Skip to content

2026-03-03, Version 25.8.0 (Current)#62073

Open
github-actions[bot] wants to merge 51 commits intov25.xfrom
v25.8.0-proposal
Open

2026-03-03, Version 25.8.0 (Current)#62073
github-actions[bot] wants to merge 51 commits intov25.xfrom
v25.8.0-proposal

Conversation

@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Mar 2, 2026

2026-03-03, Version 25.8.0 (Current), @richardlau

Notable Changes

  • [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343
  • [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298
  • [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #61869
  • [9ddd1a9c27] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
  • [0d97ec4044] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test execution (Ali Hassan) #61394

Commits

  • [940b58c8c1] - buffer: optimize buffer.concat performance (Mert Can Altin) #61721
  • [0589b0e5a1] - build: fix GN for new merve dep (Shelley Vohr) #61984
  • [f3d3968dcd] - Revert "build: add temporal test on GHA windows" (Antoine du Hamel) #61810
  • [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343
  • [b7715292f8] - child_process: add tracing channel for spawn (Marco) #61836
  • [a32a598748] - crypto: fix missing nullptr check on RSA_new() (ndossche) #61888
  • [dc384f95b3] - crypto: fix handling of null BUF_MEM* in ToV8Value() (Nora Dossche) #61885
  • [3337b095db] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
  • [51ded81139] - deps: update undici to 7.22.0 (Node.js GitHub Bot) #62035
  • [8aa2fde931] - deps: update minimatch to 10.2.4 (Node.js GitHub Bot) #62016
  • [57dc092eaf] - deps: upgrade npm to 11.11.0 (npm team) #61994
  • [705bbd60a9] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930
  • [4d411d72e5] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
  • [f53a32ab84] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
  • [9b483fbb27] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #61830
  • [4e54c103cb] - doc: separate in-types and out-types in SQLite conversion docs (René) #62034
  • [ca78ebbeaa] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #62025
  • [e6b131f3fe] - doc: fix module.stripTypeScriptTypes indentation (René) #61992
  • [7508540e19] - doc: update DEP0040 (punycode) to application type deprecation (Mike McCready) #61916
  • [33a364cb62] - doc: explicitly mention Slack handle (Rafael Gonzaga) #61986
  • [46a61922bd] - doc: support toolchain Visual Studio 2022 & 2026 + Windows 11 SDK (Mike McCready) #61864
  • [dc12a257aa] - doc: rename invalid function parameter (René) #61942
  • [dafdc0a5b8] - http: validate headers in writeEarlyHints (Richard Clarke) #61897
  • [3c94b56fa6] - inspector: unwrap internal/debugger/inspect imports (René) #61974
  • [8a24c17648] - lib: improve argument handling in Blob constructor (Ms2ger) #61980
  • [21d4baf256] - meta: bump github/codeql-action from 4.32.0 to 4.32.4 (dependabot[bot]) #61911
  • [59a726a8e3] - meta: bump step-security/harden-runner from 2.14.1 to 2.14.2 (dependabot[bot]) #61909
  • [0072b7f991] - meta: bump actions/stale from 10.1.1 to 10.2.0 (dependabot[bot]) #61908
  • [999bf22f47] - repl: keep reference count for process.on('newListener') (Anna Henningsen) #61895
  • [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298
  • [aee2a18257] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948
  • [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #61869
  • [9ddd1a9c27] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
  • [ea2df2a16f] - stream: fix pipeTo to defer writes per WHATWG spec (Matteo Collina) #61800
  • [aa0c7b09e0] - test: remove unnecessary process.exit calls from test files (Antoine du Hamel) #62020
  • [ad96a6578f] - test: skip test-url on --shared-ada builds (Antoine du Hamel) #62019
  • [7c72a31e4b] - test: skip strace test with shared openssl (Richard Lau) #61987
  • [604456c163] - test: avoid flaky debugger restart waits (Yuya Inoue) #61773
  • [4890d6bd43] - test_runner: run afterEach on runtime skip (Igor Shevelenkov) #61525
  • [fce2930110] - test_runner: expose expectFailure message (sangwook) #61563
  • [0d97ec4044] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test execution (Ali Hassan) #61394
  • [243e6b2009] - test_runner: replace native methods with primordials (Ayoub Mabrouk) #61219
  • [bf1ed7e647] - tls: forward keepAlive, keepAliveInitialDelay, noDelay to socket (Sergey Zelenov) #62004
  • [0f15079d94] - tools: remove custom logic for skipping test-strace-openat-openssl (Antoine du Hamel) #62038
  • [54a055a59d] - tools: bump minimatch from 3.1.2 to 3.1.3 in /tools/clang-format (dependabot[bot]) #61977
  • [a28744cb62] - tools: fix permissions for merve update script (Richard Lau) #62023
  • [31e7936354] - tools: revert tools GHA workflow to ubuntu-latest (Richard Lau) #62024
  • [0a96a16e1f] - tools: bump minimatch from 3.1.2 to 3.1.3 in /tools/eslint (dependabot[bot]) #61976
  • [f279233412] - tools: roll back to x86 runner on scorecard.yml (Antoine du Hamel) #61944
  • [192c0382f4] - util: add fast path to stripVTControlCharacters (Hiroki Osame) #61833

aduh95 and others added 30 commits February 24, 2026 10:16
When investigating a memory leak in one of our applications,
we discovered that this listener holds on to a `REPLServer`
instance and all heap objects transitively kept alive by it
by capturing as part of its closure.

It's cleaner to declare the listener outside of the `REPLServer`
class and to actually clean it up properly when it is no longer
required or meaningful, which is easily achieved through
keeping a reference count.

PR-URL: #61895
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/stale](https://github.com/actions/stale) from 10.1.1 to 10.2.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@9971854...b5d41d4)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61908
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.1 to 2.14.2.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@e3f713f...5ef0c07)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61909
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.0 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b20883b...89a39a4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61911
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #61944
Refs: #61903
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: #61942
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
PR-URL: #61830
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #61833
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61864
Refs: #61449
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
This function can return null, which will make the calls to
BIO_meth_set_* trigger a null deref.
Even after fixing this, there is an issue with the
`BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the
`New` method cannot handle a null pointer despite other code already
guarding for this
(e.g. the `NodeBIO::New` function already checks `bio`).
This patch solves the issues by adding more null checks.

PR-URL: #61788
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Replace native methods with primordials.

PR-URL: #61219
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
This adds support for identifying which worker is running a test file
when tests execute concurrently, similar to JEST_WORKER_ID in Jest,
VITEST_POOL_ID in Vitest, and MOCHA_WORKER_ID in Mocha.

When running with --test-isolation=process (default), each test file
runs in a separate child process and receives a unique worker ID from
1 to N. When running with --test-isolation=none, all tests run in the
same process and the worker ID is always 1.

This enables users to allocate separate resources (databases, ports,
etc.) for each test worker to avoid conflicts during concurrent
execution.

Changes:
- Add WorkerIdPool class to manage worker ID allocation and reuse
- Set NODE_TEST_WORKER_ID environment variable for child processes
- Add context.workerId getter to TestContext class
- Add tests for worker ID functionality
- Add documentation for context.workerId

Fixes: #55842
PR-URL: #61394
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: #61836
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #61925
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61928
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61930
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
The assignment to `bptr` calls `BIO_get_mem_ptr` which can fail and
leave the `bptr` as nullptr. This then later causes a null pointer
deref.
This is inconsistent with uses of the similar function
`BIO_get_mem_data` that do check its return value, e.g.
`node::crypto::X509sToArrayOfStrings()`.
Solve it by checking for a null pointer and handling the `Nothing`
return value at the call sites.

PR-URL: #61885
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
PR-URL: #61986
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add a C++ API for diagnostics channels that allows native code to check
for subscribers and publish messages without unnecessary JS boundary
crossings. Uses a shared AliasedUint32Array buffer between C++ and JS
to track subscriber counts per channel, enabling a fast inline check
(HasSubscribers) that reads the buffer directly.

PR-URL: #61869
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Add --permission-audit flag that enables the permission model in
warning-only mode. Instead of throwing ERR_ACCESS_DENIED, it emits
a message via diagnostics channel and allows the operation to
continue.

Publish permission check results to per-scope diagnostics channels
(e.g., node:permission-model:fs) so users can observe permission
decisions at runtime via diagnostics_channel.

Refs: #59935
PR-URL: #61869
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
The WHATWG Streams spec requires that pipeTo's chunk handling must
queue a microtask before calling the write algorithm. This ensures
that enqueue() does not synchronously trigger writes.

Previously, PipeToReadableStreamReadRequest[kChunk] would synchronously
call writableStreamDefaultWriterWrite(), which violated the spec and
caused the WPT test "enqueue() must not synchronously call write
algorithm" to fail.

Fix by wrapping the write operation in queueMicrotask(), which defers
it to the next microtask as required by the spec.

Refs: whatwg/streams#1243
PR-URL: #61800
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
This change exposes the expectFailure message in the test runner and
adds edge cases for expectFailure ambiguity.

PR-URL: #61563
Fixes: #61570
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Jacob Smith <jacob@frende.me>
Not checking this can cause a null deref. Since there is already a
null check at the bottom of the function with `NewRSA()`.

PR-URL: #61888
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: Igor <igorshevelenkov4@gmail.com>
PR-URL: #61525
Fixes: #61462
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
PR-URL: #61974
Refs: #38161
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61976
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61773
Refs: #61762
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
As specified in WebIDL (<https://webidl.spec.whatwg.org/#js-dictionary>),
the fields of a dictionary need to be read in lexicographical order.

PR-URL: #61980
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
`parallel/test-strace-openat-openssl` was added to check explicitly
for a list of known files that would be opened for a set workload
(`require("crypto")`). This is not reliable when Node.js is linked
to an external/shared OpenSSL library (e.g. it might be configured
to load configuration files from a different default location and/or
load more than one configuration file) so skip this test when Node.js
is built in that way.

PR-URL: #61987
Fixes: #61966
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
richardlau and others added 18 commits February 28, 2026 12:07
The update script for undici requires Docker, which is not available
on `ubuntu-slim`.

PR-URL: #62024
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Switches over to using the new doc generation tooling.
For more background on this, please see #52343

Signed-off-by: flakey5 <73616808+flakey5@users.noreply.github.com>

Co-authored-by: Claudio W <cwunder@gnome.org>
Co-authored-by: avivkeller <me@aviv.sh>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #57343
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
`tls.connect()` silently ignores `keepAlive`, `keepAliveInitialDelay`,
and `noDelay` options. The documentation states it accepts any
`socket.connect()` option, and `net.createConnection()` with the same
options works correctly.

Forward the options through both code paths so `net.Socket`'s
constructor stores them on the internal symbols (`kSetNoDelay`,
`kSetKeepAlive`, `kSetKeepAliveInitialDelay`), which `afterConnect()`
then applies to the handle.

Fixes: #62003
PR-URL: #62004
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: #61916
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: #61992
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #62019
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #62020
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Add execute permission for `tools/dep_updaters/update-merve.sh` so that
the "Tools and deps update" workflow can run it.

PR-URL: #62023
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #62025
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Bumps [minimatch](https://github.com/isaacs/minimatch)
from 3.1.2 to 3.1.3.
- [Changelog](http://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.3)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #61977
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #62016
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #62034
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
PR-URL: #62035
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #62038
Refs: #61987
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61984
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Weixie Cui <cuiweixie@gmail.com>
PR-URL: #61948
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add validateHeaderName/validateHeaderValue checks for non-link
headers and checkInvalidHeaderChar for the Link value in HTTP/1.1
writeEarlyHints, closing a CRLF injection gap where header names
and values were concatenated into the raw response without
validation.

Also tighten linkValueRegExp to reject CR/LF inside the <...>
URL portion of Link header values.

PR-URL: #61897
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Notable changes:

build, doc:
  * use new api doc tooling (flakey5) #57343
sqlite:
  * (SEMVER-MINOR) add limits property to DatabaseSync (Mert Can Altin) #61298
src:
  * (SEMVER-MINOR) add C++ support for diagnostics channels (RafaelGSS) #61869
src,permission:
  * (SEMVER-MINOR) add --permission-audit (RafaelGSS) #61869
test_runner:
  * (SEMVER-MINOR) expose worker ID for concurrent test execution (Ali Hassan) #61394

PR-URL: #62073
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/build
  • @nodejs/performance
  • @nodejs/security-wg
  • @nodejs/tsc

@github-actions github-actions bot added release Issues and PRs related to Node.js releases. v25.x Issues that can be reproduced on v25.x or PRs targeting the v25.x-staging branch. labels Mar 2, 2026
@richardlau richardlau added the request-ci Add this label to start a Jenkins CI on a PR. label Mar 2, 2026
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Mar 2, 2026
@nodejs-github-bot
Copy link
Collaborator

@richardlau richardlau marked this pull request as ready for review March 2, 2026 15:15
@codecov
Copy link

codecov bot commented Mar 2, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.67%. Comparing base (e7f5e71) to head (fc4ec2e).
⚠️ Report is 1 commits behind head on v25.x.

Additional details and impacted files
@@            Coverage Diff             @@
##            v25.x   #62073      +/-   ##
==========================================
+ Coverage   88.84%   89.67%   +0.82%     
==========================================
  Files         680      682       +2     
  Lines      205455   206149     +694     
  Branches    39303    39535     +232     
==========================================
+ Hits       182543   184860    +2317     
+ Misses      15092    13437    -1655     
- Partials     7820     7852      +32     

see 134 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@nodejs-github-bot
Copy link
Collaborator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Issues and PRs related to Node.js releases. v25.x Issues that can be reproduced on v25.x or PRs targeting the v25.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.