Traceary

Catalog / Node.js

24.19.0

2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95

23 days agosecurityaddedchangedOriginal notes

Notable Changes

  • [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
  • [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
  • [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
  • [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
  • [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
  • [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
  • [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
  • [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
  • [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
  • [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
  • [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
  • [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
  • [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217

Commits

  • [676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
  • [a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
  • [dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
  • [081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
  • [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
  • [6e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
  • [87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
  • [32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #53899
  • [69cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
  • [37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
  • [2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #63980
  • [63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
  • [fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
  • [aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
  • [fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
  • [7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
  • [b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
  • [0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
  • [824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
  • [73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
  • [c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134
  • [934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
  • [e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092
  • [e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
  • [adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
  • [bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
  • [12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542
  • [858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
  • [9a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
  • [8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
  • [329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
  • [97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
  • [9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #63663
  • [59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
  • [2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
  • [6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
  • [688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
  • [1ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
  • [92a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
  • [8b37af8b11] - deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #62132
  • [8832126422] - deps: V8: cherry-pick 64b36b441179 (Dan Carney) #61712
  • [75990c2cd6] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
  • [8500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
  • [dc78091b45] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
  • [873cc72125] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
  • [1d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
  • [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
  • [e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #63857
  • [85c6d46606] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
  • [d2ea8b7a8c] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
  • [25b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
  • [a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
  • [b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
  • [0b3b56ee95] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
  • [aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
  • [ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
  • [6edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
  • [d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
  • [91c9ce5a45] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
  • [54e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #63199
  • [64c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
  • [bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
  • [a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
  • [c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
  • [d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
  • [bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #64184
  • [fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
  • [faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
  • [79d685adf3] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
  • [744e40e05e] - doc: update list of people in SECURITY.md (Richard Lau) #64152
  • [185f57c4a4] - doc: add missing option to man page (Richard Lau) #64156
  • [8933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
  • [3a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
  • [5a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
  • [66e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
  • [a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #63961
  • [d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #63939
  • [b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
  • [f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #63883
  • [df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #63881
  • [a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #63882
  • [206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
  • [e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #63672
  • [e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
  • [0b3fbc82d7] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
  • [62078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
  • [fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
  • [42cd7e47de] - doc: add worker_threads history entries (Bob Put) #63545
  • [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
  • [56bdd87378] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493
  • [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
  • [7bb6dab70c] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
  • [1a4edb3c22] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518
  • [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
  • [e0f211ca79] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
  • [a124429b36] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
  • [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
  • [a41b4824d7] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
  • [c63e00e3a5] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
  • [d3d7cd05e3] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
  • [6f6387ecb3] - gyp: update deps gypfiles (Nad Alaba) #63117
  • [592544af44] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
  • [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
  • [85a223bf15] - http: fix drain event with cork/uncork (David Evans) #64038
  • [8b060a9628] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
  • [e68a3d33ac] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
  • [d3682930b7] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
  • [af9ea9cfcf] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
  • [cd1ea26110] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
  • [5b264398ce] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
  • [823efe8c71] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
  • [7f4af5568f] - lib: add Iterator global to primordials (Renegade334) #63698
  • [c8f3f5e5a5] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
  • [1ebbbd59cf] - lib: optimize webidl conversion options (Filip Skokan) #62756
  • [88590d1bb7] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
  • [0ea9cb9630] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850
  • [f7275a0864] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
  • [3a77d21d8c] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #64248
  • [84e2836c95] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #64247
  • [09f800eec6] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246
  • [6df1f97e64] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244
  • [737eb89651] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243
  • [dac3cd8b8f] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242
  • [108a6bc481] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240
  • [34d09a725d] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
  • [944d9bc25f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
  • [cc22555402] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
  • [da7a21931e] - meta: speed up stale bot (Aviv Keller) #64075
  • [7bfcf7ca56] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
  • [db6c983cdd] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
  • [9e4f1339d1] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
  • [92c98d3ade] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
  • [bbd3ffde89] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
  • [a6dd675c82] - module: enable import support for addons by default (Chengzhong Wu) #64221
  • [fb2ccb15a1] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
  • [b9e17dc424] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
  • [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
  • [c55dd030e6] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
  • [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
  • [f08b83bc1d] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877
  • [8d58e1b415] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
  • [c757e3ef59] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
  • [87064a096b] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
  • [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
  • [d7946c9c07] - src: add test flag to config file (Marco Ippolito) #60798
  • [a642657d71] - src: rename config file testRunner to test (Marco Ippolito) #60798
  • [

These notes run past the length kept in the archive. The rest is on the publisher’s page.