GeezerVison

CONNECT tunnels are full-duplex. When the upstream socket receives a
FIN while the client-to-upstream pipe is still draining, the default
socket behavior can produce EPIPE or ECONNRESET errors.

Keep the upstream socket half-open so both directions can drain.
Separate request logs from transport errors to verify that teardown
completes without errors.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #64973
Refs: https://github.com/nodejs/reliability/issues?q=%22test-https-proxy-request-invalid-char-in-url%22
Reviewed-By: Luigi Pinca <[email protected]>

This does not solve the remaining underlying deadlock issue, but does
bound the test behaviour in a way that seems to avoid failures in
practice. Deadlock fix to come separately later.

Co-authored-by: Filip Skokan <[email protected]>
Signed-off-by: Tim Perry <[email protected]>
PR-URL: #65079
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #65192
Refs: #65169
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Beth Griggs <[email protected]>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #65130
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
PR-URL: #65129
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

`libnode.a` is now always produced, unless configured with flag
`--shared`. This deprecates the no-op flag `--enable-static`.

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #65103
Refs: #65026
Refs: #63626
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #59357
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ryuhei Shima <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>

PR-URL: #65154
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #65153
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #65151
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

PR-URL: #65150
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #65155
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

sqlite3_prepare_v2() returns SQLITE_OK without producing a statement
when its input holds no SQL, such as a comment. PrepareStatement() only
checked the return code, so it cached a StatementSync wrapping a null
sqlite3_stmt. Executing it reached sqlite3_clear_bindings(), which only
guards against a null statement under SQLITE_ENABLE_API_ARMOR, and
segfaulted.

Reject such input instead of caching it. The StatementSync methods
already avoid the crash because their IsFinalized() guard treats a null
statement as finalized.

Fixes: #65149

Signed-off-by: Trevor Burnham <[email protected]>
PR-URL: #65157
Fixes: #65149
Reviewed-By: René <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

Apply the same check to DatabaseSync::Prepare() so that statement-less
SQL is rejected at preparation instead of on first use. This matches
SQLite's own oo1 JavaScript API, which throws when the SQL contains no
statements rather than exposing the C API's null statement pointer.

Previously db.prepare('-- comment') returned a StatementSync whose
statement_ was null. Every method on it threw "statement has been
finalized", which was misleading because nothing had been finalized, and
the object was still inserted into statements_. Since IsFinalized() is
true for a null statement, its destructor skipped UntrackStatement() and
left a dangling pointer in the set that a later close() would finalize.

Refs: #65157 (comment)
Refs: https://sqlite.org/wasm/doc/trunk/api-oo1.md

Signed-off-by: Trevor Burnham <[email protected]>
PR-URL: #65157
Fixes: #65149
Reviewed-By: René <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

Signed-off-by: Rawal27 <[email protected]>
PR-URL: #64953
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Rich Trott <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #65162
Reviewed-By: Jithil P Ponnan <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Some general modernizations of templates

Signed-off-by: James M Snell <[email protected]>
PR-URL: #65148
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

Node.js ships two pre-generated sets of OpenSSL assembly: `asm`, which
contains the AVX-512 routines, and `asm_avx2`, which does not. The
set is picked in deps/openssl/openssl.gyp based on `gas_version` or
`nasm_version`, but configure.py only reports `gas_version` when the
compiler is not clang, because clang uses its own integrated
assembler and has no GNU assembler version to report. Consequently
every clang build silently falls back to the AVX-512-less `asm_avx2`
set, with no warning.

The result is that `ossl_vaes_vpclmulqdq_capable()` is assembled as a
stub that always returns 0, so OpenSSL never selects
`ossl_aes_gcm_encrypt_avx512()` and uses the older AES-NI path
instead. On an Intel Xeon Gold 6548N this costs roughly 1.6x on
AES-256-GCM and 1.8x on both ChaCha20-Poly1305 and RSA-2048 signing.
This is not limited to custom builds: BUILDING.md documents that the
official linux-x64 binaries are produced with clang, and the shipped
v25.x and v26.x binaries contain the stub.

Accept `llvm_version` in the condition, the way
deps/openssl/openssl.gypi already does for the AVX2 set. clang's
integrated assembler has handled AVX512IFMA since 3.9 and VAES /
VPCLMULQDQ since 6.0; 8.0 is used as a conservative floor, well below
the clang 19.1 that Node.js already requires.

PR-URL: #65136
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Signed-off-by: semimikoh <[email protected]>
PR-URL: #63319
Fixes: #63311
Reviewed-By: Trivikram Kamat <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #65166
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

Signed-off-by: Trivikram Kamat <[email protected]>
PR-URL: #65090
Refs: #64743
Reviewed-By: René <[email protected]>
Reviewed-By: Edy Silva <[email protected]>

Signed-off-by: Augustin Mauroy <[email protected]>
PR-URL: #65171
Reviewed-By: Mike McCready <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Under run({ testTagFilters, isolation: 'process' }) the parent
process's FileTest wrappers have empty tag sets, so any include filter
filtered out the wrappers themselves and no test file was ever
spawned. The same applied to the single re-spawned child in watch mode
with isolation 'none'.

Exempt file wrappers from tag filtering: the filter is re-emitted to
the child process and applied there, matching isolation 'none'
results.

This also removes the testTagFilterExpressions bookkeeping and the
isolation-conditional assignment of testTagFilters, both of which
existed only to keep the parent process from filtering its own file
wrappers. The parent now always holds the canonical filter values and
re-emits them to child processes.

Refs: #63221
Signed-off-by: atlowChemi <[email protected]>
PR-URL: #65170
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>

Signed-off-by: Antoine du Hamel <[email protected]>
PR-URL: #63135
Refs: nodejs/Release#1154
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

Signed-off-by: Max H Fisher <[email protected]>
PR-URL: #64684
Reviewed-By: Chengzhong Wu <[email protected]>

Signed-off-by: Guilherme Araújo <[email protected]>
PR-URL: #62419
Reviewed-By: Trivikram Kamat <[email protected]>

Optimized V8 fast API calls truncate out-of-range pointer BigInts.
Validate them against uintptrMax before invoking the raw function
so optimized calls match the generic and shared-buffer paths.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #65032
Fixes: #65031
Reviewed-By: Matteo Collina <[email protected]>

Add a CredentialsBinding declaration for internalBinding('credentials')
and wire it into InternalBindingMap.

Signed-off-by: HoonDongKang <[email protected]>
PR-URL: #65036
Reviewed-By: Daeyeon Jeong <[email protected]>

fs.md describes the bigint variant inside the fs.Stats section and has
no separate fs.BigIntStats section to link to.

Signed-off-by: greenhead <[email protected]>
PR-URL: #65045
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: James M Snell <[email protected]>

By shifting from individual bool fields to a packed struct
we can save 20 bytes per TLSWrap instance

Signed-off-by: James M Snell <[email protected]>
PR-URL: #65144
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: #65432
Reviewed-By: Chengzhong Wu <[email protected]>
Reviewed-By: Beth Griggs <[email protected]>
Reviewed-By: James M Snell <[email protected]>

tls.connect() with malformed ALPNProtocols hit
CHECK_EQ(0, SSL_set_alpn_protos(...)) in the C++ layer and aborted
the process with SIGABRT.

Validate in JS instead, in convertALPNProtocols, so both client and
server fail early with a recoverable ERR_INVALID_ARG_VALUE:

- zero-length string protocols now throw from convertProtocols
- wire-format buffers are checked for zero-length and truncated
  entries
- an empty buffer or array is still accepted and means skip ALPN,
  matching the historical behavior for []

The C++ CHECK_EQ is left unchanged: once JS has validated the input,
a non-zero SSL_set_alpn_protos return is an internal invariant
failure rather than user-facing input.

Fixes: #65069

Signed-off-by: Sankalp Thakur <[email protected]>
PR-URL: #65076
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

Signed-off-by: Hamid Reza Ghavami <[email protected]>
PR-URL: #64238
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Juan José Arboleda <[email protected]>

Signed-off-by: Taeuk Ha <[email protected]>
PR-URL: #65481
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Beth Griggs <[email protected]>

The encode-and-enqueue transform walked the chunk code unit by code
unit, materializing a single-character string per index and building
the output with string concatenation. The only state that crosses
chunks is a trailing high (leading) surrogate, and TextEncoder.encode's
USVString conversion already replaces every interior lone surrogate
with U+FFFD, which is exactly what the spec loop produces. Join a
pending high surrogate with the incoming chunk, hold back a new
trailing high surrogate, and encode the rest in a single native call.

The streaming decode path also reuses a single options object instead
of allocating { stream: true } per chunk.

An encoding-streams benchmark is added since the suite had no
TextEncoderStream/TextDecoderStream row. Encoding improves by ~546%
with 1KB string chunks and ~20% with 16-character chunks; decode is
unchanged.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #65414
Reviewed-By: Gürgün Dayıoğlu <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Mattias Buelens <[email protected]>

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: #65358
Reviewed-By: James M Snell <[email protected]>

This is the certdata.txt[0] from NSS 3.126.

This is the version of NSS that shipped in Firefox 154.0 on 2026-08-18.

Certificates added:
- SECOM TLS RSA Root CA 2024
- SECOM TLS ECC Root CA 2024
- Telia EC TLS Root CA v3
- Telia RSA TLS Root CA v3

Certificates removed:
- ePKI Root Certification Authority
- Atos TrustedRoot 2011

[0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_126_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #65495
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

We're seeing a number of repeated mistakes in AI-generated
contributions, including agents using `Signed-off-by`, creating
what appear to be unsupervised PRs, appearing to respond to
comments without human oversight, etc. Having an AGENTS.md
file with specific instructions to the agent on what to avoid
should help.

Signed-off-by: James M Snell <[email protected]>
PR-URL: #65493
Reviewed-By: Robert Nagy <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Mike McCready <[email protected]>
Reviewed-By: Beth Griggs <[email protected]>

Normalize each stateless transform result before passing it to
the next transform in a fused run. This ensures that subsequent
transforms always receive Uint8Array[] batches in both synchronous
and asynchronous pipelines.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #65367
Fixes: #65366
Reviewed-By: James M Snell <[email protected]>

readdir({ recursive: true }) asked the binding for names only and then
called internalModuleStat() on every entry to find the directories to
descend into; with withFileTypes it built the Dirents and still stat()ed
every entry that was not already a directory. Both variants also ran
path.join() and path.relative() per entry to build the relative result.

Ask the binding for file types in all cases, descend into directories
directly, and only stat() symbolic links and entries of unknown type
(which is what could point to a directory). The relative name is the
parent's prefix plus the entry name. Results, their order and the
symlink-following behavior are unchanged for fs.readdirSync, fs.readdir
and fs.promises.readdir.

The known_issues test for Buffer paths (#58892) called back without
checking the error; the error now reaches the callback instead of being
thrown from the completion handler, so the test asserts success to keep
expressing the issue.

Signed-off-by: Shelley Vohr <[email protected]>
PR-URL: #65487
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Originally added in 16b11cd, it first
had three callers. Now there's only one branch requireing it.

Signed-off-by: Szymon Łągiewka <[email protected]>
PR-URL: #64473
Reviewed-By: Chemi Atlow <[email protected]>

While more readable, the removed closure overhead unlocks 10-20% in
eventtarget.js benchmark.

Signed-off-by: Szymon Łągiewka <[email protected]>
PR-URL: #64473
Reviewed-By: Chemi Atlow <[email protected]>

Notable changes:

benchmark:
  * (SEMVER-MINOR) add --analyze mode to compare.js (James M Snell) #65416
crypto:
  * update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
  * (SEMVER-MINOR) enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
diagnostics_channel:
  * mark TracingChannel as stable (Abdelrahman Awad) #64525
lib,src:
  * (SEMVER-MINOR) improve histogram implementation (James M Snell) #65024
net:
  * (SEMVER-MINOR) improve performance of net.BlockList (James M Snell) #64974
perf_hooks:
  * (SEMVER-MINOR) add statistical hypothesis testing to histogram (James M Snell) #65416
repl:
  * add basic syntax highlighting (Aviv Keller) #64591
sqlite:
  * (SEMVER-MINOR) add StatementSync.prototype.close() (Guilherme Araújo) #64232
  * (SEMVER-MINOR) add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
util:
  * (SEMVER-MINOR) add non-throwing MIMEType.parse (James M Snell) #64965
zlib:
  * (SEMVER-MINOR) add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339

PR-URL: #65551