Files
thelounge/.node-version
renovate[bot] 9ac9ae2d0c Update Node.js to v24 (#5111)
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Type | Update | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [node](https://nodejs.org)
([source](https://redirect.github.com/nodejs/node)) | | major | `22` →
`24` |
![age](https://developer.mend.io/api/mc/badges/age/node-version/node/v24.18.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/node-version/node/v22.23.1/v24.18.0?slim=true)
|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| devDependencies | major | [`22.19.17` →
`24.13.3`](https://renovatebot.com/diffs/npm/@types%2fnode/22.19.17/24.13.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/24.13.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.19.17/24.13.3?slim=true)
|

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

###
[`v24.18.0`](https://redirect.github.com/nodejs/node/releases/tag/v24.18.0):
2026-06-23, Version 24.18.0 'Krypton' (LTS), @&#8203;richardlau prepared
by @&#8203;sxa

[Compare
Source](https://redirect.github.com/nodejs/node/compare/v24.17.0...v24.18.0)

##### Notable Changes

-
\[[`e07e7a31e1`](https://redirect.github.com/nodejs/node/commit/e07e7a31e1)]
- **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub
Bot) [#&#8203;63527](https://redirect.github.com/nodejs/node/pull/63527)
-
\[[`44c8ebcbd6`](https://redirect.github.com/nodejs/node/commit/44c8ebcbd6)]
- **http**: avoid stream listeners on idle agent sockets (Matteo
Collina)
[#&#8203;64004](https://redirect.github.com/nodejs/node/pull/64004)
-
\[[`d3ef4122ee`](https://redirect.github.com/nodejs/node/commit/d3ef4122ee)]
- **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64
KiB (Matteo Collina)
[#&#8203;63597](https://redirect.github.com/nodejs/node/pull/63597)
-
\[[`bb2857b85a`](https://redirect.github.com/nodejs/node/commit/bb2857b85a)]
- **(SEMVER-MINOR)** **crypto**: align key argument names in docs and
error messages (Filip Skokan)
[#&#8203;62527](https://redirect.github.com/nodejs/node/pull/62527)
-
\[[`b9d5e87880`](https://redirect.github.com/nodejs/node/commit/b9d5e87880)]
- **(SEMVER-MINOR)** **crypto**: accept key data in
crypto.diffieHellman() and cleanup DH jobs (Filip Skokan)
[#&#8203;62527](https://redirect.github.com/nodejs/node/pull/62527)
-
\[[`ccd756d61e`](https://redirect.github.com/nodejs/node/commit/ccd756d61e)]
- **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web
Cryptography algorithms (Filip Skokan)
[#&#8203;62183](https://redirect.github.com/nodejs/node/pull/62183)
-
\[[`4c9251fc09`](https://redirect.github.com/nodejs/node/commit/4c9251fc09)]
- **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary
1xx status codes (Tim Perry)
[#&#8203;63155](https://redirect.github.com/nodejs/node/pull/63155)
-
\[[`8c989ec4a3`](https://redirect.github.com/nodejs/node/commit/8c989ec4a3)]
- **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS
runtime (sangwook)
[#&#8203;63079](https://redirect.github.com/nodejs/node/pull/63079)
-
\[[`3f54c8ba32`](https://redirect.github.com/nodejs/node/commit/3f54c8ba32)]
- ***Revert*** "**stream**: noop pause/resume on destroyed streams"
(Stewart X Addison)
[#&#8203;63834](https://redirect.github.com/nodejs/node/pull/63834)

##### Commits

-
\[[`d3ef4122ee`](https://redirect.github.com/nodejs/node/commit/d3ef4122ee)]
- **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64
KiB (Matteo Collina)
[#&#8203;63597](https://redirect.github.com/nodejs/node/pull/63597)
-
\[[`9ff36e40f0`](https://redirect.github.com/nodejs/node/commit/9ff36e40f0)]
- **build**: add --enable-all-experimentals build flag (Paolo Insogna)
[#&#8203;62755](https://redirect.github.com/nodejs/node/pull/62755)
-
\[[`7c22ee23aa`](https://redirect.github.com/nodejs/node/commit/7c22ee23aa)]
- **build**: def `NODE_USE_NODE_CODE_CACHE` only used in
node\_mksnapshot (Chengzhong Wu)
[#&#8203;63588](https://redirect.github.com/nodejs/node/pull/63588)
-
\[[`2551abdb4a`](https://redirect.github.com/nodejs/node/commit/2551abdb4a)]
- **build,win**: enable x64 PGO (Stefan Stojanovic)
[#&#8203;62761](https://redirect.github.com/nodejs/node/pull/62761)
-
\[[`e8a55ce9b1`](https://redirect.github.com/nodejs/node/commit/e8a55ce9b1)]
- **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen)
[#&#8203;62763](https://redirect.github.com/nodejs/node/pull/62763)
-
\[[`ae61cd68f3`](https://redirect.github.com/nodejs/node/commit/ae61cd68f3)]
- **crypto**: harden WebCrypto against prototype pollution (Filip
Skokan)
[#&#8203;63363](https://redirect.github.com/nodejs/node/pull/63363)
-
\[[`3d05a1d396`](https://redirect.github.com/nodejs/node/commit/3d05a1d396)]
- **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan)
[#&#8203;63363](https://redirect.github.com/nodejs/node/pull/63363)
-
\[[`f9d10a3f6b`](https://redirect.github.com/nodejs/node/commit/f9d10a3f6b)]
- **crypto**: remove async from WebCrypto methods (Filip Skokan)
[#&#8203;63363](https://redirect.github.com/nodejs/node/pull/63363)
-
\[[`e431d93e9e`](https://redirect.github.com/nodejs/node/commit/e431d93e9e)]
- **crypto**: add WebCrypto CryptoJob mode (Filip Skokan)
[#&#8203;63363](https://redirect.github.com/nodejs/node/pull/63363)
-
\[[`56e2505e48`](https://redirect.github.com/nodejs/node/commit/56e2505e48)]
- **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip
Skokan)
[#&#8203;63255](https://redirect.github.com/nodejs/node/pull/63255)
-
\[[`3bac77f2a8`](https://redirect.github.com/nodejs/node/commit/3bac77f2a8)]
- **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using
BoringSSL (Filip Skokan)
[#&#8203;63255](https://redirect.github.com/nodejs/node/pull/63255)
-
\[[`1bff901b09`](https://redirect.github.com/nodejs/node/commit/1bff901b09)]
- **crypto**: wire AES-KW in Web Cryptography when using BoringSSL
(Filip Skokan)
[#&#8203;63255](https://redirect.github.com/nodejs/node/pull/63255)
-
\[[`4433fca3df`](https://redirect.github.com/nodejs/node/commit/4433fca3df)]
- **crypto**: harden CryptoKey algorithm slots (Filip Skokan)
[#&#8203;63111](https://redirect.github.com/nodejs/node/pull/63111)
-
\[[`b5cf01217a`](https://redirect.github.com/nodejs/node/commit/b5cf01217a)]
- **crypto**: harden KeyObject internal slots (Filip Skokan)
[#&#8203;63111](https://redirect.github.com/nodejs/node/pull/63111)
-
\[[`ce84aef37d`](https://redirect.github.com/nodejs/node/commit/ce84aef37d)]
- **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan)
[#&#8203;62883](https://redirect.github.com/nodejs/node/pull/62883)
-
\[[`26781689b0`](https://redirect.github.com/nodejs/node/commit/26781689b0)]
- **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan)
[#&#8203;62905](https://redirect.github.com/nodejs/node/pull/62905)
-
\[[`aeea8f4970`](https://redirect.github.com/nodejs/node/commit/aeea8f4970)]
- **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip
Skokan)
[#&#8203;62706](https://redirect.github.com/nodejs/node/pull/62706)
-
\[[`407cf91656`](https://redirect.github.com/nodejs/node/commit/407cf91656)]
- **crypto**: guard against size\_t overflow on experimental 32-bit arch
(Filip Skokan)
[#&#8203;62626](https://redirect.github.com/nodejs/node/pull/62626)
-
\[[`bb2857b85a`](https://redirect.github.com/nodejs/node/commit/bb2857b85a)]
- **(SEMVER-MINOR)** **crypto**: align key argument names in docs and
error messages (Filip Skokan)
[#&#8203;62527](https://redirect.github.com/nodejs/node/pull/62527)
-
\[[`b9d5e87880`](https://redirect.github.com/nodejs/node/commit/b9d5e87880)]
- **(SEMVER-MINOR)** **crypto**: accept key data in
crypto.diffieHellman() and cleanup DH jobs (Filip Skokan)
[#&#8203;62527](https://redirect.github.com/nodejs/node/pull/62527)
-
\[[`b46d52b283`](https://redirect.github.com/nodejs/node/commit/b46d52b283)]
- **crypto**: unify asymmetric key import through KeyObjectHandle::Init
(Filip Skokan)
[#&#8203;62499](https://redirect.github.com/nodejs/node/pull/62499)
-
\[[`ccd756d61e`](https://redirect.github.com/nodejs/node/commit/ccd756d61e)]
- **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web
Cryptography algorithms (Filip Skokan)
[#&#8203;62183](https://redirect.github.com/nodejs/node/pull/62183)
-
\[[`e07e7a31e1`](https://redirect.github.com/nodejs/node/commit/e07e7a31e1)]
- **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub
Bot) [#&#8203;63527](https://redirect.github.com/nodejs/node/pull/63527)
-
\[[`61826df455`](https://redirect.github.com/nodejs/node/commit/61826df455)]
- **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan
Harband)
[#&#8203;63531](https://redirect.github.com/nodejs/node/pull/63531)
-
\[[`16d2fd3c07`](https://redirect.github.com/nodejs/node/commit/16d2fd3c07)]
- **crypto**: align verifyOneShot accepted types (Anshika Jain)
[#&#8203;63280](https://redirect.github.com/nodejs/node/pull/63280)
-
\[[`3b8330deda`](https://redirect.github.com/nodejs/node/commit/3b8330deda)]
- **crypto**: improve system certificate enumeration logic on macOS
(Robo)
[#&#8203;62576](https://redirect.github.com/nodejs/node/pull/62576)
-
\[[`141de35399`](https://redirect.github.com/nodejs/node/commit/141de35399)]
- **debugger**: add --help to `node inspect` and improve docs (Joyee
Cheung)
[#&#8203;63201](https://redirect.github.com/nodejs/node/pull/63201)
-
\[[`b76bfcd4fa`](https://redirect.github.com/nodejs/node/commit/b76bfcd4fa)]
- **deps**: upgrade npm to 11.16.0 (npm team)
[#&#8203;63602](https://redirect.github.com/nodejs/node/pull/63602)
-
\[[`4ec142314c`](https://redirect.github.com/nodejs/node/commit/4ec142314c)]
- **deps**: SQLite: cherry-pick
[`b869ed6`](b869ed6b06)
(Junsu Han)
[#&#8203;63525](https://redirect.github.com/nodejs/node/pull/63525)
-
\[[`19e8ce1c36`](https://redirect.github.com/nodejs/node/commit/19e8ce1c36)]
- **deps**: upgrade npm to 11.15.0 (npm team)
[#&#8203;63463](https://redirect.github.com/nodejs/node/pull/63463)
-
\[[`8a264260e2`](https://redirect.github.com/nodejs/node/commit/8a264260e2)]
- **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot)
[#&#8203;63217](https://redirect.github.com/nodejs/node/pull/63217)
-
\[[`50c8ff3f94`](https://redirect.github.com/nodejs/node/commit/50c8ff3f94)]
- **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot)
[#&#8203;62811](https://redirect.github.com/nodejs/node/pull/62811)
-
\[[`6e56f01c4b`](https://redirect.github.com/nodejs/node/commit/6e56f01c4b)]
- **deps**: V8: cherry-pick
[`435a2cd`](https://redirect.github.com/nodejs/node/commit/435a2cdf664c)
(Matthias Liedtke)
[#&#8203;63136](https://redirect.github.com/nodejs/node/pull/63136)
-
\[[`3ba813b242`](https://redirect.github.com/nodejs/node/commit/3ba813b242)]
- **deps**: cherry-pick
[libuv/libuv@`a43e543`](https://redirect.github.com/libuv/libuv/commit/a43e543)
(Ali Hassan)
[#&#8203;63222](https://redirect.github.com/nodejs/node/pull/63222)
-
\[[`2390e3a5ac`](https://redirect.github.com/nodejs/node/commit/2390e3a5ac)]
- **doc**: remove duplicated sentences in large-pull-requests.md (Joyee
Cheung)
[#&#8203;63650](https://redirect.github.com/nodejs/node/pull/63650)
-
\[[`52a1c18374`](https://redirect.github.com/nodejs/node/commit/52a1c18374)]
- **doc**: update `git node land` instructions for security releases
(Antoine du Hamel)
[#&#8203;63586](https://redirect.github.com/nodejs/node/pull/63586)
-
\[[`3e6b4da037`](https://redirect.github.com/nodejs/node/commit/3e6b4da037)]
- **doc**: drop --experimental from --permission (Rafael Gonzaga)
[#&#8203;63583](https://redirect.github.com/nodejs/node/pull/63583)
-
\[[`84d05163b9`](https://redirect.github.com/nodejs/node/commit/84d05163b9)]
- **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga)
[#&#8203;63479](https://redirect.github.com/nodejs/node/pull/63479)
-
\[[`7da2a4450e`](https://redirect.github.com/nodejs/node/commit/7da2a4450e)]
- **doc**: fix URL postMessage example in worker\_threads (Kit Dallege)
[#&#8203;62203](https://redirect.github.com/nodejs/node/pull/62203)
-
\[[`3d79bd8b29`](https://redirect.github.com/nodejs/node/commit/3d79bd8b29)]
- **doc**: clarify `filter` option of `sqlite.database.applyChangeset`
(Antoine du Hamel)
[#&#8203;63515](https://redirect.github.com/nodejs/node/pull/63515)
-
\[[`4f4174aace`](https://redirect.github.com/nodejs/node/commit/4f4174aace)]
- **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD
(Daijiro Wachi)
[#&#8203;63511](https://redirect.github.com/nodejs/node/pull/63511)
-
\[[`388323ca4b`](https://redirect.github.com/nodejs/node/commit/388323ca4b)]
- **doc**: fix double space in modules.md (Daijiro Wachi)
[#&#8203;63512](https://redirect.github.com/nodejs/node/pull/63512)
-
\[[`5258ccc058`](https://redirect.github.com/nodejs/node/commit/5258ccc058)]
- **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi)
[#&#8203;63453](https://redirect.github.com/nodejs/node/pull/63453)
-
\[[`43e83e6507`](https://redirect.github.com/nodejs/node/commit/43e83e6507)]
- **doc**: fix typo in deprecations (Daijiro Wachi)
[#&#8203;63434](https://redirect.github.com/nodejs/node/pull/63434)
-
\[[`f05a61d54c`](https://redirect.github.com/nodejs/node/commit/f05a61d54c)]
- **doc**: remove unsupported template type from v8.md (René)
[#&#8203;63410](https://redirect.github.com/nodejs/node/pull/63410)
-
\[[`c39d5fc820`](https://redirect.github.com/nodejs/node/commit/c39d5fc820)]
- **doc**: fix article usage before vowel-sound acronyms
(joao-oliveira-softtor)
[#&#8203;62696](https://redirect.github.com/nodejs/node/pull/62696)
-
\[[`398261f911`](https://redirect.github.com/nodejs/node/commit/398261f911)]
- **doc**: remove the bi-monthly contributor spotlight section (Claudio
Wunder)
[#&#8203;62734](https://redirect.github.com/nodejs/node/pull/62734)
-
\[[`fd9e14c405`](https://redirect.github.com/nodejs/node/commit/fd9e14c405)]
- **doc**: update http2's `push` and `trailers` events with `rawHeaders`
param (YuSheng Chen)
[#&#8203;63259](https://redirect.github.com/nodejs/node/pull/63259)
-
\[[`b943ce6933`](https://redirect.github.com/nodejs/node/commit/b943ce6933)]
- **doc**: remove inactive members from Triagers list (Antoine du Hamel)
[#&#8203;63329](https://redirect.github.com/nodejs/node/pull/63329)
-
\[[`4b9cdfc022`](https://redirect.github.com/nodejs/node/commit/4b9cdfc022)]
- **doc**: reference correct function in Module docs (Robin Malfait)
[#&#8203;63247](https://redirect.github.com/nodejs/node/pull/63247)
-
\[[`bed84b6df2`](https://redirect.github.com/nodejs/node/commit/bed84b6df2)]
- **doc**: replace Visual Studio 2022 Evergreen version reference with
17.14 (Mike McCready)
[#&#8203;63211](https://redirect.github.com/nodejs/node/pull/63211)
-
\[[`32ea70569b`](https://redirect.github.com/nodejs/node/commit/32ea70569b)]
- **doc**: recommend explicitly Tier 1 or 2 for production applications
(Mike McCready)
[#&#8203;63187](https://redirect.github.com/nodejs/node/pull/63187)
-
\[[`4627bcfd82`](https://redirect.github.com/nodejs/node/commit/4627bcfd82)]
- **doc**: run license-builder (github-actions\[bot])
[#&#8203;63232](https://redirect.github.com/nodejs/node/pull/63232)
-
\[[`28eba71845`](https://redirect.github.com/nodejs/node/commit/28eba71845)]
- **doc**: add large pull requests contributing guide (Matteo Collina)
[#&#8203;62829](https://redirect.github.com/nodejs/node/pull/62829)
-
\[[`2648efd438`](https://redirect.github.com/nodejs/node/commit/2648efd438)]
- **doc**: remove unnecessary `<!-- eslint-` magic comments (Antoine du
Hamel)
[#&#8203;63200](https://redirect.github.com/nodejs/node/pull/63200)
-
\[[`a95fc1f8fc`](https://redirect.github.com/nodejs/node/commit/a95fc1f8fc)]
- **doc**: clarify SEA platform support excludes darwin-x64 (MJSHANG)
[#&#8203;63181](https://redirect.github.com/nodejs/node/pull/63181)
-
\[[`aaef29e2e1`](https://redirect.github.com/nodejs/node/commit/aaef29e2e1)]
- **doc**: update release steps when post-release fails (Rafael Gonzaga)
[#&#8203;63131](https://redirect.github.com/nodejs/node/pull/63131)
-
\[[`7d81419cf2`](https://redirect.github.com/nodejs/node/commit/7d81419cf2)]
- **doc**: add Hmac.digest() documentation-only deprecation (DEP0206)
(Anshika Jain)
[#&#8203;63121](https://redirect.github.com/nodejs/node/pull/63121)
-
\[[`ececd80d81`](https://redirect.github.com/nodejs/node/commit/ececd80d81)]
- **doc**: document the latest-vX.x schema (Marco Ippolito)
[#&#8203;63033](https://redirect.github.com/nodejs/node/pull/63033)
-
\[[`27c1c1d842`](https://redirect.github.com/nodejs/node/commit/27c1c1d842)]
- **doc**: remove list of versions in `BUILDING.md` (Antoine du Hamel)
[#&#8203;63113](https://redirect.github.com/nodejs/node/pull/63113)
-
\[[`e369886a65`](https://redirect.github.com/nodejs/node/commit/e369886a65)]
- **doc,sqlite**: document entryPoint argument for loadExtension (Edy
Silva)
[#&#8203;63152](https://redirect.github.com/nodejs/node/pull/63152)
-
\[[`e4e5137cbd`](https://redirect.github.com/nodejs/node/commit/e4e5137cbd)]
- **errors**: handle V8 warnings in DisallowJavascriptExecutionScope
(Divyanshu Sharma)
[#&#8203;63491](https://redirect.github.com/nodejs/node/pull/63491)
-
\[[`6d1f6048d2`](https://redirect.github.com/nodejs/node/commit/6d1f6048d2)]
- **fs**: make `Date` properties on `Stats` enumerable (LiviaMedeiros)
[#&#8203;63328](https://redirect.github.com/nodejs/node/pull/63328)
-
\[[`44c8ebcbd6`](https://redirect.github.com/nodejs/node/commit/44c8ebcbd6)]
- **http**: avoid stream listeners on idle agent sockets (Matteo
Collina)
[#&#8203;64004](https://redirect.github.com/nodejs/node/pull/64004)
-
\[[`4c9251fc09`](https://redirect.github.com/nodejs/node/commit/4c9251fc09)]
- **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary
1xx status codes (Tim Perry)
[#&#8203;63155](https://redirect.github.com/nodejs/node/pull/63155)
-
\[[`39f61fb06c`](https://redirect.github.com/nodejs/node/commit/39f61fb06c)]
- **http2**: emit session close before stream close (Matteo Collina)
[#&#8203;63414](https://redirect.github.com/nodejs/node/pull/63414)
-
\[[`8a8f2127d1`](https://redirect.github.com/nodejs/node/commit/8a8f2127d1)]
- **http2**: validate non-link headers in writeEarlyHints (Matteo
Collina)
[#&#8203;62017](https://redirect.github.com/nodejs/node/pull/62017)
-
\[[`8c989ec4a3`](https://redirect.github.com/nodejs/node/commit/8c989ec4a3)]
- **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS
runtime (sangwook)
[#&#8203;63079](https://redirect.github.com/nodejs/node/pull/63079)
-
\[[`c05f38229b`](https://redirect.github.com/nodejs/node/commit/c05f38229b)]
- **lib**: cleanup stateless diffiehellman key handling (Filip Skokan)
[#&#8203;62645](https://redirect.github.com/nodejs/node/pull/62645)
-
\[[`1c16b45d35`](https://redirect.github.com/nodejs/node/commit/1c16b45d35)]
- **lib**: refactor internal webidl converters (Filip Skokan)
[#&#8203;62979](https://redirect.github.com/nodejs/node/pull/62979)
-
\[[`02f35d6dce`](https://redirect.github.com/nodejs/node/commit/02f35d6dce)]
- **lib**: define `kEnumerableProperty` atomically (Antoine du Hamel)
[#&#8203;63609](https://redirect.github.com/nodejs/node/pull/63609)
-
\[[`12c51547ba`](https://redirect.github.com/nodejs/node/commit/12c51547ba)]
- **lib**: fix typos in esm loader comments (RonGamzu)
[#&#8203;63465](https://redirect.github.com/nodejs/node/pull/63465)
-
\[[`9b03b84262`](https://redirect.github.com/nodejs/node/commit/9b03b84262)]
- **lib**: fix typo idenity => identity (Daijiro Wachi)
[#&#8203;63112](https://redirect.github.com/nodejs/node/pull/63112)
-
\[[`a84e6b0567`](https://redirect.github.com/nodejs/node/commit/a84e6b0567)]
- **lib**: fixes validator message (Daijiro Wachi)
[#&#8203;62823](https://redirect.github.com/nodejs/node/pull/62823)
-
\[[`11734166a8`](https://redirect.github.com/nodejs/node/commit/11734166a8)]
- **lib**: narrow ReadableStreamBYOBRequest.view return type to
Uint8Array (RoomWithOutRoof)
[#&#8203;63017](https://redirect.github.com/nodejs/node/pull/63017)
-
\[[`7cead61d21`](https://redirect.github.com/nodejs/node/commit/7cead61d21)]
- **meta**: flip mcollina emails in .mailmap (Matteo Collina)
[#&#8203;63621](https://redirect.github.com/nodejs/node/pull/63621)
-
\[[`a08cfcfd35`](https://redirect.github.com/nodejs/node/commit/a08cfcfd35)]
- **meta**: label "source maps" PRs (Chengzhong Wu)
[#&#8203;63591](https://redirect.github.com/nodejs/node/pull/63591)
-
\[[`d56e8d2512`](https://redirect.github.com/nodejs/node/commit/d56e8d2512)]
- **meta**: add `vfs` subsystem label (René)
[#&#8203;62331](https://redirect.github.com/nodejs/node/pull/62331)
-
\[[`6201cfe488`](https://redirect.github.com/nodejs/node/commit/6201cfe488)]
- **meta**: skip scheduled workflows on forks (Jamie Magee)
[#&#8203;63565](https://redirect.github.com/nodejs/node/pull/63565)
-
\[[`f095e2bd31`](https://redirect.github.com/nodejs/node/commit/f095e2bd31)]
- **meta**: add additional gitignore entries (James M Snell)
[#&#8203;63267](https://redirect.github.com/nodejs/node/pull/63267)
-
\[[`1ea52c444c`](https://redirect.github.com/nodejs/node/commit/1ea52c444c)]
- **meta**: move one or more collaborators to emeritus (Node.js GitHub
Bot) [#&#8203;63402](https://redirect.github.com/nodejs/node/pull/63402)
-
\[[`b1b2327611`](https://redirect.github.com/nodejs/node/commit/b1b2327611)]
- **meta**: move one or more collaborators to emeritus (Node.js GitHub
Bot) [#&#8203;63235](https://redirect.github.com/nodejs/node/pull/63235)
-
\[[`7d88e130a9`](https://redirect.github.com/nodejs/node/commit/7d88e130a9)]
- **meta**: ignore AI assistants files (Matteo Collina)
[#&#8203;62612](https://redirect.github.com/nodejs/node/pull/62612)
-
\[[`a53b51df38`](https://redirect.github.com/nodejs/node/commit/a53b51df38)]
- **module**: load ESM helpers eagerly in the snapshot (Joyee Cheung)
[#&#8203;63550](https://redirect.github.com/nodejs/node/pull/63550)
-
\[[`69df688fff`](https://redirect.github.com/nodejs/node/commit/69df688fff)]
- **module**: fix sync hook short-circuit in require() in imported CJS
(Joyee Cheung)
[#&#8203;62920](https://redirect.github.com/nodejs/node/pull/62920)
-
\[[`75d9a4ed47`](https://redirect.github.com/nodejs/node/commit/75d9a4ed47)]
- **node-api**: support SharedArrayBuffer in napi\_create\_typedarray
(Yilong Li)
[#&#8203;62710](https://redirect.github.com/nodejs/node/pull/62710)
-
\[[`c20aa4c47b`](https://redirect.github.com/nodejs/node/commit/c20aa4c47b)]
- **quic**: add reusePort option to QuicEndpoint (James M Snell)
[#&#8203;63267](https://redirect.github.com/nodejs/node/pull/63267)
-
\[[`26a30d8a7f`](https://redirect.github.com/nodejs/node/commit/26a30d8a7f)]
- **quic**: implement rate limiting for version nego and immediate close
(James M Snell)
[#&#8203;63267](https://redirect.github.com/nodejs/node/pull/63267)
-
\[[`0b534b5770`](https://redirect.github.com/nodejs/node/commit/0b534b5770)]
- **quic**: fixup linting issue after other changes (James M Snell)
[#&#8203;63267](https://redirect.github.com/nodejs/node/pull/63267)
-
\[[`4b367cbe09`](https://redirect.github.com/nodejs/node/commit/4b367cbe09)]
- **quic**: remove unused binding variable in session.cc (James M Snell)
[#&#8203;63177](https://redirect.github.com/nodejs/node/pull/63177)
-
\[[`2574bef5a6`](https://redirect.github.com/nodejs/node/commit/2574bef5a6)]
- **repl**: fix dedup comparing normalized line against raw history
(Daijiro Wachi)
[#&#8203;62886](https://redirect.github.com/nodejs/node/pull/62886)
-
\[[`30e71c7e49`](https://redirect.github.com/nodejs/node/commit/30e71c7e49)]
- **sqlite**: keep source database alive during backup (Matteo Collina)
[#&#8203;62673](https://redirect.github.com/nodejs/node/pull/62673)
-
\[[`677ca7e76c`](https://redirect.github.com/nodejs/node/commit/677ca7e76c)]
- **src**: simplify OpenSSL feature gates (Filip Skokan)
[#&#8203;63255](https://redirect.github.com/nodejs/node/pull/63255)
-
\[[`c863c75c39`](https://redirect.github.com/nodejs/node/commit/c863c75c39)]
- **src**: add BoringSSL EVP enumeration fallback (Filip Skokan)
[#&#8203;63206](https://redirect.github.com/nodejs/node/pull/63206)
-
\[[`f6b2466921`](https://redirect.github.com/nodejs/node/commit/f6b2466921)]
- **src**: decouple KeyObject and CryptoKey and move CryptoKey to src
(Filip Skokan)
[#&#8203;62924](https://redirect.github.com/nodejs/node/pull/62924)
-
\[[`92d4f07dd2`](https://redirect.github.com/nodejs/node/commit/92d4f07dd2)]
- **src**: remove license headers for new node\_profiling files
(Chengzhong Wu)
[#&#8203;63066](https://redirect.github.com/nodejs/node/pull/63066)
-
\[[`8ac5d771c8`](https://redirect.github.com/nodejs/node/commit/8ac5d771c8)]
- **src**: split profiling helpers from util (Ilyas Shabi)
[#&#8203;63008](https://redirect.github.com/nodejs/node/pull/63008)
-
\[[`85d1639495`](https://redirect.github.com/nodejs/node/commit/85d1639495)]
- **src**: remove TOCTOU race condition when encoding SAB-backed
`Buffer`s (Antoine du Hamel)
[#&#8203;63517](https://redirect.github.com/nodejs/node/pull/63517)
-
\[[`9473c5f05c`](https://redirect.github.com/nodejs/node/commit/9473c5f05c)]
- **src**: skip duplicate UTF-8 validation in TextDecoder fatal path
(Mert Can Altin)
[#&#8203;63231](https://redirect.github.com/nodejs/node/pull/63231)
-
\[[`f35c91ee68`](https://redirect.github.com/nodejs/node/commit/f35c91ee68)]
- **src**: improve token return value check (James M Snell)
[#&#8203;63483](https://redirect.github.com/nodejs/node/pull/63483)
-
\[[`26f677c1c5`](https://redirect.github.com/nodejs/node/commit/26f677c1c5)]
- **src**: expose `node::RegisterContext` to make a node managed context
(Chengzhong Wu)
[#&#8203;62322](https://redirect.github.com/nodejs/node/pull/62322)
-
\[[`275cf909b6`](https://redirect.github.com/nodejs/node/commit/275cf909b6)]
- **src,sqlite**: only pass `xFilter` when user provided a callback
(Antoine du Hamel)
[#&#8203;63516](https://redirect.github.com/nodejs/node/pull/63516)
-
\[[`287e02303f`](https://redirect.github.com/nodejs/node/commit/287e02303f)]
- **src,sqlite**: remove dead code (Edy Silva)
[#&#8203;63204](https://redirect.github.com/nodejs/node/pull/63204)
-
\[[`58fa2ee189`](https://redirect.github.com/nodejs/node/commit/58fa2ee189)]
- **stream**: switch to internal `sleep` binding (Antoine du Hamel)
[#&#8203;63611](https://redirect.github.com/nodejs/node/pull/63611)
-
\[[`f954ab3f1a`](https://redirect.github.com/nodejs/node/commit/f954ab3f1a)]
- **stream**: use data listener for compose forwarding (Trivikram Kamat)
[#&#8203;63593](https://redirect.github.com/nodejs/node/pull/63593)
-
\[[`dc57173003`](https://redirect.github.com/nodejs/node/commit/dc57173003)]
- **stream**: fix Writable.toWeb() hang on synchronous drain (sangwook)
[#&#8203;61197](https://redirect.github.com/nodejs/node/pull/61197)
-
\[[`3f54c8ba32`](https://redirect.github.com/nodejs/node/commit/3f54c8ba32)]
- ***Revert*** "**stream**: noop pause/resume on destroyed streams"
(Stewart X Addison)
[#&#8203;63834](https://redirect.github.com/nodejs/node/pull/63834)
-
\[[`cee279c5d6`](https://redirect.github.com/nodejs/node/commit/cee279c5d6)]
- **stream**: remove unnecessary check (Antoine du Hamel)
[#&#8203;63030](https://redirect.github.com/nodejs/node/pull/63030)
-
\[[`61b20f60a3`](https://redirect.github.com/nodejs/node/commit/61b20f60a3)]
- **test**: update tls/crypto behaviour expectations when using
BoringSSL (Filip Skokan)
[#&#8203;63161](https://redirect.github.com/nodejs/node/pull/63161)
-
\[[`a835363808`](https://redirect.github.com/nodejs/node/commit/a835363808)]
- **test**: update WPT for WebCryptoAPI to
[`97bbc72`](https://redirect.github.com/nodejs/node/commit/97bbc7247a)
(Node.js GitHub Bot)
[#&#8203;63417](https://redirect.github.com/nodejs/node/pull/63417)
-
\[[`a00297480b`](https://redirect.github.com/nodejs/node/commit/a00297480b)]
- **test**: update WPT resources, interfaces and WebCryptoAPI (Node.js
GitHub Bot)
[#&#8203;62389](https://redirect.github.com/nodejs/node/pull/62389)
-
\[[`5a95a2b055`](https://redirect.github.com/nodejs/node/commit/5a95a2b055)]
- **test**: shorten path in net pipe connect errors (Matteo Collina)
[#&#8203;63405](https://redirect.github.com/nodejs/node/pull/63405)
-
\[[`5e8ff22d8f`](https://redirect.github.com/nodejs/node/commit/5e8ff22d8f)]
- **test**: remove test-node-output-v8-warning (Joyee Cheung)
[#&#8203;63469](https://redirect.github.com/nodejs/node/pull/63469)
-
\[[`ee15380950`](https://redirect.github.com/nodejs/node/commit/ee15380950)]
- **test**: update test426-fixtures to
[`9b9e225`](https://redirect.github.com/nodejs/node/commit/9b9e225b5a63139e9a95cdd1bf874a8f0b9d131)
(Node.js GitHub Bot)
[#&#8203;63373](https://redirect.github.com/nodejs/node/pull/63373)
-
\[[`9e063d9bea`](https://redirect.github.com/nodejs/node/commit/9e063d9bea)]
- **test**: update WPT for url to
[`e4a4672`](https://redirect.github.com/nodejs/node/commit/e4a4672e9e)
(Node.js GitHub Bot)
[#&#8203;63372](https://redirect.github.com/nodejs/node/pull/63372)
-
\[[`503bee4b43`](https://redirect.github.com/nodejs/node/commit/503bee4b43)]
- **test**: deflake async-hooks statwatcher test (Trivikram Kamat)
[#&#8203;63396](https://redirect.github.com/nodejs/node/pull/63396)
-
\[[`cccc7c32d8`](https://redirect.github.com/nodejs/node/commit/cccc7c32d8)]
- **test**: avoid test\_runner watch restart in spec snapshot (Trivikram
Kamat)
[#&#8203;63392](https://redirect.github.com/nodejs/node/pull/63392)
-
\[[`c89489258c`](https://redirect.github.com/nodejs/node/commit/c89489258c)]
- **test**: reduce watch mode restart flakiness (Trivikram Kamat)
[#&#8203;63390](https://redirect.github.com/nodejs/node/pull/63390)
-
\[[`e4d5e2578e`](https://redirect.github.com/nodejs/node/commit/e4d5e2578e)]
- **test**: isolate rerun-failures state file under tmpdir (Chemi Atlow)
[#&#8203;63449](https://redirect.github.com/nodejs/node/pull/63449)
-
\[[`362644a9ba`](https://redirect.github.com/nodejs/node/commit/362644a9ba)]
- **test**: wait for ok before initial break after restart (Yuya Inoue)
[#&#8203;62807](https://redirect.github.com/nodejs/node/pull/62807)
-
\[[`c4058d0e05`](https://redirect.github.com/nodejs/node/commit/c4058d0e05)]
- **test**: disable Maglev in near-heap-limit worker test (Trivikram
Kamat)
[#&#8203;63398](https://redirect.github.com/nodejs/node/pull/63398)
-
\[[`214da630a7`](https://redirect.github.com/nodejs/node/commit/214da630a7)]
- **test**: deflake connection refused proxy tests (Trivikram Kamat)
[#&#8203;63395](https://redirect.github.com/nodejs/node/pull/63395)
-
\[[`1d61a29876`](https://redirect.github.com/nodejs/node/commit/1d61a29876)]
- **test**: avoid repeated writes in watch helper (Trivikram Kamat)
[#&#8203;63386](https://redirect.github.com/nodejs/node/pull/63386)
-
\[[`2004e25387`](https://redirect.github.com/nodejs/node/commit/2004e25387)]
- **test**: deflake watch mode worker test (Trivikram Kamat)
[#&#8203;63384](https://redirect.github.com/nodejs/node/pull/63384)
-
\[[`d691cccfc1`](https://redirect.github.com/nodejs/node/commit/d691cccfc1)]
- **test**: relax test-memory-usage arrayBuffers check (inoway46)
[#&#8203;63244](https://redirect.github.com/nodejs/node/pull/63244)
-
\[[`0ff6bf853c`](https://redirect.github.com/nodejs/node/commit/0ff6bf853c)]
- **test**: reduce flakiness of `different-registry-per-thread` (Antoine
du Hamel)
[#&#8203;63244](https://redirect.github.com/nodejs/node/pull/63244)
-
\[[`d9f4e8e503`](https://redirect.github.com/nodejs/node/commit/d9f4e8e503)]
- **test**: fix flaky test-watch-mode-inspect timeout (Matteo Collina)
[#&#8203;63361](https://redirect.github.com/nodejs/node/pull/63361)
-
\[[`6d7cd50328`](https://redirect.github.com/nodejs/node/commit/6d7cd50328)]
- **test**: relax min assertion in test-performance-eventloopdelay
(Marco)
[#&#8203;63100](https://redirect.github.com/nodejs/node/pull/63100)
-
\[[`9dafe1d2d8`](https://redirect.github.com/nodejs/node/commit/9dafe1d2d8)]
- **test**: avoid flaky restart sync in debugger exceptions test (Yuya
Inoue)
[#&#8203;62055](https://redirect.github.com/nodejs/node/pull/62055)
-
\[[`989b2de973`](https://redirect.github.com/nodejs/node/commit/989b2de973)]
- **test**: avoid initial-break wait in restart-message (inoway46)
[#&#8203;62060](https://redirect.github.com/nodejs/node/pull/62060)
-
\[[`a072a25ee7`](https://redirect.github.com/nodejs/node/commit/a072a25ee7)]
- **test**: move FFI tests to `NATIVE_SUITES` (Antoine du Hamel)
[#&#8203;63165](https://redirect.github.com/nodejs/node/pull/63165)
-
\[[`64efbfd878`](https://redirect.github.com/nodejs/node/commit/64efbfd878)]
- **test**: use ERM to destroy sqlite database handles after tests
(René)
[#&#8203;63076](https://redirect.github.com/nodejs/node/pull/63076)
-
\[[`7dee66cd94`](https://redirect.github.com/nodejs/node/commit/7dee66cd94)]
- **test\_runner**: dont buffer unordered events in process isolation
mode (Moshe Atlow)
[#&#8203;63432](https://redirect.github.com/nodejs/node/pull/63432)
-
\[[`d257eec1e3`](https://redirect.github.com/nodejs/node/commit/d257eec1e3)]
- **test\_runner**: fix --test-rerun-failures swallowing failures on
retry (Chemi Atlow)
[#&#8203;63431](https://redirect.github.com/nodejs/node/pull/63431)
-
\[[`288c320e2f`](https://redirect.github.com/nodejs/node/commit/288c320e2f)]
- **test\_runner**: show replayed-from-attempt hint in spec reporter
(Moshe Atlow)
[#&#8203;63429](https://redirect.github.com/nodejs/node/pull/63429)
-
\[[`904bdf5bb4`](https://redirect.github.com/nodejs/node/commit/904bdf5bb4)]
- **test\_runner**: preserve run duration when using test-rerun (Moshe
Atlow)
[#&#8203;63429](https://redirect.github.com/nodejs/node/pull/63429)
-
\[[`df183d7bfa`](https://redirect.github.com/nodejs/node/commit/df183d7bfa)]
- **test\_runner**: avoid hanging on incomplete v8 frames (Ali Hassan)
[#&#8203;62704](https://redirect.github.com/nodejs/node/pull/62704)
-
\[[`ec86c69726`](https://redirect.github.com/nodejs/node/commit/ec86c69726)]
- **test\_runner**: fix diagnostics channel context tracking (Moshe
Atlow)
[#&#8203;63283](https://redirect.github.com/nodejs/node/pull/63283)
-
\[[`94e5f63b83`](https://redirect.github.com/nodejs/node/commit/94e5f63b83)]
- **tls**: add unsupported renegotiation error (Filip Skokan)
[#&#8203;63161](https://redirect.github.com/nodejs/node/pull/63161)
-
\[[`06d308fb61`](https://redirect.github.com/nodejs/node/commit/06d308fb61)]
- **tools**: prevent lib code from reading KeyObject and CryptoKey
accessors (Filip Skokan)
[#&#8203;63111](https://redirect.github.com/nodejs/node/pull/63111)
-
\[[`2e4a0d0c91`](https://redirect.github.com/nodejs/node/commit/2e4a0d0c91)]
- **tools**: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint
(dependabot\[bot])
[#&#8203;63415](https://redirect.github.com/nodejs/node/pull/63415)
-
\[[`4c9666b366`](https://redirect.github.com/nodejs/node/commit/4c9666b366)]
- **tools**: skip commit-lint on backport pull requests (Marco)
[#&#8203;63378](https://redirect.github.com/nodejs/node/pull/63378)
-
\[[`67d0c490a8`](https://redirect.github.com/nodejs/node/commit/67d0c490a8)]
- **tools**: fix skip of `test-internet` on forks (Antoine du Hamel)
[#&#8203;63492](https://redirect.github.com/nodejs/node/pull/63492)
-
\[[`02f73c7cac`](https://redirect.github.com/nodejs/node/commit/02f73c7cac)]
- **tools**: bump the eslint group in /tools/eslint with 4 updates
(dependabot\[bot])
[#&#8203;63075](https://redirect.github.com/nodejs/node/pull/63075)
-
\[[`5d016d3241`](https://redirect.github.com/nodejs/node/commit/5d016d3241)]
- **tools**: update gyp-next to 0.22.2 (Node.js GitHub Bot)
[#&#8203;63374](https://redirect.github.com/nodejs/node/pull/63374)
-
\[[`55af0f0edb`](https://redirect.github.com/nodejs/node/commit/55af0f0edb)]
- **tools**: fix test426 updater (Antoine du Hamel)
[#&#8203;63271](https://redirect.github.com/nodejs/node/pull/63271)
-
\[[`d8475e167a`](https://redirect.github.com/nodejs/node/commit/d8475e167a)]
- **tools**: use different branch for tool updates on staging branches
(Antoine du Hamel)
[#&#8203;63110](https://redirect.github.com/nodejs/node/pull/63110)
-
\[[`c605df9e50`](https://redirect.github.com/nodejs/node/commit/c605df9e50)]
- **util**: remove unused functions (Antoine du Hamel)
[#&#8203;63612](https://redirect.github.com/nodejs/node/pull/63612)
-
\[[`fe4540ebdb`](https://redirect.github.com/nodejs/node/commit/fe4540ebdb)]
- **util**: create hex style cache and fast path (Guilherme Araújo)
[#&#8203;62999](https://redirect.github.com/nodejs/node/pull/62999)

###
[`v24.17.0`](https://redirect.github.com/nodejs/node/releases/tag/v24.17.0):
2026-06-18, Version 24.17.0 'Krypton' (LTS), @&#8203;aduh95

[Compare
Source](https://redirect.github.com/nodejs/node/compare/v24.16.0...v24.17.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks
(Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip
Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors
(Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory
growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo
Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes
(Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host
(Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2
– Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport
(RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent
(Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission
model (RafaelGSS) – Low

##### Commits

-
\[[`9e4dfc7bba`](https://redirect.github.com/nodejs/node/commit/9e4dfc7bba)]
- **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length
(Filip Skokan)
[nodejs-private/node-private#878](https://redirect.github.com/nodejs-private/node-private/pull/878)
-
\[[`cb2aed980c`](https://redirect.github.com/nodejs/node/commit/cb2aed980c)]
- **deps**: update llhttp to 9.4.2 (Antoine du Hamel)
[nodejs-private/node-private#890](https://redirect.github.com/nodejs-private/node-private/pull/890)
-
\[[`a8a0d12875`](https://redirect.github.com/nodejs/node/commit/a8a0d12875)]
- **(CVE-2026-48937)** **deps**: fix integration issues with the latest
nghttp2 (Tim Perry)
[#&#8203;62891](https://redirect.github.com/nodejs/node/pull/62891)
-
\[[`66e6203c1c`](https://redirect.github.com/nodejs/node/commit/66e6203c1c)]
- **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub
Bot) [#&#8203;62891](https://redirect.github.com/nodejs/node/pull/62891)
-
\[[`dd627ced27`](https://redirect.github.com/nodejs/node/commit/dd627ced27)]
- **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot)
[#&#8203;63820](https://redirect.github.com/nodejs/node/pull/63820)
-
\[[`684bae568f`](https://redirect.github.com/nodejs/node/commit/684bae568f)]
- **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub
Bot) [#&#8203;63820](https://redirect.github.com/nodejs/node/pull/63820)
-
\[[`3a631e7f83`](https://redirect.github.com/nodejs/node/commit/3a631e7f83)]
- **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse)
[#&#8203;62656](https://redirect.github.com/nodejs/node/pull/62656)
-
\[[`cf44df3996`](https://redirect.github.com/nodejs/node/commit/cf44df3996)]
- **deps**: update undici to 7.28.0 (Node.js GitHub Bot)
[#&#8203;63703](https://redirect.github.com/nodejs/node/pull/63703)
-
\[[`138c70294b`](https://redirect.github.com/nodejs/node/commit/138c70294b)]
- **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL
bytes (Matteo Collina)
[nodejs-private/node-private#868](https://redirect.github.com/nodejs-private/node-private/pull/868)
-
\[[`be7e719c3f`](https://redirect.github.com/nodejs/node/commit/be7e719c3f)]
- **(CVE-2026-48931)** **http**: fix response queue poisoning in
http.Agent (Matteo Collina)
[nodejs-private/node-private#846](https://redirect.github.com/nodejs-private/node-private/pull/846)
-
\[[`cc7c11b4d1`](https://redirect.github.com/nodejs/node/commit/cc7c11b4d1)]
- **(CVE-2026-48619)** **http2**: cap originSet size to prevent
unbounded memory growth (Matteo Collina)
[nodejs-private/node-private#855](https://redirect.github.com/nodejs-private/node-private/pull/855)
-
\[[`9224427b92`](https://redirect.github.com/nodejs/node/commit/9224427b92)]
- **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel
errors (Matteo Collina)
[nodejs-private/node-private#867](https://redirect.github.com/nodejs-private/node-private/pull/867)
-
\[[`cf85d54839`](https://redirect.github.com/nodejs/node/commit/cf85d54839)]
- **(CVE-2026-48935)** **permission**: disable FileHandle utimes with
permission model (RafaelGSS)
[nodejs-private/node-private#873](https://redirect.github.com/nodejs-private/node-private/pull/873)
-
\[[`a1bbc24f96`](https://redirect.github.com/nodejs/node/commit/a1bbc24f96)]
- **(CVE-2026-48617)** **permission**: handle process.chdir on
writereport (RafaelGSS)
[nodejs-private/node-private#870](https://redirect.github.com/nodejs-private/node-private/pull/870)
-
\[[`e3723ff2d6`](https://redirect.github.com/nodejs/node/commit/e3723ff2d6)]
- **test**: add session reuse host verification regressions (Matteo
Collina)
[nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854)
-
\[[`a77af4867b`](https://redirect.github.com/nodejs/node/commit/a77af4867b)]
- **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated
host (Matteo Collina)
[nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854)
-
\[[`31beb4f707`](https://redirect.github.com/nodejs/node/commit/31beb4f707)]
- **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching
(Matteo Collina)
[nodejs-private/node-private#857](https://redirect.github.com/nodejs-private/node-private/pull/857)
-
\[[`8e75c73f91`](https://redirect.github.com/nodejs/node/commit/8e75c73f91)]
- **(CVE-2026-48618)** **tls**: normalize hostname for server identity
checks (Matteo Collina)
[nodejs-private/node-private#869](https://redirect.github.com/nodejs-private/node-private/pull/869)

###
[`v24.16.0`](https://redirect.github.com/nodejs/node/releases/tag/v24.16.0):
2026-05-21, Version 24.16.0 'Krypton' (LTS), @&#8203;aduh95

[Compare
Source](https://redirect.github.com/nodejs/node/compare/v24.15.0...v24.16.0)

##### Notable Changes

-
\[[`b267f6bca3`](https://redirect.github.com/nodejs/node/commit/b267f6bca3)]
- **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378)
[#&#8203;62553](https://redirect.github.com/nodejs/node/pull/62553)
-
\[[`ec2451b9cd`](https://redirect.github.com/nodejs/node/commit/ec2451b9cd)]
- **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression
probes to `node inspect` (Joyee Cheung)
[#&#8203;62713](https://redirect.github.com/nodejs/node/pull/62713)
-
\[[`9705f628d9`](https://redirect.github.com/nodejs/node/commit/9705f628d9)]
- **(SEMVER-MINOR)** **fs**: add signal option to `fs.stat()` (Mert Can
Altin)
[#&#8203;57775](https://redirect.github.com/nodejs/node/pull/57775)
-
\[[`40ccfdecf9`](https://redirect.github.com/nodejs/node/commit/40ccfdecf9)]
- **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho
Jang)
[#&#8203;62277](https://redirect.github.com/nodejs/node/pull/62277)
-
\[[`d7188af5c9`](https://redirect.github.com/nodejs/node/commit/d7188af5c9)]
- **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge
(Matteo Collina)
[#&#8203;63082](https://redirect.github.com/nodejs/node/pull/63082)
-
\[[`aa1d8a9afc`](https://redirect.github.com/nodejs/node/commit/aa1d8a9afc)]
- **(SEMVER-MINOR)** **http**: add `req.signal` to `IncomingMessage`
(Akshat)
[#&#8203;62541](https://redirect.github.com/nodejs/node/pull/62541)
-
\[[`6f37f7e240`](https://redirect.github.com/nodejs/node/commit/6f37f7e240)]
- **(SEMVER-MINOR)** **stream**: propagate destruction in `duplexPair`
(Ahmed Elhor)
[#&#8203;61098](https://redirect.github.com/nodejs/node/pull/61098)
-
\[[`d14029be7f`](https://redirect.github.com/nodejs/node/commit/d14029be7f)]
- **(SEMVER-MINOR)** **test\_runner**: support test order randomization
(Pietro Marchini)
[#&#8203;61747](https://redirect.github.com/nodejs/node/pull/61747)
-
\[[`d142c584cd`](https://redirect.github.com/nodejs/node/commit/d142c584cd)]
- **(SEMVER-MINOR)** **test\_runner**: align mock timeout api (sangwook)
[#&#8203;62820](https://redirect.github.com/nodejs/node/pull/62820)
-
\[[`01a9552585`](https://redirect.github.com/nodejs/node/commit/01a9552585)]
- **(SEMVER-MINOR)** **test\_runner**: add mock-timers support for
`AbortSignal.timeout` (DeveloperViraj)
[#&#8203;60751](https://redirect.github.com/nodejs/node/pull/60751)
-
\[[`00705a459a`](https://redirect.github.com/nodejs/node/commit/00705a459a)]
- **(SEMVER-MINOR)** **util**: colorize text with hex colors (Guilherme
Araújo)
[#&#8203;61556](https://redirect.github.com/nodejs/node/pull/61556)

##### Commits

-
\[[`dd72df060d`](https://redirect.github.com/nodejs/node/commit/dd72df060d)]
- **assert,util**: fix stale nested cycle memo entries (Ruben
Bridgewater)
[#&#8203;62509](https://redirect.github.com/nodejs/node/pull/62509)
-
\[[`add94f4bc3`](https://redirect.github.com/nodejs/node/commit/add94f4bc3)]
- **build**: track PDL files as inputs in inspector GN build (Robo)
[#&#8203;62888](https://redirect.github.com/nodejs/node/pull/62888)
-
\[[`1b1eb9e334`](https://redirect.github.com/nodejs/node/commit/1b1eb9e334)]
- **build**: remove redundant -fuse-linker-plugin from GCC LTO flags
(Daniel Lando)
[#&#8203;62667](https://redirect.github.com/nodejs/node/pull/62667)
-
\[[`8752b604ec`](https://redirect.github.com/nodejs/node/commit/8752b604ec)]
- **crypto**: deduplicate and canonicalize CryptoKey usages (Filip
Skokan)
[#&#8203;62902](https://redirect.github.com/nodejs/node/pull/62902)
-
\[[`341947e7fd`](https://redirect.github.com/nodejs/node/commit/341947e7fd)]
- **crypto**: reject unintended raw key format string input (Filip
Skokan)
[#&#8203;62974](https://redirect.github.com/nodejs/node/pull/62974)
-
\[[`28a78747fc`](https://redirect.github.com/nodejs/node/commit/28a78747fc)]
- **crypto**: remove Argon2 KDF derivation from its job setup (Filip
Skokan)
[#&#8203;62863](https://redirect.github.com/nodejs/node/pull/62863)
-
\[[`16e8c2b54d`](https://redirect.github.com/nodejs/node/commit/16e8c2b54d)]
- **crypto**: fix unsigned conversion of 4-byte RSA publicExponent
(DeepView Autofix)
[#&#8203;62839](https://redirect.github.com/nodejs/node/pull/62839)
-
\[[`eeae754a87`](https://redirect.github.com/nodejs/node/commit/eeae754a87)]
- **crypto**: reject inherited key type names (Jonathan Lopes)
[#&#8203;62875](https://redirect.github.com/nodejs/node/pull/62875)
-
\[[`9dd5540325`](https://redirect.github.com/nodejs/node/commit/9dd5540325)]
- **crypto**: add memory tracking for secureContext openssl objects
(Mert Can Altin)
[#&#8203;59051](https://redirect.github.com/nodejs/node/pull/59051)
-
\[[`b267f6bca3`](https://redirect.github.com/nodejs/node/commit/b267f6bca3)]
- **(SEMVER-MINOR)** **crypto**: implement randomUUIDv7() (nabeel378)
[#&#8203;62553](https://redirect.github.com/nodejs/node/pull/62553)
-
\[[`7597d204c1`](https://redirect.github.com/nodejs/node/commit/7597d204c1)]
- **crypto**: add support for
[`Ed25519`](https://redirect.github.com/nodejs/node/commit/Ed25519)
context parameter (Filip Skokan)
[#&#8203;62474](https://redirect.github.com/nodejs/node/pull/62474)
-
\[[`4bf85845da`](https://redirect.github.com/nodejs/node/commit/4bf85845da)]
- **debugger**: move ProbeInspectorSession and helpers to separate files
(Joyee Cheung)
[#&#8203;63013](https://redirect.github.com/nodejs/node/pull/63013)
-
\[[`ec2451b9cd`](https://redirect.github.com/nodejs/node/commit/ec2451b9cd)]
- **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression
probes to `node inspect` (Joyee Cheung)
[#&#8203;62713](https://redirect.github.com/nodejs/node/pull/62713)
-
\[[`83e98f77b7`](https://redirect.github.com/nodejs/node/commit/83e98f77b7)]
- **deps**: update corepack to 0.35.0 (Node.js GitHub Bot)
[#&#8203;63375](https://redirect.github.com/nodejs/node/pull/63375)
-
\[[`ec8c6b939a`](https://redirect.github.com/nodejs/node/commit/ec8c6b939a)]
- **deps**: V8: cherry-pick
[`657d8de`](https://redirect.github.com/nodejs/node/commit/657d8de27427)
(Guy Bedford)
[#&#8203;62784](https://redirect.github.com/nodejs/node/pull/62784)
-
\[[`722c0c3274`](https://redirect.github.com/nodejs/node/commit/722c0c3274)]
- **deps**: update nghttp3 to 1.14.0 (Node.js GitHub Bot)
[#&#8203;61187](https://redirect.github.com/nodejs/node/pull/61187)
-
\[[`5304db93d3`](https://redirect.github.com/nodejs/node/commit/5304db93d3)]
- **deps**: update nghttp3 to 1.13.1 (Node.js GitHub Bot)
[#&#8203;60046](https://redirect.github.com/nodejs/node/pull/60046)
-
\[[`e073b3811d`](https://redirect.github.com/nodejs/node/commit/e073b3811d)]
- **deps**: update nghttp3 to 1.11.0 (James M Snell)
[#&#8203;59249](https://redirect.github.com/nodejs/node/pull/59249)
-
\[[`1d00313fb2`](https://redirect.github.com/nodejs/node/commit/1d00313fb2)]
- **deps**: update ngtcp2 to 1.14.0 (James M Snell)
[#&#8203;59249](https://redirect.github.com/nodejs/node/pull/59249)
-
\[[`8b3a4fc18f`](https://redirect.github.com/nodejs/node/commit/8b3a4fc18f)]
- **deps**: update amaro to 1.1.9 (Node.js GitHub Bot)
[#&#8203;63090](https://redirect.github.com/nodejs/node/pull/63090)
-
\[[`62fe0cfcd1`](https://redirect.github.com/nodejs/node/commit/62fe0cfcd1)]
- **deps**: update llhttp to 9.4.1 (Node.js GitHub Bot)
[#&#8203;63045](https://redirect.github.com/nodejs/node/pull/63045)
-
\[[`137e09c8e9`](https://redirect.github.com/nodejs/node/commit/137e09c8e9)]
- **deps**: update corepack to 0.34.7 (Node.js GitHub Bot)
[#&#8203;62810](https://redirect.github.com/nodejs/node/pull/62810)
-
\[[`14a4cb8fbc`](https://redirect.github.com/nodejs/node/commit/14a4cb8fbc)]
- **deps**: update timezone to 2026b (Node.js GitHub Bot)
[#&#8203;62962](https://redirect.github.com/nodejs/node/pull/62962)
-
\[[`3e1036583a`](https://redirect.github.com/nodejs/node/commit/3e1036583a)]
- **deps**: upgrade npm to 11.13.0 (npm team)
[#&#8203;62898](https://redirect.github.com/nodejs/node/pull/62898)
-
\[[`01dfe5961c`](https://redirect.github.com/nodejs/node/commit/01dfe5961c)]
- **deps**: cherry-pick
[libuv/libuv@`439a54b`](https://redirect.github.com/libuv/libuv/commit/439a54b)
(skooch)
[#&#8203;62881](https://redirect.github.com/nodejs/node/pull/62881)
-
\[[`6cd368b10c`](https://redirect.github.com/nodejs/node/commit/6cd368b10c)]
- **deps**: update sqlite to 3.53.0 (Node.js GitHub Bot)
[#&#8203;62699](https://redirect.github.com/nodejs/node/pull/62699)
-
\[[`f218a4f553`](https://redirect.github.com/nodejs/node/commit/f218a4f553)]
- **deps**: update nbytes to 0.1.4 (Node.js GitHub Bot)
[#&#8203;62698](https://redirect.github.com/nodejs/node/pull/62698)
-
\[[`b47688524a`](https://redirect.github.com/nodejs/node/commit/b47688524a)]
- **deps**: update archs files for openssl-3.5.6 (Node.js GitHub Bot)
[#&#8203;62629](https://redirect.github.com/nodejs/node/pull/62629)
-
\[[`d202e2d343`](https://redirect.github.com/nodejs/node/commit/d202e2d343)]
- **deps**: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub
Bot) [#&#8203;62629](https://redirect.github.com/nodejs/node/pull/62629)
-
\[[`2faba66341`](https://redirect.github.com/nodejs/node/commit/2faba66341)]
- **deps**: update minimatch to 10.2.5 (Node.js GitHub Bot)
[#&#8203;62594](https://redirect.github.com/nodejs/node/pull/62594)
-
\[[`fa46c90c5d`](https://redirect.github.com/nodejs/node/commit/fa46c90c5d)]
- **deps**: update googletest to
[`d72f9c8`](d72f9c8aea)
(Node.js GitHub Bot)
[#&#8203;62593](https://redirect.github.com/nodejs/node/pull/62593)
-
\[[`099ded5713`](https://redirect.github.com/nodejs/node/commit/099ded5713)]
- **deps**: update simdjson to 4.6.1 (Node.js GitHub Bot)
[#&#8203;62592](https://redirect.github.com/nodejs/node/pull/62592)
-
\[[`7ce95afe96`](https://redirect.github.com/nodejs/node/commit/7ce95afe96)]
- **deps**: libuv: cherry-pick
[`aabb765`](https://redirect.github.com/nodejs/node/commit/aabb7651de)
(Santiago Gimeno)
[#&#8203;62561](https://redirect.github.com/nodejs/node/pull/62561)
-
\[[`57ef845623`](https://redirect.github.com/nodejs/node/commit/57ef845623)]
- **deps**: update icu to 78.3 (Node.js GitHub Bot)
[#&#8203;62324](https://redirect.github.com/nodejs/node/pull/62324)
-
\[[`493ac40e12`](https://redirect.github.com/nodejs/node/commit/493ac40e12)]
- **deps**: update libuv to 1.52.1 (Node.js GitHub Bot)
[#&#8203;61829](https://redirect.github.com/nodejs/node/pull/61829)
-
\[[`b39508b368`](https://redirect.github.com/nodejs/node/commit/b39508b368)]
- **deps**: update undici to 7.25.0 (Node.js GitHub Bot)
[#&#8203;63011](https://redirect.github.com/nodejs/node/pull/63011)
-
\[[`cb67a925e9`](https://redirect.github.com/nodejs/node/commit/cb67a925e9)]
- **deps**: use npm undici\@&#8203;seven tag in `update-undici.sh`
(Matteo Collina)
[#&#8203;62739](https://redirect.github.com/nodejs/node/pull/62739)
-
\[[`aa1e0bc28b`](https://redirect.github.com/nodejs/node/commit/aa1e0bc28b)]
- **doc**: fix typos and inconsistencies in crypto.md and webcrypto.md
(Filip Skokan)
[#&#8203;62828](https://redirect.github.com/nodejs/node/pull/62828)
-
\[[`f2a1735ed9`](https://redirect.github.com/nodejs/node/commit/f2a1735ed9)]
- **doc**: fix duplicate word "to to" in util.styleText (Daijiro Wachi)
[#&#8203;62917](https://redirect.github.com/nodejs/node/pull/62917)
-
\[[`b6378e215c`](https://redirect.github.com/nodejs/node/commit/b6378e215c)]
- **doc**: fix node-config-schema (Сковорода Никита Андреевич)
[#&#8203;61596](https://redirect.github.com/nodejs/node/pull/61596)
-
\[[`233894a9ce`](https://redirect.github.com/nodejs/node/commit/233894a9ce)]
- **doc**: fix the TypeScript Execute (tsx) project link (David
Thornton)
[#&#8203;63093](https://redirect.github.com/nodejs/node/pull/63093)
-
\[[`5d97919f8f`](https://redirect.github.com/nodejs/node/commit/5d97919f8f)]
- **doc**: correct diagnostics\_channel built-in channel names (Bryan
English)
[#&#8203;62995](https://redirect.github.com/nodejs/node/pull/62995)
-
\[[`2a9ccc927e`](https://redirect.github.com/nodejs/node/commit/2a9ccc927e)]
- **doc**: use mjs/cjs blocks for callbackify null reason example
(Daijiro Wachi)
[#&#8203;62884](https://redirect.github.com/nodejs/node/pull/62884)
-
\[[`ef413b5358`](https://redirect.github.com/nodejs/node/commit/ef413b5358)]
- **doc**: fix typo in test.md (Rich Trott)
[#&#8203;62960](https://redirect.github.com/nodejs/node/pull/62960)
-
\[[`76f21c5070`](https://redirect.github.com/nodejs/node/commit/76f21c5070)]
- **doc**: correct typo in PR contribution instructions (Mike McCready)
[#&#8203;62738](https://redirect.github.com/nodejs/node/pull/62738)
-
\[[`ca02af1f7d`](https://redirect.github.com/nodejs/node/commit/ca02af1f7d)]
- **doc**: fix duplicate word "of of" in postMessageToThread (Daijiro
Wachi)
[#&#8203;62917](https://redirect.github.com/nodejs/node/pull/62917)
-
\[[`46c99ed526`](https://redirect.github.com/nodejs/node/commit/46c99ed526)]
- **doc**: fix duplicate word "for for" in compile cache (Daijiro Wachi)
[#&#8203;62917](https://redirect.github.com/nodejs/node/pull/62917)
-
\[[`1a60851734`](https://redirect.github.com/nodejs/node/commit/1a60851734)]
- **doc**: fix typo in dns.lookup options description (Daijiro Wachi)
[#&#8203;62882](https://redirect.github.com/nodejs/node/pull/62882)
-
\[[`169b5ea2ed`](https://redirect.github.com/nodejs/node/commit/169b5ea2ed)]
- **doc**: fix Argon2 parameter bounds (Tobias Nießen)
[#&#8203;62868](https://redirect.github.com/nodejs/node/pull/62868)
-
\[[`9a3a190f4e`](https://redirect.github.com/nodejs/node/commit/9a3a190f4e)]
- **doc**: clarify diffieHellman.generateKeys recomputes same key (Kit
Dallege)
[#&#8203;62205](https://redirect.github.com/nodejs/node/pull/62205)
-
\[[`0fba9e87d6`](https://redirect.github.com/nodejs/node/commit/0fba9e87d6)]
- **doc**: remove Ayase-252 and meixg from triagger team (Antoine du
Hamel)
[#&#8203;62841](https://redirect.github.com/nodejs/node/pull/62841)
-
\[[`9c700f3446`](https://redirect.github.com/nodejs/node/commit/9c700f3446)]
- **doc**: clarify dns.lookup() callback signature when all is true
(eungi)
[#&#8203;62800](https://redirect.github.com/nodejs/node/pull/62800)
-
\[[`6b7280bc17`](https://redirect.github.com/nodejs/node/commit/6b7280bc17)]
- **doc**: add experimental modul

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/thelounge/thelounge).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbIlR5cGU6IERlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-07-13 11:40:38 -07:00

2 lines
3 B
Plaintext