

* test: update WPT for streams to f8f26a372f

PR-URL: https://github.com/nodejs/node/pull/62864
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

* test: update WPT for url to 258f285de0

PR-URL: https://github.com/nodejs/node/pull/63087
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

* repl: keep reference count for `process.on('newListener')`

When investigating a memory leak in one of our applications,
we discovered that this listener holds on to a `REPLServer`
instance and all heap objects transitively kept alive by it
by capturing as part of its closure.

It's cleaner to declare the listener outside of the `REPLServer`
class and to actually clean it up properly when it is no longer
required or meaningful, which is easily achieved through
keeping a reference count.

PR-URL: https://github.com/nodejs/node/pull/61895
Backport-PR-URL: https://github.com/nodejs/node/pull/63194
Reviewed-By: Antoine du Hamel <[email protected]>

* crypto: remove Argon2 KDF derivation from its job setup

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62863
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Fixes: https://github.com/nodejs/node/issues/62861
Reviewed-By: Antoine du Hamel <[email protected]>

* crypto: reject unintended raw key format string input

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62974
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Reviewed-By: Antoine du Hamel <[email protected]>

* doc: fix typos and inconsistencies in crypto.md and webcrypto.md

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62828
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Reviewed-By: Antoine du Hamel <[email protected]>

* crypto: deduplicate and canonicalize CryptoKey usages

Fixes: https://github.com/nodejs/node/issues/62899

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62902
Backport-PR-URL: https://github.com/nodejs/node/pull/63173
Fixes: https://github.com/nodejs/node/issues/62899
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: initial support storage inspection

PR-URL: https://github.com/nodejs/node/pull/61139
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: auto collect webstorage data

PR-URL: https://github.com/nodejs/node/pull/62145
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: return errors when CDP protocol event emission fails

PR-URL: https://github.com/nodejs/node/pull/62162
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* inspector: coerce key and value to string in webstorage events

Signed-off-by: Ali Hassan <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62616
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Refs: https://github.com/nodejs/node/pull/62145
Refs: https://github.com/nodejs/node/pull/62162
Reviewed-By: Antoine du Hamel <[email protected]>

* test: generate `localstorage.db` in a temp dir

Co-Authored-By: Antoine du Hamel <[email protected]>
Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62660
Backport-PR-URL: https://github.com/nodejs/node/pull/63176
Reviewed-By: Antoine du Hamel <[email protected]>

* deps: V8: cherry-pick 657d8de27427

Original commit message:

    [maglev] Fix throwing node inside eager inlining

    This commit refactors the exception handling logic to correctly identify
    and associate nodes with their respective `catch` blocks, even
    when multiple levels of inlining are involved.

    Previously, the check `!IsInsideTryBlock() && !is_eager_inline()` was
    insufficient to determine if catch block inside `CatchDetails` was
    already created.

    Specifically, consider the case where:
    1. Function `bar` is non-eagerly inlined into `foo`.
    2. `foo` contains a `catch` block.
    3. `bar` calls `in_bar`, which is eagerly inlined.
    4. A node within `in_bar` can `throw`.

    In this scenario, `is_eager_inline` would be true when compiling
    `in_bar`, leading to an incorrect assumption that the catch block didn't exist yet.

    This change addresses the issue by propagating a boolean value via
    `CatchDetails`. This boolean accurately indicates whether a `catch`
    block is present in the call chain, allowing for correct exception
    handling regardless of inlining depth or eagerness.

    Fixed: 417768368
    Change-Id: Ic52f72f302b4dc644bdcad939addf98111bc525b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6563500
    Commit-Queue: Victor Gomes <[email protected]>
    Reviewed-by: Darius Mercadier <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#100380}

Refs: https://github.com/v8/v8/commit/657d8de274276c940d07203ee43d3cf4c732cebd
PR-URL: https://github.com/nodejs/node/pull/62784
Reviewed-By: Xuguang Mei <[email protected]>

* test_runner: support test order randomization

PR-URL: https://github.com/nodejs/node/pull/61747
Reviewed-By: Jacob Smith <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>

* test_runner: publish to TracingChannel for OTel instrumentation

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62502
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

* test_runner: add `testId` to test events

Signed-off-by: Moshe Atlow <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62772
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>

* deps: update corepack to 0.35.0

PR-URL: https://github.com/nodejs/node/pull/63375
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

* 2026-05-21, Version 24.16.0 'Krypton' (LTS)

Notable changes:

crypto:
  * (SEMVER-MINOR) implement `randomUUIDv7()` (nabeel378) https://github.com/nodejs/node/pull/62553
debugger:
  * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) https://github.com/nodejs/node/pull/62713
fs:
  * (SEMVER-MINOR) add `signal` option to `fs.stat()` (Mert Can Altin) https://github.com/nodejs/node/pull/57775
  * (SEMVER-MINOR) expose `frsize` field in `statfs` (Jinho Jang) https://github.com/nodejs/node/pull/62277
http:
  * (SEMVER-MINOR) harden `ClientRequest` options merge (Matteo Collina) https://github.com/nodejs/node/pull/63082
  * (SEMVER-MINOR) add `req.signal` to `IncomingMessage` (Akshat) https://github.com/nodejs/node/pull/62541
stream:
  * (SEMVER-MINOR) propagate destruction in `duplexPair` (Ahmed Elhor) https://github.com/nodejs/node/pull/61098
test_runner:
  * (SEMVER-MINOR) support test order randomization (Pietro Marchini) https://github.com/nodejs/node/pull/61747
  * (SEMVER-MINOR) align mock timeout api (sangwook) https://github.com/nodejs/node/pull/62820
  * (SEMVER-MINOR) add mock-timers support for `AbortSignal.timeout` (DeveloperViraj) https://github.com/nodejs/node/pull/60751
util:
  * (SEMVER-MINOR) colorize text with hex colors (Guilherme Araújo) https://github.com/nodejs/node/pull/61556

PR-URL: https://github.com/nodejs/node/pull/63263

* Working on v24.16.1

PR-URL: https://github.com/nodejs/node/pull/63263

* deps: update undici to 7.28.0

PR-URL: https://github.com/nodejs/node/pull/63703
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

* deps: fix aix implicit declaration in OpenSSL

This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: https://github.com/nodejs/node/pull/62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

* deps: upgrade openssl sources to openssl-3.5.7

PR-URL: https://github.com/nodejs/node/pull/63820
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

* deps: update archs files for openssl-3.5.7

PR-URL: https://github.com/nodejs/node/pull/63820
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

* deps: update nghttp2 to 1.69.0

PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

* deps: fix integration issues with the latest nghttp2

This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63164
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Refs: https://hackerone.com/reports/3658225
CVE-ID: CVE-2026-48937

* deps: update llhttp to 9.4.2

PR-URL: https://github.com/nodejs-private/node-private/pull/890
Reviewed-By: Tobias Nießen <[email protected]>

* lib,test: redact proxy credentials in tunnel errors

Refs: https://hackerone.com/reports/3720313
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/867
Reviewed-By: Joyee Cheung <[email protected]>
CVE-ID: CVE-2026-48615

* permission: handle process.chdir on writereport

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/870
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987

* tls: normalize hostname for server identity checks

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/869
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48618
Refs: https://hackerone.com/reports/3688064

* http2: cap originSet size to prevent unbounded memory growth

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48619

* tls: fix case-sensitive SNI context matching

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: https://github.com/nodejs-private/node-private/pull/857
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869

* dns,net: reject hostnames with embedded NUL bytes

Ref: https://hackerone.com/reports/3656716
PR-URL: https://github.com/nodejs-private/node-private/pull/868
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48930
Refs: https://hackerone.com/reports/3656716

* permission: disable FileHandle utimes with permission model

PR-URL: https://github.com/nodejs-private/node-private/pull/873
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48935
Refs: https://hackerone.com/reports/3625987

* http: fix response queue poisoning in http.Agent

Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.

Refs: https://hackerone.com/reports/3582376
PR-URL: https://github.com/nodejs-private/node-private/pull/846
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48931
Refs: https://hackerone.com/reports/3582376

* crypto: guard WebCrypto cipher output length

Reject WebCrypto cipher operations whose computed output length would
exceed INT_MAX before passing the length to OpenSSL.

This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot
cipher paths and turns oversized inputs into a clean operation failure.

Refs: https://hackerone.com/reports/3760016
Signed-off-by: Filip Skokan <[email protected]>
PR-URL: https://github.com/nodejs-private/node-private/pull/878
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48933

* tls: bind reusable sessions to authenticated host

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48934
Refs: https://hackerone.com/reports/3649802

* test: add session reuse host verification regressions

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <[email protected]>
Refs: https://hackerone.com/reports/3649802

* 2026-06-18, Version 24.17.0 'Krypton' (LTS)

This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

PR-URL: https://github.com/nodejs-private/node-private/pull/899

* Working on v24.17.1

PR-URL: https://github.com/nodejs-private/node-private/pull/899

* doc: remove list of versions in `BUILDING.md`

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63113
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Paolo Insogna <[email protected]>

* doc: document the latest-vX.x schema

Signed-off-by: Marco Ippolito <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63033
Reviewed-By: Pietro Marchini <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* doc: add Hmac.digest() documentation-only deprecation (DEP0206)

Signed-off-by: anshikakalpana <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/63121
Refs: https://github.com/nodejs/node/issues/62838
Reviewed-By: René <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: James M Snell <[email protected]>

* sqlite: keep source database alive during backup

Signed-off-by: Matteo C
[Page truncated to keep GeezerVison snappy.]